@omnicross/daemon 0.1.3 → 0.1.5

package/dist/index.cjs

@@ -80,6 +80,7 @@ var CodexOAuthSessionStore = class {
   ttlMs;
   sessions = /* @__PURE__ */ new Map();
   activeSessionId = null;
+  aborters = /* @__PURE__ */ new Map();
   /** Whether a codex sign-in is currently in flight (port 1455 held). */
   isBusy() {
     this.sweep();
@@ -91,13 +92,22 @@ var CodexOAuthSessionStore = class {
     const sessionId = import_node_crypto.default.randomBytes(24).toString("base64url");
     this.sessions.set(sessionId, { status: "pending", createdAt: Date.now() });
     this.activeSessionId = sessionId;
-    return sessionId;
+    const controller = new AbortController();
+    this.aborters.set(sessionId, controller);
+    return { sessionId, signal: controller.signal };
   }
   /** Settle a flow (done/error) + free the active slot. */
   settle(sessionId, status, error) {
     const prior = this.sessions.get(sessionId);
     this.sessions.set(sessionId, { status, error, createdAt: prior?.createdAt ?? Date.now() });
     if (this.activeSessionId === sessionId) this.activeSessionId = null;
+    this.aborters.delete(sessionId);
+  }
+  cancel(sessionId) {
+    if (!this.sessions.has(sessionId)) return false;
+    this.aborters.get(sessionId)?.abort();
+    this.settle(sessionId, "error", "login: cancelled");
+    return true;
   }
   /** Read a flow's status (token-free), or null when unknown/expired. */
   get(sessionId) {
@@ -126,13 +136,13 @@ function handleCodexOAuthStart(deps) {
     );
   }
   const { authUrl, codeVerifier, state } = import_subscriptions.codexOAuth.generateAuthParams();
-  const sessionId = deps.codexSessions.begin();
-  void runCodexLoopback(sessionId, codeVerifier, state, deps);
+  const { sessionId, signal } = deps.codexSessions.begin();
+  void runCodexLoopback(sessionId, codeVerifier, state, signal, deps);
   return { status: 200, body: { authUrl, sessionId } };
 }
-async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
+async function runCodexLoopback(sessionId, codeVerifier, state, signal, deps) {
   try {
-    const code = await deps.codexAwaitLoopback(state);
+    const code = await deps.codexAwaitLoopback(state, void 0, signal);
     const result = await import_subscriptions.codexOAuth.exchangeCodeForTokens(
       { authorizationCode: code, codeVerifier, state },
       deps.oauthExchangeFetch
@@ -154,6 +164,10 @@ async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
     deps.codexSessions.settle(sessionId, "error", reason);
   }
 }
+function handleCodexOAuthCancel(sessionId, deps) {
+  if (!deps.codexSessions.cancel(sessionId)) return err(404, "unknown or expired codex sign-in session");
+  return { status: 200, body: { ok: true } };
+}
 function handleCodexOAuthStatus(sessionId, deps) {
   const s = deps.codexSessions.get(sessionId);
   if (!s) return err(404, "unknown or expired codex sign-in session");
@@ -1889,12 +1903,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+var import_node_path3 = require("path");
 var import_auditSink = require("@omnicross/core/pipeline/auditSink");
+var import_upstreamTrace = require("@omnicross/core/pipeline/upstreamTrace");
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -1906,9 +1924,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    (0, import_upstreamTrace.setUpstreamTracePath)(config.captureBodies ? (0, import_node_path3.join)(auditDir, "upstream-trace.jsonl") : null);
   } else {
     (0, import_auditSink.setAuditCaptureConfig)(null);
     (0, import_auditSink.setAuditSink)(null);
+    (0, import_upstreamTrace.setUpstreamTracePath)(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -1918,9 +1938,11 @@ function applyAuditConfig(config) {
 function resetAuditRuntimeForTests() {
   (0, import_auditSink.setAuditCaptureConfig)(null);
   (0, import_auditSink.setAuditSink)(null);
+  (0, import_upstreamTrace.setUpstreamTracePath)(null);
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
+  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -3535,6 +3557,10 @@ async function handleAccounts(req, res, method, rest, deps) {
     const result = handleCodexOAuthStatus(rest[2], deps);
     return writeJson2(res, result.status, result.body);
   }
+  if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
+    const result = handleCodexOAuthCancel(rest[2], deps);
+    return writeJson2(res, result.status, result.body);
+  }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) {
@@ -3782,7 +3808,7 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 var import_node_fs4 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_module = require("module");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
 var import_meta = {};
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -3803,13 +3829,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return (0, import_node_fs4.existsSync)(import_node_path3.default.join(fromEnv, "index.html")) ? import_node_path3.default.resolve(fromEnv) : null;
+    return (0, import_node_fs4.existsSync)(import_node_path4.default.join(fromEnv, "index.html")) ? import_node_path4.default.resolve(fromEnv) : null;
   }
   try {
     const req = (0, import_node_module.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
-    const dist = import_node_path3.default.join(import_node_path3.default.dirname(pkgJson), "dist");
-    return (0, import_node_fs4.existsSync)(import_node_path3.default.join(dist, "index.html")) ? dist : null;
+    const dist = import_node_path4.default.join(import_node_path4.default.dirname(pkgJson), "dist");
+    return (0, import_node_fs4.existsSync)(import_node_path4.default.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -3851,16 +3877,16 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
     return true;
   }
-  const filePath = import_node_path3.default.resolve(uiDist, rel === "" ? "index.html" : rel);
-  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path3.default.sep)) {
+  const filePath = import_node_path4.default.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path4.default.sep)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
     return true;
   }
   let target = filePath;
   if (!(0, import_node_fs4.existsSync)(target) || (0, import_node_fs4.statSync)(target).isDirectory()) {
-    if (import_node_path3.default.extname(rel) === "") {
-      target = import_node_path3.default.join(uiDist, "index.html");
+    if (import_node_path4.default.extname(rel) === "") {
+      target = import_node_path4.default.join(uiDist, "index.html");
     } else {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
@@ -3868,14 +3894,14 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     }
   }
   const body = await (0, import_promises.readFile)(target);
-  const type = CONTENT_TYPES[import_node_path3.default.extname(target).toLowerCase()] ?? "application/octet-stream";
+  const type = CONTENT_TYPES[import_node_path4.default.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
   return true;
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.3" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -4130,7 +4156,7 @@ var DEFAULT_TIMEOUT_MS = 5 * 6e4;
 function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
-function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
+function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
@@ -4164,6 +4190,12 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
       res.end(pageHtml("Login complete."));
       finish(server, () => resolve(code));
     });
+    const abort = () => finish(server, () => reject(new Error("login: cancelled")));
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+    signal?.addEventListener("abort", abort, { once: true });
     server.on("error", (err5) => {
       if (settled) return;
       settled = true;
@@ -4251,21 +4283,21 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-var import_node_path4 = require("path");
+var import_node_path5 = require("path");
 function defaultVouchersPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "vouchers.json");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "vouchers.json");
 }
 function defaultPricingPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "pricing.json");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "pricing.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "usage-events.jsonl");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "audit");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "billing");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
@@ -5262,7 +5294,7 @@ var JsonVoucherDb = class {
 
 // src/ports/JsonSubscriptionCredentialStore.ts
 var import_node_fs13 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
@@ -5344,9 +5376,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 var import_node_fs11 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 function externalStorePath(provider, home = (0, import_node_os2.homedir)()) {
-  return provider === "claude" ? (0, import_node_path5.join)(home, ".claude", ".credentials.json") : (0, import_node_path5.join)(home, ".codex", "auth.json");
+  return provider === "claude" ? (0, import_node_path6.join)(home, ".claude", ".credentials.json") : (0, import_node_path6.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -5409,7 +5441,7 @@ function readExternalCliCredentials(provider, home = (0, import_node_os2.homedir
 // src/ports/external-cli-store.ts
 var import_node_fs12 = require("fs");
 var import_node_os3 = require("os");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function markerPath(provider, home) {
   return `${externalStorePath(provider, home)}.omnicross-managed`;
 }
@@ -5444,7 +5476,7 @@ function readExistingObject(path2) {
   }
 }
 function writeAtomic(path2, content) {
-  (0, import_node_fs12.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path7.dirname)(path2), { recursive: true });
   const temp = `${path2}.omnicross-tmp`;
   (0, import_node_fs12.writeFileSync)(temp, content, "utf8");
   (0, import_node_fs12.renameSync)(temp, path2);
@@ -6115,7 +6147,7 @@ var JsonSubscriptionCredentialStore = class {
    *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
    *  write — incl. child 4's future refresh writes — lands encrypted. */
   persist(config) {
-    (0, import_node_fs13.mkdirSync)((0, import_node_path7.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs13.mkdirSync)((0, import_node_path8.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
     (0, import_node_fs13.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
@@ -6465,7 +6497,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 var import_node_fs14 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6491,8 +6523,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6548,7 +6580,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          (0, import_node_fs14.unlinkSync)((0, import_node_path8.join)(this.auditDir, file));
+          (0, import_node_fs14.unlinkSync)((0, import_node_path9.join)(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6572,14 +6604,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 var import_node_fs15 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!(0, import_node_fs15.existsSync)(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!(0, import_node_fs15.existsSync)(auditDir2)) return [];
   let files;
   try {
-    files = (0, import_node_fs15.readdirSync)(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = (0, import_node_fs15.readdirSync)(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6590,7 +6622,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = (0, import_node_fs15.readFileSync)((0, import_node_path9.join)(auditDir, file), "utf8");
+      raw = (0, import_node_fs15.readFileSync)((0, import_node_path10.join)(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6620,10 +6652,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 var import_node_fs16 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6656,7 +6688,7 @@ var AuditWriter = class {
       (0, import_node_fs16.mkdirSync)(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = (0, import_node_path10.join)(this.auditDir, auditFileName(record.ts));
+    const file = (0, import_node_path11.join)(this.auditDir, auditFileName(record.ts));
     (0, import_node_fs16.appendFileSync)(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6664,7 +6696,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 var import_node_fs17 = require("fs");
 var import_node_crypto10 = require("crypto");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
@@ -6735,7 +6767,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = (0, import_node_path11.join)(this.billingDir, billingFileName(event.ts));
+    const file = (0, import_node_path12.join)(this.billingDir, billingFileName(event.ts));
     (0, import_node_fs17.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6785,7 +6817,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = (0, import_node_path11.join)(this.billingDir, deliveredFileName(event.ts));
+      const file = (0, import_node_path12.join)(this.billingDir, deliveredFileName(event.ts));
       (0, import_node_fs17.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6802,7 +6834,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 var import_node_fs18 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!(0, import_node_fs18.existsSync)(billingDir)) return view;
@@ -6839,7 +6871,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs18.readFileSync)((0, import_node_path12.join)(dir, file), "utf8");
+    raw = (0, import_node_fs18.readFileSync)((0, import_node_path13.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7280,7 +7312,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7321,7 +7353,7 @@ function buildDaemon(config, paths) {
     // the app polls the token-free status. A test seam (`paths.codexAwaitLoopback`)
     // can inject a mock so no real port is bound.
     codexSessions: new CodexOAuthSessionStore(),
-    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs) => awaitLoopbackCode(state, timeoutMs)),
+    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs, signal) => awaitLoopbackCode(state, timeoutMs, signal)),
     // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
     // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
@@ -7356,7 +7388,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7366,9 +7398,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,

package/dist/index.d.cts

@@ -1048,7 +1048,7 @@ interface SubscriptionAccountAppender {
  */
 
 /** The loopback-listener fn (injected so tests need not bind a real port). */
-type CodexLoopbackFn = (state: string, timeoutMs?: number) => Promise<string>;
+type CodexLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
 /** One codex sign-in flow's polled status (NEVER carries a token). */
 interface CodexFlowState {
     status: 'pending' | 'done' | 'error';
@@ -1066,13 +1066,18 @@ declare class CodexOAuthSessionStore {
     private readonly ttlMs;
     private readonly sessions;
     private activeSessionId;
+    private readonly aborters;
     constructor(ttlMs?: number);
     /** Whether a codex sign-in is currently in flight (port 1455 held). */
     isBusy(): boolean;
     /** Mint a fresh sessionId, mark it pending + active, return the id. */
-    begin(): string;
+    begin(): {
+        sessionId: string;
+        signal: AbortSignal;
+    };
     /** Settle a flow (done/error) + free the active slot. */
     settle(sessionId: string, status: 'done' | 'error', error?: string): void;
+    cancel(sessionId: string): boolean;
     /** Read a flow's status (token-free), or null when unknown/expired. */
     get(sessionId: string): CodexFlowState | null;
     /** Drop expired flows; free the active slot if the active flow expired. */

package/dist/index.d.ts

@@ -1048,7 +1048,7 @@ interface SubscriptionAccountAppender {
  */
 
 /** The loopback-listener fn (injected so tests need not bind a real port). */
-type CodexLoopbackFn = (state: string, timeoutMs?: number) => Promise<string>;
+type CodexLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
 /** One codex sign-in flow's polled status (NEVER carries a token). */
 interface CodexFlowState {
     status: 'pending' | 'done' | 'error';
@@ -1066,13 +1066,18 @@ declare class CodexOAuthSessionStore {
     private readonly ttlMs;
     private readonly sessions;
     private activeSessionId;
+    private readonly aborters;
     constructor(ttlMs?: number);
     /** Whether a codex sign-in is currently in flight (port 1455 held). */
     isBusy(): boolean;
     /** Mint a fresh sessionId, mark it pending + active, return the id. */
-    begin(): string;
+    begin(): {
+        sessionId: string;
+        signal: AbortSignal;
+    };
     /** Settle a flow (done/error) + free the active slot. */
     settle(sessionId: string, status: 'done' | 'error', error?: string): void;
+    cancel(sessionId: string): boolean;
     /** Read a flow's status (token-free), or null when unknown/expired. */
     get(sessionId: string): CodexFlowState | null;
     /** Drop expired flows; free the active slot if the active flow expired. */