@omnicross/daemon 0.1.3 → 0.1.5

package/dist/index.js

@@ -38,6 +38,7 @@ var CodexOAuthSessionStore = class {
   ttlMs;
   sessions = /* @__PURE__ */ new Map();
   activeSessionId = null;
+  aborters = /* @__PURE__ */ new Map();
   /** Whether a codex sign-in is currently in flight (port 1455 held). */
   isBusy() {
     this.sweep();
@@ -49,13 +50,22 @@ var CodexOAuthSessionStore = class {
     const sessionId = crypto.randomBytes(24).toString("base64url");
     this.sessions.set(sessionId, { status: "pending", createdAt: Date.now() });
     this.activeSessionId = sessionId;
-    return sessionId;
+    const controller = new AbortController();
+    this.aborters.set(sessionId, controller);
+    return { sessionId, signal: controller.signal };
   }
   /** Settle a flow (done/error) + free the active slot. */
   settle(sessionId, status, error) {
     const prior = this.sessions.get(sessionId);
     this.sessions.set(sessionId, { status, error, createdAt: prior?.createdAt ?? Date.now() });
     if (this.activeSessionId === sessionId) this.activeSessionId = null;
+    this.aborters.delete(sessionId);
+  }
+  cancel(sessionId) {
+    if (!this.sessions.has(sessionId)) return false;
+    this.aborters.get(sessionId)?.abort();
+    this.settle(sessionId, "error", "login: cancelled");
+    return true;
   }
   /** Read a flow's status (token-free), or null when unknown/expired. */
   get(sessionId) {
@@ -84,13 +94,13 @@ function handleCodexOAuthStart(deps) {
     );
   }
   const { authUrl, codeVerifier, state } = codexOAuth.generateAuthParams();
-  const sessionId = deps.codexSessions.begin();
-  void runCodexLoopback(sessionId, codeVerifier, state, deps);
+  const { sessionId, signal } = deps.codexSessions.begin();
+  void runCodexLoopback(sessionId, codeVerifier, state, signal, deps);
   return { status: 200, body: { authUrl, sessionId } };
 }
-async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
+async function runCodexLoopback(sessionId, codeVerifier, state, signal, deps) {
   try {
-    const code = await deps.codexAwaitLoopback(state);
+    const code = await deps.codexAwaitLoopback(state, void 0, signal);
     const result = await codexOAuth.exchangeCodeForTokens(
       { authorizationCode: code, codeVerifier, state },
       deps.oauthExchangeFetch
@@ -112,6 +122,10 @@ async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
     deps.codexSessions.settle(sessionId, "error", reason);
   }
 }
+function handleCodexOAuthCancel(sessionId, deps) {
+  if (!deps.codexSessions.cancel(sessionId)) return err(404, "unknown or expired codex sign-in session");
+  return { status: 200, body: { ok: true } };
+}
 function handleCodexOAuthStatus(sessionId, deps) {
   const s = deps.codexSessions.get(sessionId);
   if (!s) return err(404, "unknown or expired codex sign-in session");
@@ -1874,12 +1888,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+import { join as join3 } from "path";
 import { setAuditCaptureConfig, setAuditSink } from "@omnicross/core/pipeline/auditSink";
+import { setUpstreamTracePath } from "@omnicross/core/pipeline/upstreamTrace";
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -1891,9 +1909,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    setUpstreamTracePath(config.captureBodies ? join3(auditDir, "upstream-trace.jsonl") : null);
   } else {
     setAuditCaptureConfig(null);
     setAuditSink(null);
+    setUpstreamTracePath(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -1903,9 +1923,11 @@ function applyAuditConfig(config) {
 function resetAuditRuntimeForTests() {
   setAuditCaptureConfig(null);
   setAuditSink(null);
+  setUpstreamTracePath(null);
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
+  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -3520,6 +3542,10 @@ async function handleAccounts(req, res, method, rest, deps) {
     const result = handleCodexOAuthStatus(rest[2], deps);
     return writeJson2(res, result.status, result.body);
   }
+  if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
+    const result = handleCodexOAuthCancel(rest[2], deps);
+    return writeJson2(res, result.status, result.body);
+  }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) {
@@ -3859,7 +3885,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.3" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -4114,7 +4140,7 @@ var DEFAULT_TIMEOUT_MS = 5 * 6e4;
 function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
-function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
+function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
@@ -4148,6 +4174,12 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
       res.end(pageHtml("Login complete."));
       finish(server, () => resolve(code));
     });
+    const abort = () => finish(server, () => reject(new Error("login: cancelled")));
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+    signal?.addEventListener("abort", abort, { once: true });
     server.on("error", (err5) => {
       if (settled) return;
       settled = true;
@@ -4235,21 +4267,21 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 function defaultVouchersPath(configPath) {
-  return join3(dirname2(configPath), "vouchers.json");
+  return join4(dirname2(configPath), "vouchers.json");
 }
 function defaultPricingPath(configPath) {
-  return join3(dirname2(configPath), "pricing.json");
+  return join4(dirname2(configPath), "pricing.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return join3(dirname2(configPath), "usage-events.jsonl");
+  return join4(dirname2(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return join3(dirname2(configPath), "audit");
+  return join4(dirname2(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return join3(dirname2(configPath), "billing");
+  return join4(dirname2(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
@@ -5335,9 +5367,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function externalStorePath(provider, home = homedir2()) {
-  return provider === "claude" ? join4(home, ".claude", ".credentials.json") : join4(home, ".codex", "auth.json");
+  return provider === "claude" ? join5(home, ".claude", ".credentials.json") : join5(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -6456,7 +6488,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 import { existsSync as existsSync11, readdirSync, unlinkSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6482,8 +6514,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6539,7 +6571,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          unlinkSync(join5(this.auditDir, file));
+          unlinkSync(join6(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6563,14 +6595,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync11 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!existsSync12(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!existsSync12(auditDir2)) return [];
   let files;
   try {
-    files = readdirSync2(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = readdirSync2(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6581,7 +6613,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = readFileSync11(join6(auditDir, file), "utf8");
+      raw = readFileSync11(join7(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6611,10 +6643,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6647,7 +6679,7 @@ var AuditWriter = class {
       mkdirSync4(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = join7(this.auditDir, auditFileName(record.ts));
+    const file = join8(this.auditDir, auditFileName(record.ts));
     appendFileSync2(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6655,7 +6687,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync5 } from "fs";
 import { createHmac } from "crypto";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -6726,7 +6758,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join8(this.billingDir, billingFileName(event.ts));
+    const file = join9(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6776,7 +6808,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join8(this.billingDir, deliveredFileName(event.ts));
+      const file = join9(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6793,7 +6825,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync12 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!existsSync13(billingDir)) return view;
@@ -6830,7 +6862,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync12(join9(dir, file), "utf8");
+    raw = readFileSync12(join10(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7271,7 +7303,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7312,7 +7344,7 @@ function buildDaemon(config, paths) {
     // the app polls the token-free status. A test seam (`paths.codexAwaitLoopback`)
     // can inject a mock so no real port is bound.
     codexSessions: new CodexOAuthSessionStore(),
-    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs) => awaitLoopbackCode(state, timeoutMs)),
+    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs, signal) => awaitLoopbackCode(state, timeoutMs, signal)),
     // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
     // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
@@ -7347,7 +7379,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7357,9 +7389,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => fetchUpstream6(url, init)
   });
   setWebhookRuntime(webhookDispatcher, getSharedAccountHealth2());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@omnicross/daemon",
-  "version": "0.1.3",
-  "description": "Omnicross standalone daemon — the bare-Node embedder of @omnicross/core with an admin HTTP API + dashboard.",
+  "version": "0.1.5",
+  "description": "Omnicross standalone daemon 鈥?the bare-Node embedder of @omnicross/core with an admin HTTP API + dashboard.",
   "license": "MIT",
   "author": "Sayo (https://github.com/Dumoedss)",
   "homepage": "https://github.com/Dumoedss/omnicross#readme",