@sunshaobei/dsh-codex-auth 3.0.3 → 3.0.4

package/lib/index.js

@@ -384,6 +384,50 @@ function registerCodexAuthRpc(ctx, credentials, phase) {
     };
     ctx.effect(() => ctx.webServer.register(route), 'dsh-codex-auth: rpc channel');
 }
+// ---------------------------------------------------------------------------
+// silent token refresh (runs once per app start; no timers)
+// ---------------------------------------------------------------------------
+const REFRESH_AHEAD_MS = 60 * 60 * 1000;      // only refresh when < 1 hour left
+
+async function silentRefresh(credentials) {
+    try {
+        const record = await credentials.readRecord(CRED_KEY);
+        const payload = record && record.kind === 'grant' ? record.payload : undefined;
+        if (!payload || payload.type !== 'oauth' || !payload.refresh)
+            return;
+        const msLeft = typeof payload.expires === 'number' ? payload.expires - Date.now() : 0;
+        if (msLeft > REFRESH_AHEAD_MS)
+            return; // still fresh; nothing to do
+        const res = await fetch(TOKEN_URL, {
+            method: 'POST',
+            signal: AbortSignal.timeout(30000),
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                client_id: CLIENT_ID,
+                refresh_token: payload.refresh,
+            }),
+        });
+        if (!res.ok)
+            return; // keep the old grant; user can re-authorize if it expires
+        const json = await res.json().catch(() => undefined);
+        if (!json || typeof json.access_token !== 'string' || json.access_token.length === 0)
+            return;
+        const next = {
+            ...payload,
+            access: json.access_token,
+            refresh: typeof json.refresh_token === 'string' && json.refresh_token.length > 0 ? json.refresh_token : payload.refresh,
+            expires: Date.now() + Number(json.expires_in ?? 0) * 1000,
+        };
+        if (!(next.expires > Date.now()))
+            return;
+        await credentials.modifyRecord(CRED_KEY, async () => ({ kind: 'grant', payload: next }));
+    }
+    catch {
+        // silent: keep the old grant on any failure
+    }
+}
+
 // ---------------------------------------------------------------------------
 // plugin entry
 // ---------------------------------------------------------------------------
@@ -391,4 +435,5 @@ export function apply(ctx, _config = {}) {
     const credentials = ctx.credentials;
     const phase = { phase: 'idle' };
     registerCodexAuthRpc(ctx, credentials, phase);
+    void silentRefresh(credentials);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sunshaobei/dsh-codex-auth",
   "description": "Codex 订阅授权管理 for the dsh web surface: a dedicated settings page (authorization status, validity/expiry, one-click browser OAuth) plus an expired-credential modal when a GPT model is selected. Host half runs the full OpenAI OAuth flow (PKCE S256, localhost:1455 callback) and writes the llm-pi-ai/openai-codex grant record through ctx.credentials.",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",