@tnnevol/dsh-codex-auth 0.1.2-rc.1.4 → 0.1.7-rc.2

package/lib/index.d.ts

@@ -100,10 +100,24 @@ declare class CodexWebAuth {
   private challenge;
   private challengeWaiters;
   private challengeTimer;
+  /** 用户点「取消」后由 `cancel()` 独占最终状态写入。 */
+  private cancelled;
   constructor(store: CodexCredentialStore, challengeTimeoutMs?: number, mirror?: CodexCredentialMirror | undefined);
   status(): Promise<CodexWebAuthStatus>;
   signIn(): Promise<CodexLoginChallenge>;
   signOut(): Promise<void>;
+  /**
+   * Stop an in-flight sign-in without touching stored credentials.
+   *
+   * 与 `signOut()` 的区别：这里只回收本次未完成的授权（中止 device-code
+   * 轮询、拒绝还在等的 challenge 请求、清掉一次性授权码），不删除已保存的
+   * 凭据。用户点「取消」时走这条路径——他们放弃的是**这次**登录，不是已经
+   * 登录的账号。
+   *
+   * 只有用户主动取消才会调用它。授权窗口自行关闭**不是**放弃信号：授权成功
+   * 后授权页会自己关闭，若据此取消就会中止正在进行的轮询并丢掉刚取得的凭据。
+   */
+  cancel(): Promise<void>;
   dispose(): Promise<void>;
   private start;
   private onEvent;

package/lib/index.js

@@ -1,5 +1,5 @@
-import { a as CodexCredentialStore, i as CODEX_PROVIDER, n as loginCodex, r as logoutCodex, t as codexAuthStatus } from "./auth-DQlapSCa.js";
-import { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_STATUS_PATH, CODEX_GLOBAL_MODEL_PATH, CODEX_MODEL_REFRESH_PATH, CODEX_USAGE_PATH } from "./auth-paths.js";
+import { a as CODEX_PROVIDER, i as CodexCredentialStore, n as loginCodex, r as logoutCodex, t as codexAuthStatus } from "./auth-BQNZ__ZK.js";
+import { CODEX_AUTH_CANCEL_PATH, CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_STATUS_PATH, CODEX_GLOBAL_MODEL_PATH, CODEX_MODEL_REFRESH_PATH, CODEX_USAGE_PATH } from "./auth-paths.js";
 import { createModels, defaultProviderAuthContext } from "@earendil-works/pi-ai";
 import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
@@ -332,7 +332,13 @@ async function refreshCodexModelCatalog(store, fetchImpl = fetch) {
 }
 //#endregion
 //#region src/host/auth-routes.ts
-const CODEX_AUTH_URL_TIMEOUT_MS = 3e4;
+/**
+* 等 OpenAI 返回设备授权码（授权 URL）的上限。
+*
+* 拿到设备码后这个计时器就清掉了（见 `onEvent`），因此它**不**约束用户在浏览器
+* 里完成授权的时间——那段由 pi-ai 自己的设备码轮询窗口兜底。
+*/
+const CODEX_AUTH_URL_TIMEOUT_MS = 12e4;
 const REMOTE_WEB_ORIGIN_NOT_TRUSTED = "remote-web-origin-not-trusted";
 const CODEX_USAGE_UNAVAILABLE = "codex-usage-unavailable";
 const CODEX_GLOBAL_MODEL_INVALID = "codex-global-model-invalid";
@@ -368,6 +374,8 @@ var CodexWebAuth = class {
 	challenge;
 	challengeWaiters = [];
 	challengeTimer;
+	/** 用户点「取消」后由 `cancel()` 独占最终状态写入。 */
+	cancelled = false;
 	constructor(store, challengeTimeoutMs = CODEX_AUTH_URL_TIMEOUT_MS, mirror) {
 		this.store = store;
 		this.challengeTimeoutMs = challengeTimeoutMs;
@@ -396,13 +404,30 @@ var CodexWebAuth = class {
 		});
 	}
 	async signOut() {
-		this.cancelSignIn(/* @__PURE__ */ new Error("Codex sign-in cancelled"));
-		await this.operation?.catch(() => void 0);
+		await this.cancel();
 		await logoutCodex(this.store);
 		await this.mirror?.clear();
-		this.challenge = void 0;
 		this.state = { status: "signed-out" };
 	}
+	/**
+	* Stop an in-flight sign-in without touching stored credentials.
+	*
+	* 与 `signOut()` 的区别：这里只回收本次未完成的授权（中止 device-code
+	* 轮询、拒绝还在等的 challenge 请求、清掉一次性授权码），不删除已保存的
+	* 凭据。用户点「取消」时走这条路径——他们放弃的是**这次**登录，不是已经
+	* 登录的账号。
+	*
+	* 只有用户主动取消才会调用它。授权窗口自行关闭**不是**放弃信号：授权成功
+	* 后授权页会自己关闭，若据此取消就会中止正在进行的轮询并丢掉刚取得的凭据。
+	*/
+	async cancel() {
+		this.cancelled = true;
+		this.cancelSignIn(/* @__PURE__ */ new Error("Codex sign-in cancelled"));
+		this.challenge = void 0;
+		await this.operation?.catch(() => void 0);
+		const stored = await codexAuthStatus(this.store);
+		this.state = stored.authenticated ? signedInStatus(stored.expiresAt) : { status: "signed-out" };
+	}
 	async dispose() {
 		this.cancelSignIn(/* @__PURE__ */ new Error("Codex auth plugin disposed"));
 		await this.operation?.catch(() => void 0);
@@ -410,6 +435,7 @@ var CodexWebAuth = class {
 	start() {
 		const cancellation = new AbortController();
 		this.cancellation = cancellation;
+		this.cancelled = false;
 		this.challenge = void 0;
 		this.state = { status: "signing-in" };
 		this.challengeTimer = setTimeout(() => {
@@ -426,6 +452,7 @@ var CodexWebAuth = class {
 				this.onEvent(event);
 			}
 		}, this.store).then(async () => {
+			if (this.cancelled) return;
 			if (this.challenge === void 0) {
 				const error = /* @__PURE__ */ new Error("Codex sign-in finished without an authorization code");
 				this.rejectChallenge(error);
@@ -440,6 +467,7 @@ var CodexWebAuth = class {
 			this.state = stored.authenticated ? signedInStatus(stored.expiresAt) : { status: "signed-out" };
 		}, (error) => {
 			this.rejectChallenge(error);
+			if (this.cancelled) return;
 			this.state = {
 				status: "error",
 				message: safeMessage(error)
@@ -691,6 +719,20 @@ function registerCodexAuthRoutes(ctx, store, mirror) {
 					}
 				}
 			}),
+			ctx.webServer.register({
+				kind: "exact",
+				path: CODEX_AUTH_CANCEL_PATH,
+				handler: async (req, res) => {
+					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+					if (!authorize(req, res)) return;
+					try {
+						await auth.cancel();
+						json(res, 200, { ok: true });
+					} catch (error) {
+						json(res, 500, { error: safeMessage(error) });
+					}
+				}
+			}),
 			ctx.webServer.register({
 				kind: "exact",
 				path: CODEX_AUTH_LOGOUT_PATH,
@@ -823,7 +865,8 @@ function createCodexAdapter(credentials, resolveAttachments) {
 		requestImageMaxBytes: CODEX_REQUEST_IMAGE_MAX_BYTES,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-codex-auth-plugin retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
-		piProvider: requestProvider(provider)
+		piProvider: requestProvider(provider),
+		modelErrors: /* @__PURE__ */ new Map()
 	}]]);
 	const models = createModels({ credentials });
 	models.setProvider(provider);