@vibedev-si/dsh-vibedev 0.2.7 → 0.3.0

package/lib/index.js

@@ -53,12 +53,14 @@ var AccountService = class {
 		const credential = await this.options.chain.resolve().catch(() => void 0);
 		const source = credential === void 0 ? "none" : credential.kind === "account" ? "host" : credential.kind;
 		const pending = this.options.login.pendingSignIn();
+		const attempt = this.options.login.signInAttempt();
 		const base = {
 			source,
 			models: this.options.models(),
 			links: this.links(),
 			primary: this.options.primary === true,
-			...pending === void 0 ? {} : { pending }
+			...pending === void 0 ? {} : { pending },
+			...attempt === void 0 ? {} : { attempt }
 		};
 		if (credential === void 0) return base;
 		const grantUser = credential.kind === "plugin" ? await this.options.login.user().catch(() => void 0) : void 0;
@@ -82,7 +84,8 @@ var AccountService = class {
 						authorization: `Bearer ${token}`,
 						"user-agent": this.options.userAgent
 					},
-					signal: AbortSignal.timeout(15e3)
+					signal: AbortSignal.timeout(15e3),
+					redirect: "error"
 				});
 				if (!response.ok) return {};
 				const body = record$8(await response.json().catch(() => void 0));
@@ -166,9 +169,11 @@ function json(status, body) {
 	});
 }
 function failure(error) {
+	const candidate = record$8(error)?.code;
+	const code = candidate === "SIGN_IN_REFUSED" || candidate === "SIGN_IN_TIMEOUT" || candidate === "SIGN_IN_CANCELLED" ? candidate : "INTERNAL";
 	return json(500, { error: {
-		code: text$8(record$8(error)?.code) ?? "INTERNAL",
-		message: error instanceof Error ? error.message : String(error)
+		code,
+		message: code === "SIGN_IN_CANCELLED" ? "Sign-in was cancelled. 登录已取消。" : code === "SIGN_IN_TIMEOUT" ? "Sign-in expired. 登录已超时，请重新登录。" : "The account request could not be completed. 账号请求未完成，请查看登录诊断后重试。"
 	} });
 }
 /**
@@ -511,6 +516,32 @@ async function downloadTo(response, temporary, maxBytes, signal) {
 	}
 }
 //#endregion
+//#region src/gateway/origin.ts
+/** Origin boundaries for accounts and durable media state. No endpoint fallback is defined here. */
+/** Production API origin. Storage URLs are returned by the server, not derived from this address. */
+const DEFAULT_GATEWAY_ORIGIN = "https://api.vibedev.studio";
+/** Validate a bare HTTP(S) origin and canonicalize default ports, casing and trailing slash. */
+function normalizeGatewayOrigin(value) {
+	const url = new URL(value.trim());
+	if (!["https:", "http:"].includes(url.protocol) || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("gatewayOrigin must be a bare HTTP(S) origin, without credentials, path, query or fragment.");
+	return url.origin;
+}
+/** Stable, filesystem-safe identity; ports and schemes remain separate boundaries. */
+function gatewayId(origin) {
+	return createHash("sha256").update(normalizeGatewayOrigin(origin)).digest("hex");
+}
+/** Every gateway uses its own namespace; never read the unmarked historical root. */
+function gatewayStateDirectory(root, origin) {
+	return join(root, "gateways", gatewayId(origin));
+}
+/** Ignore the old shared key variable; development requires an explicitly named, gateway-specific variable. */
+function developmentKey(origin, name, env = process.env) {
+	normalizeGatewayOrigin(origin);
+	const key = name.trim();
+	if (key === "" || key === "VIBEDEV_GATEWAY_API_KEY") return void 0;
+	return env[key]?.trim() || void 0;
+}
+//#endregion
 //#region src/auth/credentials.ts
 /**
 * Which VibeDev credential a gateway request carries, in order: the host's
@@ -555,7 +586,10 @@ var CredentialChain = class {
 		else if (credential.kind === "plugin") await this.options.plugin?.reject(credential.token);
 	}
 };
-const GRANT_KEY = credentialKey("dsh-media", "vibedev-session");
+/** Credential identity for one gateway; never consult another gateway's record. */
+function gatewayGrantKey(origin) {
+	return credentialKey("dsh-vibedev", `gateway-${gatewayId(origin)}`);
+}
 function isGrant(value) {
 	const grant = value;
 	return typeof grant === "object" && grant !== null && typeof grant.accessToken === "string" && typeof grant.refreshToken === "string" && typeof grant.expiresAt === "number" && typeof grant.refreshExpiresAt === "number";
@@ -564,11 +598,23 @@ function isGrant(value) {
 * Grant storage: the host's credential store when one is loaded (a grant
 * record the store keeps verbatim), else a private file in the state
 * directory. The device id is not a secret and lives in the state directory.
-* @param stateDir - the plugin state directory.
+* @param root - the plugin state root; the storage selects an origin-specific directory itself.
 * @param credentials - the host's credential store, when loaded.
+* @param selectedOrigin - the issuing gateway; unmarked historical state is never adopted.
 * @returns the storage.
 */
-function grantStorage(stateDir, credentials) {
+function grantStorage(root, credentials, selectedOrigin = DEFAULT_GATEWAY_ORIGIN) {
+	const origin = normalizeGatewayOrigin(selectedOrigin);
+	const key = gatewayGrantKey(origin);
+	const stateDir = gatewayStateDirectory(root, origin);
+	const readGrant = (value) => isGrant(value) && value.gatewayOrigin === origin ? value : void 0;
+	const bind = (grant) => {
+		if (grant.gatewayOrigin !== void 0 && grant.gatewayOrigin !== origin) throw new Error("Cannot store a grant issued by another gateway.");
+		return {
+			...grant,
+			gatewayOrigin: origin
+		};
+	};
 	const sessionFile = join(stateDir, "session.json");
 	const deviceFile = join(stateDir, "device.json");
 	let device;
@@ -581,9 +627,9 @@ function grantStorage(stateDir, credentials) {
 			throw error;
 		}
 		const parsed = JSON.parse(text);
-		return isGrant(parsed) ? parsed : void 0;
+		return readGrant(parsed);
 	};
-	const writeFileGrant = (grant) => writeFileAtomic(sessionFile, new TextEncoder().encode(grant === void 0 ? "null" : JSON.stringify(grant)), { mode: 384 });
+	const writeFileGrant = (grant) => writeFileAtomic(sessionFile, new TextEncoder().encode(grant === void 0 ? "null" : JSON.stringify(bind(grant))), { mode: 384 });
 	const clearFileGrant = async () => {
 		try {
 			await stat(sessionFile);
@@ -599,9 +645,9 @@ function grantStorage(stateDir, credentials) {
 		} catch {}
 	};
 	const readHostGrant = async (store) => {
-		const stored = await store.readRecord(GRANT_KEY);
+		const stored = await store.readRecord(key);
 		if (stored !== void 0) {
-			const grant = stored.kind === "grant" && isGrant(stored.payload) ? stored.payload : void 0;
+			const grant = stored.kind === "grant" ? readGrant(stored.payload) : void 0;
 			if (grant !== void 0) await clearFileGrantQuietly();
 			return grant;
 		}
@@ -612,15 +658,15 @@ function grantStorage(stateDir, credentials) {
 			throw error;
 		}
 		let adopted;
-		await store.modifyRecord(GRANT_KEY, async (current) => {
+		await store.modifyRecord(key, async (current) => {
 			if (current !== void 0) {
-				adopted = current.kind === "grant" && isGrant(current.payload) ? current.payload : void 0;
+				adopted = current.kind === "grant" ? readGrant(current.payload) : void 0;
 				return;
 			}
 			adopted = await readFileGrant();
 			return adopted === void 0 ? void 0 : {
 				kind: "grant",
-				payload: adopted
+				payload: bind(adopted)
 			};
 		});
 		if (adopted !== void 0) await clearFileGrantQuietly();
@@ -636,11 +682,11 @@ function grantStorage(stateDir, credentials) {
 			if (store !== void 0) {
 				if (grant === void 0) {
 					await clearFileGrant();
-					await store.deleteRecord(GRANT_KEY);
+					await store.deleteRecord(key);
 				} else {
-					await store.modifyRecord(GRANT_KEY, () => Promise.resolve({
+					await store.modifyRecord(key, () => Promise.resolve({
 						kind: "grant",
-						payload: grant
+						payload: bind(grant)
 					}));
 					await clearFileGrantQuietly();
 				}
@@ -653,17 +699,17 @@ function grantStorage(stateDir, credentials) {
 			if (store !== void 0) {
 				await readHostGrant(store);
 				let remove = false;
-				await store.modifyRecord(GRANT_KEY, async (current) => {
-					const result = await change(current?.kind === "grant" && isGrant(current.payload) ? current.payload : void 0);
+				await store.modifyRecord(key, async (current) => {
+					const result = await change(current?.kind === "grant" ? readGrant(current.payload) : void 0);
 					if (result.kind === "set") return {
 						kind: "grant",
-						payload: result.grant
+						payload: bind(result.grant)
 					};
 					remove = result.kind === "delete";
 				});
 				if (remove) {
 					await clearFileGrant();
-					await store.deleteRecord(GRANT_KEY);
+					await store.deleteRecord(key);
 				}
 				return;
 			}
@@ -686,6 +732,100 @@ function grantStorage(stateDir, credentials) {
 	};
 }
 //#endregion
+//#region src/auth/sign-in-state.ts
+const REDEEM_PATH = "/api/v1/vibedev/link/redeem";
+const NETWORK_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ECONNABORTED",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"ENETUNREACH",
+	"EHOSTUNREACH",
+	"EPIPE",
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT",
+	"UND_ERR_SOCKET",
+	"CERT_HAS_EXPIRED",
+	"DEPTH_ZERO_SELF_SIGNED_CERT",
+	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+	"ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+const TIMEOUT_CODES = /* @__PURE__ */ new Set([
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT"
+]);
+/** Read only fixed transport codes, never error text, stack, body or arbitrary fields. */
+function transportFailure(error) {
+	let cause = error;
+	let timeout = false;
+	let networkCode;
+	for (let depth = 0; depth < 5 && typeof cause === "object" && cause !== null; depth++) {
+		const value = cause;
+		if (value.name === "TimeoutError") timeout = true;
+		if (typeof value.code === "string" && NETWORK_CODES.has(value.code)) {
+			networkCode ??= value.code;
+			if (TIMEOUT_CODES.has(value.code)) timeout = true;
+		}
+		cause = value.cause;
+	}
+	return {
+		errorCode: timeout ? "timeout" : "network",
+		...networkCode === void 0 ? {} : { networkCode }
+	};
+}
+const EXPLANATIONS = {
+	network: ["无法连接登录网关，请检查网络后重新登录。", "The sign-in gateway could not be reached. Check the connection and start sign-in again."],
+	timeout: ["登录等待或网关请求已超时，请重新登录。", "Sign-in or the gateway request timed out. Start sign-in again."],
+	"gateway-refused": ["登录网关拒绝了请求，请重新登录。", "The gateway refused the sign-in request. Start sign-in again."],
+	"gateway-unavailable": ["登录网关暂时不可用，请稍后重新登录。", "The sign-in gateway is temporarily unavailable. Start sign-in again later."],
+	protocol: ["登录网关返回了无效的凭据格式，请稍后重新登录。", "The gateway returned an invalid credential response. Start sign-in again later."],
+	storage: ["无法准备或保存本地登录凭据，请检查存储权限后重新登录。", "Local sign-in credentials could not be prepared or saved. Check storage permissions and start sign-in again."],
+	callback: ["无法启动或使用本地登录回调，请重新登录。", "The local sign-in callback could not be started or used. Start sign-in again."]
+};
+const STAGES = {
+	listen: ["本地回调监听", "Local callback listener"],
+	device: ["准备本地设备标识", "Preparing the local device identity"],
+	redeem: ["交换登录凭据", "Exchanging sign-in credentials"],
+	persist: ["保存本地凭据", "Saving local credentials"]
+};
+/** A fixed bilingual explanation suitable for exposed rejection messages. */
+function failureMessage(attempt) {
+	const [chinese, english] = EXPLANATIONS[attempt.errorCode ?? "callback"];
+	const stage = attempt.stage === void 0 ? "" : ` ${STAGES[attempt.stage].join(" / ")}; stage=${attempt.stage}.`;
+	const status = attempt.httpStatus === void 0 ? "" : ` HTTP ${attempt.httpStatus}.`;
+	return `${english} ${chinese} errorCode=${attempt.errorCode ?? "callback"}.${stage}${status}`;
+}
+const escapeHtml = (text) => text.replace(/[&<>"']/g, (character) => ({
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+})[character]);
+/** Only our fixed explanation and escaped safe enum/status fields reach the browser. */
+function failurePage(attempt) {
+	return `<h1>Sign-in failed.</h1><p>${escapeHtml(failureMessage(attempt))}</p><p>请回到对话重新登录。</p>`;
+}
+/** Explicit log allowlist; adding fields to the public attempt never expands log output. */
+function attemptLog(event, attempt) {
+	return `dsh-vibedev sign-in ${JSON.stringify({
+		event,
+		id: attempt.id,
+		phase: attempt.phase,
+		gatewayOrigin: attempt.gatewayOrigin,
+		path: REDEEM_PATH,
+		...attempt.stage === void 0 ? {} : { stage: attempt.stage },
+		...attempt.errorCode === void 0 ? {} : { errorCode: attempt.errorCode },
+		...attempt.httpStatus === void 0 ? {} : { httpStatus: attempt.httpStatus },
+		...attempt.networkCode === void 0 ? {} : { networkCode: attempt.networkCode }
+	})}`;
+}
+//#endregion
 //#region src/auth/login.ts
 /**
 * The plugin's own VibeDev sign-in, for hosts whose account service does not
@@ -772,6 +912,7 @@ var PluginLogin = class {
 	readFailureReported = false;
 	refreshing;
 	pending;
+	attempt;
 	listeners = /* @__PURE__ */ new Set();
 	now;
 	origin;
@@ -781,7 +922,7 @@ var PluginLogin = class {
 	constructor(options) {
 		this.options = options;
 		this.now = options.now ?? Date.now;
-		this.origin = options.origin.trim().replace(/\/+$/, "");
+		this.origin = normalizeGatewayOrigin(options.origin);
 	}
 	readStored(notify) {
 		if (this.reading !== void 0) return this.reading;
@@ -816,10 +957,32 @@ var PluginLogin = class {
 		const changed = this.grant?.accessToken !== grant?.accessToken;
 		this.grant = grant;
 		if (!changed) return;
+		this.notify();
+	}
+	notify() {
 		for (const listener of this.listeners) try {
 			listener();
 		} catch {}
 	}
+	/** A copied safe snapshot, retained after completion until the next sign-in. */
+	signInAttempt() {
+		return this.attempt === void 0 ? void 0 : Object.freeze({ ...this.attempt });
+	}
+	logAttempt(event) {
+		if (this.attempt === void 0) return;
+		try {
+			this.options.log?.(attemptLog(event, this.attempt));
+		} catch {}
+	}
+	transition(id, change, event = "phase") {
+		if (this.attempt?.id !== id) return;
+		this.attempt = {
+			...this.attempt,
+			...change
+		};
+		this.logAttempt(event);
+		this.notify();
+	}
 	async save(grant) {
 		await this.options.storage.write(grant);
 		this.adopt(grant);
@@ -842,9 +1005,10 @@ var PluginLogin = class {
 	}
 	/** Whether a sign-in is waiting for the browser, and its link. */
 	pendingSignIn() {
-		return this.pending === void 0 ? void 0 : {
-			url: this.pending.url,
-			expiresAt: this.pending.expiresAt
+		const pending = this.pending;
+		return pending?.url === void 0 ? void 0 : {
+			url: pending.url,
+			expiresAt: pending.expiresAt
 		};
 	}
 	/**
@@ -900,7 +1064,7 @@ var PluginLogin = class {
 					});
 					const body = await response.json().catch(() => void 0);
 					if (response.status === 401 || response.status === 403) {
-						this.options.log?.(`dsh-vibedev: the VibeDev session ended (${text$6(record$6(body)?.reason) ?? response.status}); signed out`);
+						this.options.log?.(`dsh-vibedev: the VibeDev session ended (HTTP ${response.status}); signed out`);
 						outcome = void 0;
 						return { kind: "delete" };
 					}
@@ -927,7 +1091,7 @@ var PluginLogin = class {
 		})();
 		return this.refreshing;
 	}
-	post(path, json, token) {
+	post(path, json, token, signal = AbortSignal.timeout(3e4)) {
 		return (this.options.fetch ?? globalThis.fetch)(`${this.origin}${path}`, {
 			method: "POST",
 			headers: {
@@ -937,7 +1101,8 @@ var PluginLogin = class {
 				...token === void 0 ? {} : { authorization: `Bearer ${token}` }
 			},
 			body: JSON.stringify(json),
-			signal: AbortSignal.timeout(3e4)
+			redirect: "error",
+			signal
 		});
 	}
 	/**
@@ -948,19 +1113,22 @@ var PluginLogin = class {
 	* @returns the authorization link, whether a browser was opened, and the completion.
 	*/
 	async startSignIn(request = {}) {
-		const open = (url) => request.open === false ? Promise.resolve(false) : (this.options.openBrowser ?? openInBrowser)(url);
-		if (this.pending !== void 0 && this.pending.expiresAt > this.now()) {
-			const opened = await open(this.pending.url);
-			return {
-				url: this.pending.url,
-				expiresAt: this.pending.expiresAt,
-				done: this.pending.done,
-				opened
-			};
-		}
+		if (this.pending !== void 0 && !this.pending.committing && this.pending.expiresAt <= this.now()) this.pending.cancel("expired");
+		const active = this.pending ?? this.beginSignIn();
+		const started = await active.ready;
+		const opened = request.open === false || this.pending !== active ? false : await (this.options.openBrowser ?? openInBrowser)(started.url).catch(() => false);
+		return {
+			...started,
+			opened
+		};
+	}
+	beginSignIn() {
 		const verifier = base64url(randomBytes(32));
 		const challenge = base64url(createHash("sha256").update(verifier).digest());
 		const state = base64url(randomBytes(18));
+		const id = randomUUID();
+		const expiresAt = this.now() + (this.options.signInTimeoutMs ?? 3e5);
+		const controller = new AbortController();
 		let resolveDone;
 		let rejectDone;
 		const done = new Promise((resolve, reject) => {
@@ -968,8 +1136,73 @@ var PluginLogin = class {
 			rejectDone = reject;
 		});
 		done.catch(() => void 0);
-		let settled = false;
-		const server = createServer((request, response) => {
+		let resolveReady;
+		let rejectReady;
+		const ready = new Promise((resolve, reject) => {
+			resolveReady = resolve;
+			rejectReady = reject;
+		});
+		ready.catch(() => void 0);
+		let finished = false;
+		let claimed = false;
+		let server;
+		let timer;
+		const finish = () => {
+			finished = true;
+			clearTimeout(timer);
+			server?.close();
+			server?.closeAllConnections?.();
+			if (this.pending === active) this.pending = void 0;
+		};
+		const fail = (failure, phase = "failed") => {
+			const attempt = {
+				...this.attempt,
+				...failure,
+				phase
+			};
+			const error = new MediaError(phase === "cancelled" ? "The sign-in was cancelled." : failureMessage(attempt), phase === "expired" ? "SIGN_IN_TIMEOUT" : phase === "cancelled" ? "SIGN_IN_CANCELLED" : "SIGN_IN_REFUSED", attempt.httpStatus === void 0 ? {} : { status: attempt.httpStatus });
+			finish();
+			controller.abort();
+			this.transition(id, {
+				...failure,
+				phase
+			}, "terminal");
+			rejectReady(error);
+			rejectDone(error);
+			return error;
+		};
+		const active = {
+			id,
+			expiresAt,
+			ready,
+			done,
+			committing: false,
+			cancel: (phase) => {
+				if (!finished && !active.committing) fail(phase === "expired" ? { errorCode: "timeout" } : {}, phase);
+			}
+		};
+		this.pending = active;
+		this.attempt = {
+			id,
+			expiresAt,
+			gatewayOrigin: this.origin,
+			phase: "preparing",
+			stage: "listen"
+		};
+		this.logAttempt("request");
+		this.notify();
+		const live = () => {
+			if (finished || this.pending !== active) return false;
+			if (!active.committing && this.now() >= expiresAt) {
+				active.cancel("expired");
+				return false;
+			}
+			return true;
+		};
+		if (!live()) return active;
+		timer = setTimeout(() => active.cancel("expired"), Math.max(0, expiresAt - this.now()));
+		timer.unref();
+		const callback = (request, response) => {
 			const url = new URL(request.url ?? "/", "http://127.0.0.1");
 			if (url.pathname !== CALLBACK_PATH) {
 				response.writeHead(404).end();
@@ -981,107 +1214,170 @@ var PluginLogin = class {
 					"cache-control": "no-store"
 				}).end(PAGE(title, body));
 			};
-			if (settled) {
-				answer(410, "VibeDev", "<h1>This sign-in link has already been used.</h1><p>此登录链接已使用过。</p>");
+			if (request.method !== "GET") {
+				response.setHeader("allow", "GET");
+				answer(405, "VibeDev", "<h1>Use GET for sign-in.</h1><p>请使用浏览器登录回调。</p>");
 				return;
 			}
-			if (url.searchParams.get("state") !== state || url.searchParams.get("code") === null) {
+			if (claimed || !live()) {
+				answer(410, "VibeDev", "<h1>This sign-in link has already been used.</h1><p>此登录链接已使用过或已失效。</p>");
+				return;
+			}
+			const states = url.searchParams.getAll("state");
+			const codes = url.searchParams.getAll("code");
+			const code = codes[0];
+			if (states.length !== 1 || states[0] !== state || codes.length !== 1 || code === void 0 || code.trim() === "") {
 				answer(400, "VibeDev", "<h1>Sign-in could not be completed.</h1><p>登录未完成：链接无效，请回到对话重新登录。</p>");
 				return;
 			}
-			settled = true;
-			const code = url.searchParams.get("code");
-			this.redeem(code, verifier).then((grant) => {
-				const who = grant.user?.email ?? grant.user?.nickname;
-				answer(200, "VibeDev", `<h1>Signed in to VibeDev${who === void 0 ? "" : ` as ${who.replace(/[<>&"]/g, "")}`}.</h1><p>已登录 VibeDev，可以关闭此页面，回到对话继续。</p><p>You can close this tab and return to the conversation.</p>`);
+			claimed = true;
+			this.transition(id, {
+				phase: "exchanging",
+				stage: "device"
+			}, "request");
+			(async () => {
+				let grant;
+				try {
+					if (!live()) return;
+					const deviceId = await this.options.storage.deviceId();
+					if (!live()) return;
+					this.transition(id, { stage: "redeem" }, "request");
+					if (!live()) return;
+					const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(3e4)]);
+					const response = await this.post(REDEEM_PATH, {
+						code,
+						code_verifier: verifier,
+						token_type: "app",
+						client: this.options.client ?? "vibedev-plugin",
+						device_id: deviceId,
+						device_model: `${platform()}-${arch()}`.slice(0, 128),
+						os_version: release().slice(0, 128)
+					}, void 0, signal);
+					if (!live()) {
+						response.body?.cancel().catch(() => void 0);
+						return;
+					}
+					this.transition(id, { httpStatus: response.status }, "response");
+					if (!live()) {
+						response.body?.cancel().catch(() => void 0);
+						return;
+					}
+					if (!response.ok) {
+						response.body?.cancel().catch(() => void 0);
+						const errorCode = response.status === 429 || response.status >= 500 ? "gateway-unavailable" : response.status >= 400 && response.status < 500 ? "gateway-refused" : "protocol";
+						answer(502, "VibeDev", failurePage({
+							...this.attempt,
+							errorCode
+						}));
+						fail({ errorCode });
+						return;
+					}
+					let body;
+					try {
+						body = await response.json();
+					} catch (error) {
+						if (!live()) return;
+						const transport = transportFailure(error);
+						const failure = transport.networkCode !== void 0 || transport.errorCode === "timeout" ? transport : { errorCode: "protocol" };
+						answer(502, "VibeDev", failurePage({
+							...this.attempt,
+							...failure
+						}));
+						fail(failure);
+						return;
+					}
+					if (!live()) return;
+					const envelope = record$6(body);
+					const parsed = envelope !== void 0 && (envelope.code === void 0 || envelope.code === 0) && (envelope.data === void 0 || record$6(envelope.data) !== void 0) ? parseGrant(body, this.now()) : void 0;
+					if (parsed === void 0) {
+						answer(502, "VibeDev", failurePage({
+							...this.attempt,
+							errorCode: "protocol"
+						}));
+						fail({ errorCode: "protocol" });
+						return;
+					}
+					grant = parsed;
+					active.committing = true;
+					clearTimeout(timer);
+					this.transition(id, {
+						phase: "committing",
+						stage: "persist"
+					});
+					await this.save(grant);
+				} catch (error) {
+					if (finished || this.pending !== active) return;
+					const failure = this.attempt?.stage === "device" || this.attempt?.stage === "persist" ? { errorCode: "storage" } : transportFailure(error);
+					answer(502, "VibeDev", failurePage({
+						...this.attempt,
+						...failure
+					}));
+					fail(failure);
+					return;
+				}
+				answer(200, "VibeDev", "<h1>Signed in to VibeDev.</h1><p>已登录 VibeDev，可以关闭此页面，回到对话继续。</p><p>You can close this tab and return to the conversation.</p>");
 				finish();
+				this.transition(id, { phase: "succeeded" }, "terminal");
 				resolveDone(grant);
-			}, (error) => {
-				answer(502, "VibeDev", "<h1>Sign-in failed.</h1><p>登录失败，请回到对话重新登录。</p>");
-				finish();
-				rejectDone(error instanceof Error ? error : new Error(String(error)));
+			})();
+		};
+		try {
+			server = createServer(callback);
+			server.on("error", () => {
+				if (finished || active.committing) return;
+				this.transition(id, { stage: "listen" });
+				if (!finished) fail({ errorCode: "callback" });
 			});
-		});
-		await new Promise((resolve, reject) => {
-			server.once("error", reject);
 			server.listen(0, "127.0.0.1", () => {
-				server.off("error", reject);
-				resolve();
-			});
-		});
-		const callback = `http://127.0.0.1:${server.address().port}${CALLBACK_PATH}`;
-		const url = `${this.origin}/vibedev-link?${new URLSearchParams({
-			callback,
-			state,
-			response_type: "code",
-			code_challenge: challenge,
-			code_challenge_method: "S256",
-			client: this.options.client ?? "vibedev-plugin"
-		}).toString()}`;
-		const timeoutMs = this.options.signInTimeoutMs ?? 3e5;
-		const timer = setTimeout(() => {
-			if (settled) return;
-			settled = true;
-			finish();
-			rejectDone(new MediaError("The VibeDev sign-in was not completed in time.", "SIGN_IN_TIMEOUT"));
-		}, timeoutMs);
-		timer.unref();
-		const finish = () => {
-			clearTimeout(timer);
-			server.close();
-			server.closeAllConnections?.();
-			if (this.pending?.server === server) this.pending = void 0;
-		};
-		this.pending = {
-			url,
-			expiresAt: this.now() + timeoutMs,
-			done,
-			server,
-			cancel: (reason) => {
-				if (!settled) {
-					settled = true;
-					finish();
-					rejectDone(reason);
+				if (!live()) {
+					server?.close();
+					server?.closeAllConnections?.();
+					return;
 				}
-			}
-		};
-		const opened = await open(url);
-		return {
-			url,
-			expiresAt: this.now() + timeoutMs,
-			done,
-			opened
-		};
-	}
-	async redeem(code, verifier) {
-		const response = await this.post("/api/v1/vibedev/link/redeem", {
-			code,
-			code_verifier: verifier,
-			token_type: "app",
-			client: this.options.client ?? "vibedev-plugin",
-			device_id: await this.options.storage.deviceId(),
-			device_model: `${platform()}-${arch()}`.slice(0, 128),
-			os_version: release().slice(0, 128)
-		});
-		const body = await response.json().catch(() => void 0);
-		if (!response.ok) throw new MediaError(`The VibeDev gateway refused the sign-in (HTTP ${response.status}${text$6(record$6(body)?.reason) === void 0 ? "" : `, ${text$6(record$6(body)?.reason)}`}).`, "SIGN_IN_REFUSED", { status: response.status });
-		const grant = parseGrant(body, this.now());
-		if (grant === void 0) throw new MediaError("The VibeDev gateway returned no tokens for the sign-in.", "SIGN_IN_REFUSED");
-		await this.save(grant);
-		return grant;
+				const port = (server?.address()).port;
+				const url = `${this.origin}/vibedev-link?${new URLSearchParams({
+					callback: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+					state,
+					response_type: "code",
+					code_challenge: challenge,
+					code_challenge_method: "S256",
+					client: this.options.client ?? "vibedev-plugin"
+				}).toString()}`;
+				active.url = url;
+				this.transition(id, {
+					phase: "waiting-browser",
+					stage: void 0
+				});
+				if (live()) resolveReady({
+					url,
+					expiresAt,
+					done
+				});
+			});
+		} catch {
+			if (!finished) fail({ errorCode: "callback" });
+		}
+		return active;
 	}
 	/** Sign out: revoke the session at the gateway (best effort) and forget it. */
 	async signOut() {
+		const attemptId = this.attempt?.id;
+		const pending = this.pending;
+		if (pending?.committing) await pending.done.catch(() => void 0);
+		else pending?.cancel("cancelled");
 		await this.load();
 		const grant = this.grant;
-		this.pending?.cancel(new MediaError("The sign-in was cancelled.", "SIGN_IN_CANCELLED"));
+		if (grant !== void 0) await this.save(void 0);
+		if (this.attempt?.id === attemptId && this.pending === void 0) {
+			this.attempt = void 0;
+			this.notify();
+		}
 		if (grant === void 0) return;
-		await this.save(void 0);
 		await this.post("/api/v1/vibedev/app-token/revoke", { refresh_token: grant.refreshToken }, grant.accessToken).then((response) => response.body?.cancel(), () => void 0);
 	}
 	/** Stop a waiting sign-in. */
 	dispose() {
-		this.pending?.cancel(new MediaError("The plugin stopped before the sign-in finished.", "SIGN_IN_CANCELLED"));
+		this.pending?.cancel("cancelled");
 	}
 };
 //#endregion
@@ -2495,7 +2791,12 @@ var GatewayAdapter = class extends LlmAdapter {
 					const token = credential.token;
 					let response;
 					const observingFetch = async (input, init) => {
-						const received = await fetch(input, init);
+						const url = input instanceof Request ? input.url : String(input);
+						if (new URL(url).origin !== snapshot.origin) throw new Error("Refusing a model request to another gateway origin.");
+						const received = await fetch(input, {
+							...init,
+							redirect: "error"
+						});
 						response = {
 							status: received.status,
 							headers: Object.fromEntries(received.headers.entries())
@@ -3141,7 +3442,7 @@ var GatewayHttp = class {
 				method: request.method ?? (body === void 0 ? "GET" : "POST"),
 				headers,
 				...body === void 0 ? {} : { body },
-				redirect: "follow",
+				redirect: "error",
 				signal
 			});
 		} catch (error) {
@@ -4591,7 +4892,7 @@ const text$2 = (value) => typeof value === "string" && value.trim() !== "" ? val
 const noPaths = { readPath: () => Promise.reject(new MediaError("The gateway returned an unexpected image reference.", "GATEWAY_BAD_RESPONSE")) };
 /**
 * Read the images of an `/v1/images/*` answer: `b64_json`, a `data:` URL, or a link.
-* @param runtime - for authenticated downloads of gateway links.
+* @param runtime - for downloading the gateway's full signed result URLs.
 * @param body - the parsed answer.
 * @param signal - cancels downloads.
 * @returns the images and the revised prompt, when the model returned one.
@@ -4611,7 +4912,7 @@ async function decodeImages(runtime, body, signal) {
 		else if (url?.startsWith("data:") === true) data = (await loadMedia(url, noPaths, MAX_OUTPUT_BYTES)).data;
 		else if (url !== void 0 && /^https?:\/\//i.test(url)) {
 			const response = await runtime.http.send(url, {
-				anonymous: !runtime.http.isGatewayUrl(url),
+				anonymous: true,
 				headers: { accept: "*/*" },
 				timeoutMs: 12e4,
 				signal
@@ -6516,19 +6817,15 @@ var TaskTracker = class {
 			missing
 		};
 	}
-	/** Download one output: the authenticated `/content` route, then the gateway's no-login link. */
+	/** Use a returned signed URL verbatim and without the app token; old gateways without a URL use `/content`. */
 	async fetchOutput(record, task, output, temporary) {
 		const spec = SPECS[record.kind];
 		const sources = [];
-		if (record.kind === "video") sources.push({
-			url: spec.content(task.id, output.index),
-			anonymous: false
-		});
 		if (output.url !== void 0) sources.push({
 			url: output.url,
 			anonymous: true
 		});
-		if (record.kind === "audio") sources.push({
+		else sources.push({
 			url: spec.content(task.id, output.index),
 			anonymous: false
 		});
@@ -6561,8 +6858,6 @@ var TaskTracker = class {
 * Settings → VibeDev 账号; this is the agent's way to the same sign-in.
 * @module dsh-vibedev/tools/account
 */
-/** Where new users register. */
-const REGISTER_URL = "https://vibedev.jzsaas.com";
 /**
 * Build the tool.
 * @param runtime - the media runtime.
@@ -6643,7 +6938,7 @@ function mediaAccountTool(runtime, chain, login) {
 			return {
 				source,
 				signInUrl: started.url,
-				message: `${started.opened ? "Opened the VibeDev sign-in page in the user's browser." : "Could not open a browser."} If it did not appear, give the user this link: ${started.url} — new users can register on that page (or at ${REGISTER_URL}). The sign-in completes in the background within ${minutes} minutes; once the user says they are done, retry the request.`
+				message: `${started.opened ? "Opened the VibeDev sign-in page in the user's browser." : "Could not open a browser."} If it did not appear, give the user this link: ${started.url} — new users can register on that page (or at ${runtime.http.origin}). The sign-in completes in the background within ${minutes} minutes; once the user says they are done, retry the request.`
 			};
 		}
 	});
@@ -7263,10 +7558,10 @@ const Config = Schema.object({
 	musicModel: Schema.string().default("").volatile(),
 	podcastModel: Schema.string().default("").volatile(),
 	transcriptionModel: Schema.string().default("").volatile(),
-	gatewayOrigin: Schema.string().default("https://vibedev.jzsaas.com"),
+	gatewayOrigin: Schema.string().default(DEFAULT_GATEWAY_ORIGIN),
 	client: Schema.string().default("vibedev-plugin"),
 	primary: Schema.boolean().default(false),
-	apiKeyEnv: Schema.string().default("VIBEDEV_GATEWAY_API_KEY"),
+	apiKeyEnv: Schema.string().default(""),
 	stateDir: Schema.string().default("")
 }).i18n({
 	"zh-CN": {
@@ -7308,13 +7603,13 @@ const Config = Schema.object({
 });
 const GUIDANCE = "VibeDev media tools: image_generate, video_generate, audio_generate (music or a podcast) and audio_transcribe create and transcribe media with the user's VibeDev account; media_models lists models and prices. Use them on your own judgment whenever generated media serves the request (illustrations, product shots, storyboard frames, short clips, background music, a podcast episode), not only when a tool is named. They spend the user's balance, so make what the request needs rather than speculative variations. Results are saved in the workspace under media/. Pass files the user attached in this chat as chat:1 (the most recent), chat:2, and so on. Video and audio run as background jobs: carry on and let the job notification report the result.";
 function apply(ctx, config) {
-	const origin = config.gatewayOrigin.trim().replace(/\/+$/, "");
+	const origin = normalizeGatewayOrigin(config.gatewayOrigin);
 	const stateDir = stateDirectory(config.stateDir);
 	const userAgent = `vibedev-plugin/${version}`;
 	const warn = (message) => {
 		ctx.logger.warn(message);
 	};
-	const storage = grantStorage(stateDir, () => ctx.get("credentials"));
+	const storage = grantStorage(stateDir, () => ctx.get("credentials"), origin);
 	const login = new PluginLogin({
 		origin,
 		userAgent,
@@ -7325,7 +7620,7 @@ function apply(ctx, config) {
 	});
 	ctx.inject(["credentials"], (scoped) => {
 		scoped.on("credentials/record-updated", (key) => {
-			if (key === GRANT_KEY) login.restore();
+			if (key === gatewayGrantKey(origin)) login.restore();
 		});
 		scoped.effect(async () => {
 			await login.restore();
@@ -7336,7 +7631,7 @@ function apply(ctx, config) {
 		origin,
 		plugin: login,
 		account: () => ctx.get("deepseekAccount"),
-		apiKey: () => config.apiKeyEnv.trim() === "" ? void 0 : process.env[config.apiKeyEnv.trim()]?.trim()
+		apiKey: () => developmentKey(origin, config.apiKeyEnv)
 	});
 	const http = new GatewayHttp({
 		origin,
@@ -7344,7 +7639,7 @@ function apply(ctx, config) {
 		resolveCredential: () => chain.resolve(),
 		rejectToken: (credential) => chain.reject(credential)
 	});
-	const store = new TaskStore(stateDir);
+	const store = new TaskStore(gatewayStateDirectory(stateDir, origin));
 	const tracker = new TaskTracker({
 		http,
 		store,