clay-server 4.7.1-beta.4 → 4.8.0-beta.1

package/lib/public/modules/vendor-login.js

@@ -15,6 +15,7 @@ import { getWs } from './ws-ref.js';
 import { refreshIcons, iconHtml } from './icons.js';
 import { openTuiModal, closeTuiModal, getTuiModalTerminalId } from './tui-attention.js';
 import { forwardPaneAuthRequired } from './pane-bridge.js';
+import { openLoginBrowser, closeLoginBrowser } from './vendor-login-browser.js';
 
 // vendor -> { terminalId, startedAt } as last broadcast by the server.
 var activeFlows = Object.create(null);
@@ -106,7 +107,7 @@ function showLoginStartedBanner(vendor) {
   showLoginBanner({
     icon: "check-circle",
     title: vendorDisplayName(vendor) + " login started",
-    text: "Finish the sign-in in the terminal. Clay reloads the credentials on its own, so your sessions keep working - no new session needed.",
+    text: "Finish sign-in in the window below. Clay reconnects your sessions automatically.",
     onDismiss: function () { cancelVendorLogin(vendor); },
   });
 }
@@ -169,6 +170,7 @@ export function requestVendorLogin(vendor, opts) {
     vendor: target,
     auto: !!options.auto,
     sessionId: options.sessionId || store.get('activeSessionId') || null,
+    mode: options.mode || ((target === "claude" || target === "codex") ? "browser" : "terminal"),
   }));
   showLoginStartedBanner(target);
   return true;
@@ -177,13 +179,17 @@ export function requestVendorLogin(vendor, opts) {
 export function cancelVendorLogin(vendor) {
   var target = vendor || modalVendor;
   if (!target) return;
+  var flow = activeFlows[target];
+  var browser = store.get('vendorLoginBrowser');
+  var browserId = flow && flow.browserId || (browser && browser.vendor === target ? browser.browserId : null);
+  if (browser && browser.vendor === target) closeLoginBrowser();
   delete pendingStarts[target];
   delete activeFlows[target];
   clearLoginBanners();
   if (modalVendor === target) closeModalInternally();
   var ws = getWs();
   if (ws && ws.readyState === 1) {
-    ws.send(JSON.stringify({ type: "vendor_login_cancel", vendor: target }));
+    ws.send(JSON.stringify({ type: "vendor_login_cancel", vendor: target, browserId: browserId }));
   }
 }
 
@@ -215,7 +221,11 @@ export function handleVendorLoginReady(msg) {
   if (!msg || typeof msg.terminalId !== "number") return;
   var vendor = msg.vendor || "claude";
   delete pendingStarts[vendor];
-  activeFlows[vendor] = { terminalId: msg.terminalId, startedAt: Date.now() };
+  activeFlows[vendor] = { terminalId: msg.terminalId, startedAt: Date.now(), browserId: msg.browserId || null };
+  if (msg.browserId) {
+    openLoginBrowser(msg);
+    return;
+  }
 
   var slug = msg.slug || currentProjectSlug();
   if (!slug) return;
@@ -239,7 +249,7 @@ export function handleVendorLoginState(msg) {
   var next = Object.create(null);
   var flows = msg.flows || [];
   for (var i = 0; i < flows.length; i++) {
-    next[flows[i].vendor] = { terminalId: flows[i].terminalId, startedAt: flows[i].startedAt };
+    next[flows[i].vendor] = { terminalId: flows[i].terminalId, startedAt: flows[i].startedAt, browserId: flows[i].browserId || null };
     delete pendingStarts[flows[i].vendor];
   }
 
@@ -253,11 +263,18 @@ export function handleVendorLoginState(msg) {
     }
   }
   activeFlows = next;
+  var browser = store.get('vendorLoginBrowser');
+  if (browser && (!next[browser.vendor] || next[browser.vendor].browserId !== browser.browserId)) {
+    closeLoginBrowser();
+    clearLoginBanners();
+  }
 }
 
 export function handleAuthRefreshed(msg) {
   if (!msg) return;
   var vendor = msg.vendor || "claude";
+  var browser = store.get('vendorLoginBrowser');
+  if (browser && browser.vendor === vendor) closeLoginBrowser();
   var flow = activeFlows[vendor];
   delete pendingStarts[vendor];
   delete activeFlows[vendor];
@@ -269,6 +286,8 @@ export function handleAuthRefreshed(msg) {
 export function handleVendorLoginError(msg) {
   if (!msg) return;
   var vendor = msg.vendor || "claude";
+  var browser = store.get('vendorLoginBrowser');
+  if (browser && browser.vendor === vendor) closeLoginBrowser();
   delete pendingStarts[vendor];
   delete activeFlows[vendor];
   if (modalVendor === vendor) closeModalInternally();

package/lib/public/style.css

@@ -1,4 +1,5 @@
 @import url("css/session-github.css");
+@import url("css/vendor-login-browser.css");
 @import url("css/issues.css");
 @import url("css/base.css?v=20260828-type1");
 @import url("css/icon-strip.css?v=20260828-surfaces4");

package/lib/terminal.js

@@ -25,6 +25,10 @@ function createTerminal(cwd, cols, rows, osUserInfo, opts) {
 
   // Build a minimal, isolated environment (no daemon env leakage)
   var termEnv = buildUserEnv(osUserInfo);
+  if (opts && opts.loginBrowserEnv) {
+    termEnv.BROWSER = opts.loginBrowserEnv.BROWSER;
+    termEnv.CLAY_LOGIN_URL_FILE = opts.loginBrowserEnv.CLAY_LOGIN_URL_FILE;
+  }
   var spawnOpts = {
     name: "xterm-256color",
     cols: cols || 80,

package/lib/vendor-login-browser-flow.js

@@ -0,0 +1,46 @@
+var createLoginBrowser = require("./vendor-login-browser").createLoginBrowser;
+
+function attachBrowserLogin(ctx) {
+  function allowed(ws, flow) {
+    var userId = ws && ws._clayUser ? String(ws._clayUser.id) : null;
+    return userId === flow.ownerId && ctx.hasTerminalPermission(ws);
+  }
+  function prepare(ws, flow, identity) {
+    if (ctx.osUsers && !identity.osUserInfo) throw new Error("OS user identity is unavailable");
+    flow.ownerId = ws && ws._clayUser ? String(ws._clayUser.id) : null;
+    flow.browser = (ctx.createLoginBrowser || createLoginBrowser)({
+      ws: ws, vendor: flow.vendor, osUserInfo: identity.osUserInfo,
+      sendTo: ctx.sendTo,
+      canAccess: function (peer) { return allowed(peer, flow); },
+    });
+    flow.expiryTimer = setTimeout(function () { ctx.cancel(flow.key); }, 15 * 60 * 1000);
+    flow.expiryTimer.unref();
+  }
+  function handle(ws, msg, flows) {
+    var flow = flows[ctx.flowKey(ws, String(msg.vendor || "claude"))];
+    if (msg.type === "vendor_login_cancel" && msg.browserId && (!flow || !flow.browser)) return true;
+    if (typeof msg.type === "string" && msg.type.indexOf("term_") === 0) {
+      var vendors = Object.keys(flows);
+      for (var i = 0; i < vendors.length; i++) {
+        var candidate = flows[vendors[i]];
+        if (candidate.terminalId === msg.id && !allowed(ws, candidate)) return true;
+      }
+    }
+    if (msg.type === "vendor_login_browser_attach" || msg.type === "vendor_login_browser_input") {
+      if (!flow || !flow.browser || flow.browser.id !== msg.browserId || !allowed(ws, flow)) return true;
+      if (msg.type === "vendor_login_browser_attach") flow.browser.attach(ws);
+      else flow.browser.input(ws, msg.event);
+      return true;
+    }
+    if (flow && flow.browser && (msg.type === "vendor_login_start" || msg.type === "vendor_login_cancel")) {
+      if (!allowed(ws, flow) || (msg.type === "vendor_login_cancel" && msg.browserId !== flow.browser.id)) {
+        ctx.sendTo(ws, { type: "vendor_login_error", vendor: msg.vendor, error: "This sign-in belongs to another request. Reopen sign-in to continue." });
+        return true;
+      }
+    }
+    return false;
+  }
+  return { prepare: prepare, handle: handle };
+}
+
+module.exports = { attachBrowserLogin: attachBrowserLogin };

package/lib/vendor-login-browser-passkeys.js

@@ -0,0 +1,27 @@
+// Runs before page scripts in each remote sign-in page, frame, and popup.
+function disableLoginPasskeys() {
+  var credentials = window.CredentialsContainer && window.CredentialsContainer.prototype;
+  if (credentials) {
+    ["get", "create"].forEach(function (method) {
+      var original = credentials[method];
+      if (typeof original !== "function") return;
+      Object.defineProperty(credentials, method, {
+        configurable: true,
+        writable: true,
+        value: function (options) {
+          if (options && "publicKey" in Object(options)) {
+            return Promise.reject(new DOMException(
+              "Passkeys are unavailable in this remote sign-in browser. Choose another sign-in method.",
+              "NotSupportedError"
+            ));
+          }
+          return original.apply(this, arguments);
+        },
+      });
+    });
+  }
+  // Feature detection should choose password/email instead of host-native authenticator UI.
+  Object.defineProperty(window, "PublicKeyCredential", { configurable: true, writable: true, value: undefined });
+}
+
+module.exports = { disableLoginPasskeys: disableLoginPasskeys };

package/lib/vendor-login-browser-worker.js

@@ -0,0 +1,149 @@
+// Runs as the same OS identity as the login CLI. Only the human supplies input.
+var readline = require("readline");
+var spawn = require("child_process").spawn;
+var chromium = require("playwright").chromium;
+var browser = null;
+var page = null;
+var installing = null;
+var viewing = true;
+var closing = false;
+var captureTimer = null;
+var inputQueue = Promise.resolve();
+var queued = 0;
+var viewport = { width: 1000, height: 720 };
+
+function emit(message) {
+  if (!closing && process.stdout.writableLength < 1024 * 1024) process.stdout.write(JSON.stringify(message) + "\n");
+}
+
+function status(text, phase) { emit({ type: "status", text: text, phase: phase || "loading" }); }
+
+async function launch() {
+  var channels = ["chrome", "msedge", null];
+  for (var i = 0; i < channels.length; i++) {
+    try {
+      return await chromium.launch({ channel: channels[i] || undefined, headless: true, chromiumSandbox: true, timeout: 20000 });
+    } catch (e) {
+      if (closing) throw e;
+    }
+  }
+  status("Preparing the sign-in browser. The first download may take a few minutes…");
+  await new Promise(function (resolve, reject) {
+    installing = spawn(process.execPath, [require("path").join(require.resolve("playwright/package.json"), "../cli.js"), "install", "chromium"], { stdio: "ignore", env: process.env });
+    var timer = setTimeout(function () { installing.kill(); reject(new Error("Install timed out")); }, 180000);
+    installing.once("error", function (err) { clearTimeout(timer); reject(err); });
+    installing.once("exit", function (code) {
+      clearTimeout(timer);
+      installing = null;
+      if (code === 0) resolve(); else reject(new Error("Browser installation failed"));
+    });
+  });
+  if (closing) throw new Error("Closed");
+  return chromium.launch({ headless: true, chromiumSandbox: true, timeout: 20000 });
+}
+
+async function capture() {
+  if (closing) return;
+  try {
+    if (page && !page.isClosed() && viewing && process.stdout.writableLength < 262144) {
+      var current = page;
+      var data = await current.screenshot({ type: "jpeg", quality: 65, caret: "initial", timeout: 3000 });
+      if (current === page) emit({ type: "frame", data: data.toString("base64"), origin: new URL(current.url()).origin,
+        width: current.viewportSize().width, height: current.viewportSize().height });
+    }
+  } catch (e) {}
+  if (!closing) captureTimer = setTimeout(capture, 250);
+}
+
+async function start(url) {
+  browser = await launch();
+  if (closing) { await browser.close(); return; }
+  var session = await browser.newBrowserCDPSession();
+  var version;
+  try { version = await session.send("Browser.getVersion"); }
+  finally { await session.detach(); }
+  // Preserve the native version/platform and replace only the headless product token.
+  var userAgent = version.userAgent.replace("HeadlessChrome/", "Chrome/");
+  var context = await browser.newContext({ viewport: viewport, acceptDownloads: false, userAgent: userAgent });
+  await context.addInitScript(require("./vendor-login-browser-passkeys").disableLoginPasskeys);
+  var callback = new URL(new URL(url).searchParams.get("redirect_uri"));
+  await context.route("**/*", function (route) {
+    var target = new URL(route.request().url());
+    if (target.protocol === "https:" || (target.origin === callback.origin && target.pathname === callback.pathname)) return route.continue();
+    return route.abort();
+  });
+  context.on("page", function (opened) {
+    page = opened;
+    opened.setViewportSize(viewport).catch(function () {});
+    opened.on("download", function (download) { download.cancel().catch(function () {}); });
+    opened.on("close", function () {
+      var pages = context.pages();
+      page = pages.length ? pages[pages.length - 1] : null;
+    });
+  });
+  page = await context.newPage();
+  capture();
+  status("Opening sign-in page…");
+  await page.goto(url, { waitUntil: "domcontentloaded", timeout: 60000 });
+  status("Sign in to connect your account.", "ready");
+}
+
+async function input(event) {
+  if (!page || page.isClosed() || closing) return;
+  if (["move", "down", "up"].indexOf(event.kind) >= 0 && Number.isFinite(event.x) && Number.isFinite(event.y)) {
+    var pointerSize = page.viewportSize();
+    var x = Math.max(0, Math.min(pointerSize.width - 1, event.x));
+    var y = Math.max(0, Math.min(pointerSize.height - 1, event.y));
+    await page.mouse.move(x, y);
+    if (event.kind === "down") await page.mouse.down();
+    if (event.kind === "up") await page.mouse.up();
+  } else if (event.kind === "click" && Number.isFinite(event.x) && Number.isFinite(event.y)) {
+    var size = page.viewportSize();
+    await page.mouse.click(Math.max(0, Math.min(size.width - 1, event.x)), Math.max(0, Math.min(size.height - 1, event.y)));
+  } else if (event.kind === "wheel" && Number.isFinite(event.deltaY)) {
+    await page.mouse.wheel(0, Math.max(-1500, Math.min(1500, event.deltaY)));
+  } else if (event.kind === "text" && typeof event.text === "string" && event.text.length <= 4096) {
+    await page.keyboard.insertText(event.text);
+  } else if (event.kind === "key" && /^(Tab|Shift\+Tab|Enter|Backspace|Delete|Escape|ArrowLeft|ArrowRight|ArrowUp|ArrowDown|Home|End|ControlOrMeta\+A)$/.test(event.key)) {
+    await page.keyboard.press(event.key);
+  } else if (event.kind === "reload") {
+    await page.reload({ waitUntil: "domcontentloaded", timeout: 30000 });
+  } else if (event.kind === "resize" && Number.isFinite(event.width) && Number.isFinite(event.height)) {
+    viewport = { width: Math.round(Math.max(320, Math.min(1000, event.width))), height: Math.round(Math.max(360, Math.min(720, event.height))) };
+    await page.setViewportSize(viewport);
+  }
+}
+
+async function close() {
+  if (closing) return;
+  closing = true;
+  clearTimeout(captureTimer);
+  if (installing) installing.kill();
+  if (browser) await browser.close().catch(function () {});
+  process.exit(0);
+}
+
+var started = false;
+var lines = readline.createInterface({ input: process.stdin });
+lines.on("line", function (line) {
+  if (line.length > 20000 || closing) return;
+  var message;
+  try { message = JSON.parse(line); } catch (e) { return; }
+  if (message.type === "start" && !started) {
+    started = true;
+    start(message.url).catch(function () {
+      status("Unable to open the sign-in browser. The host may need browser libraries or sandbox support. Use terminal sign-in to continue.", "error");
+    });
+  } else if (message.type === "viewing") {
+    viewing = !!message.value;
+  } else if (message.type === "input" && message.event && queued < 100) {
+    if (message.event.kind === "move" && queued >= 10) return;
+    queued++;
+    inputQueue = inputQueue.then(function () { return input(message.event); }).catch(function () {
+      status("The page did not respond. Try reloading.", "error");
+    }).finally(function () { queued--; });
+  }
+});
+lines.on("close", close);
+process.on("SIGTERM", close);
+process.on("SIGINT", close);

package/lib/vendor-login-browser.js

@@ -0,0 +1,162 @@
+// Private, human-controlled browser transport for a single vendor login.
+var fs = require("fs");
+var os = require("os");
+var path = require("path");
+var crypto = require("crypto");
+var spawn = require("child_process").spawn;
+var buildUserEnv = require("./build-user-env").buildUserEnv;
+var wrapSpawnAsUser = require("./os-users").wrapSpawnAsUser;
+
+function loginUrl(value, vendor) {
+  try {
+    var url = new URL(value);
+    var hosts = vendor === "codex" ? ["auth.openai.com"] : ["claude.ai", "claude.com", "console.anthropic.com", "platform.claude.com"];
+    if (url.protocol !== "https:" || url.username || url.password || hosts.indexOf(url.hostname) < 0) return null;
+    if (!url.searchParams.get("state") || !url.searchParams.get("code_challenge")) return null;
+    var callback = new URL(url.searchParams.get("redirect_uri"));
+    if (callback.protocol !== "http:" || ["localhost", "127.0.0.1", "[::1]"].indexOf(callback.hostname) < 0) return null;
+    return url.href;
+  } catch (e) { return null; }
+}
+
+function createLoginBrowser(options) {
+  var id = crypto.randomUUID();
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "clay-login-"));
+  fs.chmodSync(dir, 0o700);
+  var info = options.osUserInfo;
+  if (info) fs.chownSync(dir, info.uid, info.gid);
+  var urlFile = path.join(dir, "url");
+  var opener = path.resolve(__dirname, "../bin/login-browser-open.js");
+  var wrapper = path.join(dir, process.platform === "win32" ? "open.cmd" : "open");
+  var quote = function (value) { return "'" + value.replace(/'/g, "'\\''") + "'"; };
+  var script = process.platform === "win32"
+    ? '@"' + process.execPath + '" "' + opener + '" %*\r\n'
+    : "#!/bin/sh\nexec " + quote(process.execPath) + " " + quote(opener) + ' "$@"\n';
+  fs.writeFileSync(wrapper, script, { mode: 0o700 });
+  if (info) fs.chownSync(wrapper, info.uid, info.gid);
+  var child = null;
+  var peer = options.ws;
+  var closed = false;
+  var started = false;
+  var status = "Waiting for the sign-in page…";
+  var statusPhase = "loading";
+  var tail = "";
+  var pollBusy = false;
+  var waitTimer = setTimeout(function () {
+    if (!started && !closed) {
+      status = "Still waiting for the CLI sign-in page. Use terminal sign-in if it needs attention.";
+      send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
+    }
+  }, 30000);
+  waitTimer.unref();
+
+  function send(message) {
+    if (closed || !peer || peer.readyState !== 1 || !options.canAccess(peer)) return;
+    if (message.type === "vendor_login_browser_frame" && peer.bufferedAmount > 1024 * 1024) return;
+    options.sendTo(peer, Object.assign({ vendor: options.vendor, browserId: id }, message));
+  }
+  function write(message) {
+    if (child && child.stdin.writable && child.stdin.writableLength < 65536) child.stdin.write(JSON.stringify(message) + "\n");
+  }
+  function start(url) {
+    if (closed || started) return;
+    started = true;
+    clearTimeout(waitTimer);
+    status = "Opening a private sign-in browser…";
+    send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
+    var env = buildUserEnv(info);
+    if (process.platform === "win32" && !info) {
+      ["SystemRoot", "WINDIR", "TEMP", "TMP", "LOCALAPPDATA", "APPDATA", "USERPROFILE", "COMSPEC", "PATHEXT"].forEach(function (key) {
+        if (process.env[key]) env[key] = process.env[key];
+      });
+    }
+    var opts = { cwd: info ? info.home : os.homedir(), env: env, stdio: ["pipe", "pipe", "ignore"] };
+    if (info) { opts.uid = info.uid; opts.gid = info.gid; }
+    var spec = wrapSpawnAsUser(process.execPath, [path.join(__dirname, "vendor-login-browser-worker.js")], opts);
+    child = spawn(spec.command, spec.args, spec.options);
+    var buffer = "";
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", function (chunk) {
+      buffer += chunk;
+      if (buffer.length > 4 * 1024 * 1024) { child.kill(); return; }
+      var at;
+      while ((at = buffer.indexOf("\n")) >= 0) {
+        var line = buffer.slice(0, at);
+        buffer = buffer.slice(at + 1);
+        try {
+          var message = JSON.parse(line);
+          if (message.type === "status") {
+            status = message.text;
+            statusPhase = message.phase || "loading";
+            send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
+          } else if (message.type === "frame") {
+            send({ type: "vendor_login_browser_frame", data: message.data, origin: message.origin, width: message.width, height: message.height });
+            write({ type: "viewing", value: !!(peer && peer.readyState === 1 && options.canAccess(peer)) });
+          }
+        } catch (e) {}
+      }
+    });
+    child.on("error", function () {
+      statusPhase = "error";
+      status = "The sign-in browser could not start. Use terminal sign-in to continue.";
+      send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
+    });
+    child.on("exit", function () {
+      if (closed) return;
+      statusPhase = "error";
+      status = "The sign-in browser closed. You can retry or use terminal sign-in.";
+      send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
+    });
+    child.stdin.on("error", function () {});
+    write({ type: "start", url: url });
+  }
+  function acceptUrl(value) {
+    var url = loginUrl(value, options.vendor);
+    if (url) start(url);
+  }
+  var timer = setInterval(function () {
+    if (closed || started || pollBusy) return;
+    pollBusy = true;
+    fs.readFile(urlFile, "utf8", function (err, value) {
+      pollBusy = false;
+      if (!err && value.length <= 16384) acceptUrl(value);
+    });
+  }, 250);
+  timer.unref();
+  return {
+    id: id,
+    env: { BROWSER: wrapper, CLAY_LOGIN_URL_FILE: urlFile },
+    output: function (chunk) {
+      // Codex also prints the complete URL when the platform opener ignores BROWSER.
+      tail = (tail + chunk).slice(-32768);
+      var matches = tail.match(/https:\/\/[^\s\x1b<>"']+(?=[\s\x1b<>"'])/g) || [];
+      for (var i = 0; i < matches.length; i++) acceptUrl(matches[i]);
+    },
+    attach: function (ws) {
+      peer = ws;
+      send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
+      write({ type: "viewing", value: true });
+    },
+    input: function (ws, event) {
+      if (ws !== peer || !options.canAccess(ws) || !event || typeof event !== "object") return;
+      write({ type: "input", event: event });
+    },
+    close: function () {
+      if (closed) return;
+      closed = true;
+      clearInterval(timer);
+      clearTimeout(waitTimer);
+      if (child) {
+        child.stdin.end();
+        var killTimer = setTimeout(function () { child.kill("SIGKILL"); }, 5000);
+        killTimer.unref();
+        child.once("exit", function () { clearTimeout(killTimer); });
+      }
+      fs.rmSync(dir, { recursive: true, force: true });
+      tail = "";
+      peer = null;
+    },
+  };
+}
+
+module.exports = { createLoginBrowser: createLoginBrowser, loginUrl: loginUrl };

package/lib/ws-schema.js

@@ -220,6 +220,10 @@ var schema = {
   // -----------------------------------------------------------------------
   "auth_required":            { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Authentication required (e.g. API key needed)" },
   "vendor_login_start":       { direction: "c2s", handler: "lib/project-vendor-login.js", description: "Start (or re-attach to) the per-vendor login terminal" },
+  "vendor_login_browser_attach": { direction: "c2s", handler: "lib/vendor-login-browser-flow.js", description: "Attach the sign-in owner to their private browser" },
+  "vendor_login_browser_input": { direction: "c2s", handler: "lib/vendor-login-browser-flow.js", description: "Send human input to the private sign-in browser" },
+  "vendor_login_browser_frame": { direction: "s2c", handler: "lib/public/modules/vendor-login-browser.js", description: "Private sign-in viewport; never recorded in conversation history" },
+  "vendor_login_browser_status": { direction: "s2c", handler: "lib/public/modules/vendor-login-browser.js", description: "Private sign-in browser status" },
   "vendor_login_cancel":      { direction: "c2s", handler: "lib/project-vendor-login.js", description: "Dismiss the login flow and kill its terminal" },
   "vendor_login_state_request": { direction: "c2s", handler: "lib/project-vendor-login.js", description: "Ask for the project's active login flows" },
   "vendor_login_ready":       { direction: "s2c", handler: "lib/public/modules/vendor-login.js", description: "Login terminal is available; open/re-attach the modal to it" },

package/lib/yoke/adapters/codex.js

@@ -14,6 +14,7 @@ var { resolveOsUserInfo } = require("../../os-users");
 var backgroundTasks = require("../codex-background-tasks");
 var codexUserInput = require("../codex-user-input");
 var createTurnStop = require("../codex-turn-stop").createTurnStop;
+var idleRecovery = require("../codex-idle-recovery");
 
 // --- Reasoning defaults ---
 // Reasoning summaries are the only readable thinking channel Codex offers:
@@ -895,6 +896,9 @@ function createCodexQueryHandle(appServer, queryOpts) {
   var messageWaiting = null;
   var messageQueueEnded = false;
   var handlerEntry = null;
+  var inputRevision = 0;
+  var resolveLoopFinished;
+  var loopFinished = new Promise(function(resolve) { resolveLoopFinished = resolve; });
 
   function pushMessageToQueue(msg) {
     if (messageQueueEnded) return false;
@@ -1314,6 +1318,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
 
     state.done = true;
     endIterator();
+    resolveLoopFinished();
   }
 
   var handle = {
@@ -1333,6 +1338,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
 
     pushMessage: function(text, images) {
       if (iteratorDone || state.done || messageQueueEnded) return false;
+      inputRevision++;
       var input;
       if (images && images.length > 0) {
         input = [];
@@ -1354,6 +1360,16 @@ function createCodexQueryHandle(appServer, queryOpts) {
       }
     },
 
+    getIdleRecoverySnapshot: function() {
+      if (!state.threadId || !messageWaiting || messageQueue.length || messageQueueEnded || iteratorDone || isCancelled()) return null;
+      return { threadId: state.threadId, revision: inputRevision };
+    },
+
+    retireIdleForRecovery: function() {
+      handle.endInput();
+      return loopFinished;
+    },
+
     setModel: function(model) {
       state.model = model || DEFAULT_CODEX_MODEL;
       return Promise.resolve();
@@ -1477,6 +1493,7 @@ function createCodexAdapter(opts) {
   var _initPromise = null;
   var _initializing = false;
   var _shutdownPromise = null;
+  var _shutdownEpoch = 0;
   var _refCount = 0;
   var _lastActiveAt = Date.now();
   var _shuttingDown = false;
@@ -1560,10 +1577,6 @@ function createCodexAdapter(opts) {
     updateLastActiveAt();
   }
 
-  function waitForRecoveryHandoff() {
-    return _recoveryHandoff || Promise.resolve();
-  }
-
   function retainRecoveryRuntime(runtime) {
     _recoveryRuntimes.push(runtime);
   }
@@ -1612,6 +1625,11 @@ function createCodexAdapter(opts) {
   }
 
   async function createIsolatedRecoveryQuery(queryOpts) {
+    var shutdownEpoch = _shutdownEpoch;
+    function checkCurrent() {
+      idleRecovery.checkAbort(queryOpts);
+      if (_shuttingDown || shutdownEpoch !== _shutdownEpoch) throw createShutdownError();
+    }
     var releaseHandoff;
     var priorHandoff = _recoveryHandoff;
     var myHandoff = new Promise(function(resolve) { releaseHandoff = resolve; });
@@ -1619,6 +1637,11 @@ function createCodexAdapter(opts) {
     await (priorHandoff || Promise.resolve());
     try {
       await _recoveryCleanup;
+      checkCurrent();
+      if (!_initializing && _refCount > 0) {
+        await idleRecovery.retireIdleQueries(_activeQueries.slice(), _appServer, checkCurrent);
+      }
+      checkCurrent();
       if (_refCount > 0 || _initializing) {
         throw new Error("Codex resumed-tool recovery is waiting for an active shared runtime; retry after its current queries finish.");
       }
@@ -1626,6 +1649,7 @@ function createCodexAdapter(opts) {
         var stopped = await adapter.shutdownIfIdle(0);
         if (!stopped) throw new Error("Codex resumed-tool recovery could not safely release the shared runtime; retry after its current queries finish.");
       }
+      checkCurrent();
       var recoveryRuntime = createCodexAdapter(Object.assign({}, _defaultInitOpts, {
         recoveryRuntime: true,
         recoverySessionMcpServer: queryOpts.sessionMcpServer,
@@ -1792,6 +1816,13 @@ function createCodexAdapter(opts) {
       if (_shuttingDown) {
         return Promise.reject(createShutdownError());
       }
+      if (_recoveryHandoff) {
+        var initEpoch = _shutdownEpoch;
+        return _recoveryHandoff.then(function() {
+          if (initEpoch !== _shutdownEpoch) throw createShutdownError();
+          return adapter.init(initOpts);
+        });
+      }
 
       var effectiveInitOpts = Object.assign({}, _defaultInitOpts, initOpts || {});
 
@@ -2004,10 +2035,25 @@ function createCodexAdapter(opts) {
       if (queryOpts && queryOpts.sessionMcpServer && queryOpts.resumeSessionId && !queryOpts.isolatedRecovery) {
         return createIsolatedRecoveryQuery(queryOpts);
       }
-      await waitForRecoveryHandoff();
-
-      if (!_appServer || !_appServer.started) {
-        await adapter.init(queryOpts || {});
+      var queryEpoch = _shutdownEpoch;
+      // Recheck after every await: recovery may replace the runtime while an
+      // ordinary start is waiting for initialization or an earlier handoff.
+      while (true) {
+        idleRecovery.checkAbort(queryOpts || {});
+        if (_shuttingDown || queryEpoch !== _shutdownEpoch) throw createShutdownError();
+        if (_recoveryHandoff) {
+          await _recoveryHandoff;
+          continue;
+        }
+        if (_initializing && _initPromise) {
+          await _initPromise;
+          continue;
+        }
+        if (!_appServer || !_appServer.started) {
+          await adapter.init(queryOpts || {});
+          continue;
+        }
+        break;
       }
 
       if (_shuttingDown) {
@@ -2186,6 +2232,7 @@ function createCodexAdapter(opts) {
 
     // Shutdown the app-server process
     shutdown: function() {
+      _shutdownEpoch++;
       return Promise.all([
         beginShutdown(true),
         shutdownUserRuntimes("shutdown"),