dsh-codex-oauth 0.2.4 → 0.2.6

package/README.md

@@ -61,6 +61,8 @@ The default is `~/.dsh/.openai-codex-auth.json`. The file is written atomically
 npm test
 ```
 
+`npm test` rebuilds the Web bundle before running the smoke checks.
+
 The test requires the DSH and `pi-ai` peer dependencies supplied by a DSH profile.
 
 ## Limitations

package/README.zh.md

@@ -74,6 +74,8 @@ dsh plugin --profile web exec dsh-openai-codex logout
 npm test
 ```
 
+`npm test` 会先重新构建 Web bundle，再运行基础检查。
+
 测试需要当前 DSH profile 提供 DSH 和 `pi-ai` peer dependencies。
 
 ## 限制

package/bin/dsh-openai-codex.js

@@ -2,6 +2,7 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { authPath, login, logout, status } from "../lib/auth.js";
+import { safeMessage } from "../lib/safe-message.js";
 
 function openBrowser(raw) {
   const url = new URL(raw);
@@ -10,11 +11,6 @@ function openBrowser(raw) {
   const child = spawn(command[0], command.slice(1), { detached: true, stdio: "ignore", windowsHide: true });
   child.on("error", () => {}); child.unref();
 }
-function safeMessage(error) {
-  return String(error?.message ?? error)
-    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]")
-    .replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]");
-}
 function help() {
   console.log("Usage: dsh-openai-codex <login|logout|status> [--device-code]");
 }

package/client/index.jsx

@@ -8,7 +8,7 @@ const h = React.createElement;
 async function request(path, method = "GET") {
   const response = await fetch(path, { method, credentials: "same-origin", headers: { accept: "application/json" } });
   const value = await response.json().catch(() => ({}));
-  if (!response.ok) throw new Error(value.error || `HTTP ${response.status}`);
+  if (!response.ok) throw new Error(value && typeof value === "object" && typeof value.error === "string" ? value.error : `HTTP ${response.status}`);
   return value;
 }
 
@@ -22,11 +22,18 @@ function CodexSettings() {
     const timer = setInterval(refresh, 1000);
     return () => clearInterval(timer);
   }, [refresh, state.status]);
-  const signIn = () => {
+  const signIn = async () => {
+    const popup = window.open("about:blank", "_blank");
+    if (!popup) { setState({ status: "error", message: "Please allow popups to sign in" }); return; }
+    popup.opener = null;
     setBusy(true); setState({ status: "signing-in" });
-    const popup = window.open(LOGIN, "_blank", "noopener,noreferrer");
-    if (!popup) { setBusy(false); setState({ status: "error", message: "Please allow popups to sign in" }); }
-    else setTimeout(() => setBusy(false), 500);
+    try {
+      const challenge = await request(LOGIN, "POST");
+      popup.location.replace(challenge.url);
+    } catch (error) {
+      popup?.close();
+      setState({ status: "error", message: error.message });
+    } finally { setBusy(false); }
   };
   const signOut = async () => { setBusy(true); try { await request(LOGOUT, "POST"); setState({ status: "signed-out" }); } catch (error) { setState({ status: "error", message: error.message }); } finally { setBusy(false); } };
   const signedIn = state.status === "signed-in";

package/lib/adapter.js

@@ -14,8 +14,9 @@ function tokenProvider(provider) {
       apiKey: {
         name: "OpenAI Codex OAuth bearer token",
         async resolve({ credential }) {
-          return credential?.access
-            ? { auth: { apiKey: credential.access }, source: "Pi OAuth" }
+          const access = credential?.access ?? credential?.key;
+          return access
+            ? { auth: { apiKey: access }, source: "DSH Codex OAuth" }
             : undefined;
         },
       },

package/lib/client.js

@@ -43,7 +43,7 @@ var h = import_react.default.createElement;
 async function request(path, method = "GET") {
   const response = await fetch(path, { method, credentials: "same-origin", headers: { accept: "application/json" } });
   const value = await response.json().catch(() => ({}));
-  if (!response.ok) throw new Error(value.error || `HTTP ${response.status}`);
+  if (!response.ok) throw new Error(value && typeof value === "object" && typeof value.error === "string" ? value.error : `HTTP ${response.status}`);
   return value;
 }
 function CodexSettings() {
@@ -58,14 +58,24 @@ function CodexSettings() {
     const timer = setInterval(refresh, 1e3);
     return () => clearInterval(timer);
   }, [refresh, state.status]);
-  const signIn = () => {
+  const signIn = async () => {
+    const popup = window.open("about:blank", "_blank");
+    if (!popup) {
+      setState({ status: "error", message: "Please allow popups to sign in" });
+      return;
+    }
+    popup.opener = null;
     setBusy(true);
     setState({ status: "signing-in" });
-    const popup = window.open(LOGIN, "_blank", "noopener,noreferrer");
-    if (!popup) {
+    try {
+      const challenge = await request(LOGIN, "POST");
+      popup.location.replace(challenge.url);
+    } catch (error) {
+      popup?.close();
+      setState({ status: "error", message: error.message });
+    } finally {
       setBusy(false);
-      setState({ status: "error", message: "Please allow popups to sign in" });
-    } else setTimeout(() => setBusy(false), 500);
+    }
   };
   const signOut = async () => {
     setBusy(true);

package/lib/safe-message.js

@@ -0,0 +1,8 @@
+export function safeMessage(error) {
+  return String(error?.message ?? error)
+    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]")
+    .replace(/([?&](?:code|token|refresh_token|access_token|id_token)=)[^&#\s]+/giu, "$1[redacted]")
+    .replace(/(["']?(?:access_token|refresh_token|id_token|authorization_code|code_verifier|token|code)["']?\s*[:=]\s*)("[^"]*"|'[^']*'|[^,}\s]+)/giu, "$1[redacted]")
+    .replace(/(\bBearer\s+)[^\s,]+/giu, "$1[redacted]")
+    .slice(0, 500);
+}

package/lib/store.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, stat } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
@@ -10,11 +10,22 @@ export function authPath(home = process.env.DSH_HOME || join(homedir(), ".dsh"))
 }
 
 function clone(value) { return value === undefined ? undefined : structuredClone(value); }
+async function privateDirectory(filename) {
+  const directory = dirname(filename);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  if (process.platform === "win32") return;
+  const info = await lstat(directory);
+  if (info.isSymbolicLink()) throw new Error(`${directory} must not be a symbolic link`);
+  if (info.mode & 0o077) await chmod(directory, 0o700);
+}
 async function ownerOnly(filename) {
   if (process.platform === "win32") return;
-  try {
-    if ((await stat(filename)).mode & 0o077) throw new Error(`${filename} must be owner-only (chmod 600)`);
-  } catch (error) { if (error?.code !== "ENOENT") throw error; }
+  for (const [path, label] of [[dirname(filename), "directory"], [filename, "file"]]) {
+    try {
+      const info = await lstat(path);
+      if (info.isSymbolicLink() || info.mode & 0o077) throw new Error(`${path} must be an owner-only ${label}`);
+    } catch (error) { if (error?.code !== "ENOENT") throw error; }
+  }
 }
 function parse(text, filename) {
   let value;
@@ -30,6 +41,7 @@ function parse(text, filename) {
 export class CodexCredentialStore {
   constructor(filename = authPath()) { this.filename = filename; }
   async readCurrent() {
+    await privateDirectory(this.filename);
     await ownerOnly(this.filename);
     try { return parse(await readFile(this.filename, "utf8"), this.filename); }
     catch (error) { if (error?.code === "ENOENT") return undefined; throw error; }
@@ -38,7 +50,7 @@ export class CodexCredentialStore {
   async list() { return (await this.readCurrent()) ? [{ providerId: OPENAI_CODEX_PROVIDER, type: "oauth" }] : []; }
   async modify(providerId, fn) {
     if (providerId !== OPENAI_CODEX_PROVIDER) throw new Error(`credential store does not own ${providerId}`);
-    await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 });
+    await privateDirectory(this.filename);
     return withFileLock(this.filename, async () => {
       const current = await this.readCurrent();
       const next = await fn(clone(current));
@@ -51,8 +63,9 @@ export class CodexCredentialStore {
   }
   async delete(providerId) {
     if (providerId !== OPENAI_CODEX_PROVIDER) return;
-    await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 });
+    await privateDirectory(this.filename);
     await withFileLock(this.filename, async () => {
+      await ownerOnly(this.filename);
       const { rm } = await import("node:fs/promises");
       await rm(this.filename, { force: true });
     });

package/lib/web-auth.js

@@ -1,15 +1,10 @@
 import { login, logout, status } from "./auth.js";
+import { safeMessage } from "./safe-message.js";
 
 export const AUTH_STATUS_PATH = "/plugins/dsh-codex-oauth/auth/status";
 export const AUTH_LOGIN_PATH = "/plugins/dsh-codex-oauth/auth/login";
 export const AUTH_LOGOUT_PATH = "/plugins/dsh-codex-oauth/auth/logout";
 
-function safeMessage(error) {
-  return String(error?.message ?? error)
-    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]")
-    .replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]")
-    .slice(0, 500);
-}
 function trusted(req) {
   const remote = req.socket.remoteAddress;
   if (!["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(remote)) return false;
@@ -26,42 +21,78 @@ function json(res, statusCode, value) {
 
 export function registerWebAuth(ctx, store) {
   let operation;
+  let cancellation;
   let challenge;
   let state = { status: "signed-out" };
-  const cancellation = new AbortController();
-  const update = () => status(store).then((value) => { state = value.authenticated ? { status: "signed-in" } : { status: "signed-out" }; return state; });
+  const update = async () => {
+    const value = await status(store);
+    state = value.authenticated ? { status: "signed-in" } : { status: "signed-out" };
+    return state;
+  };
   const start = () => {
     if (operation) return;
+    const controller = new AbortController();
+    cancellation = controller;
     state = { status: "signing-in" };
     challenge = undefined;
-    operation = login(store, {
-      signal: cancellation.signal,
-      prompt: async (prompt) => prompt.type === "select" ? "browser" : new Promise((_resolve, reject) => cancellation.signal.addEventListener("abort", () => reject(cancellation.signal.reason), { once: true })),
-      notify: (event) => { if (event.type === "auth_url") challenge = { url: event.url }; },
-    }).then(update, (error) => { state = { status: "error", message: safeMessage(error) }; }).finally(() => { operation = undefined; });
+    operation = (async () => {
+      try {
+        await login(store, {
+          signal: controller.signal,
+          prompt: async (prompt) => prompt.type === "select"
+            ? "browser"
+            : new Promise((_resolve, reject) => controller.signal.addEventListener("abort", () => reject(controller.signal.reason), { once: true })),
+          notify: (event) => {
+            if (event.type !== "auth_url") return;
+            try {
+              const url = new URL(event.url);
+              if (url.protocol !== "https:") throw new Error("OAuth URL must use HTTPS");
+              challenge = { url: url.href };
+            } catch (error) { controller.abort(error); }
+          },
+        });
+        await update();
+      } catch (error) {
+        state = controller.signal.aborted ? { status: "signed-out" } : { status: "error", message: safeMessage(error) };
+      } finally {
+        if (cancellation === controller) cancellation = undefined;
+        operation = undefined;
+      }
+    })();
   };
   ctx.inject(["webServer"], (web) => ctx.effect(() => {
     const routes = [
       web.webServer.register({ kind: "exact", path: AUTH_STATUS_PATH, handler: async (req, res) => {
         if (req.method !== "GET" || !trusted(req)) return json(res, req.method === "GET" ? 403 : 405, { error: "forbidden" });
-        if (!operation) await update();
-        json(res, 200, state);
+        try {
+          if (!operation) await update();
+          json(res, 200, state);
+        } catch (error) { json(res, 500, { error: safeMessage(error) }); }
       }}),
       web.webServer.register({ kind: "exact", path: AUTH_LOGIN_PATH, handler: async (req, res) => {
-        if (!trusted(req) || !["GET", "POST"].includes(req.method)) return json(res, req.method === "GET" || req.method === "POST" ? 403 : 405, { error: "forbidden" });
+        if (req.method !== "POST" || !trusted(req)) return json(res, req.method === "POST" ? 403 : 405, { error: "forbidden" });
         try {
           start();
           for (let i = 0; i < 50 && !challenge && operation; i++) await new Promise((resolve) => setTimeout(resolve, 100));
           if (!challenge) throw new Error("OAuth URL was not created");
-          if (req.method === "GET") { res.writeHead(302, { location: challenge.url, "cache-control": "no-store" }); res.end(); }
-          else json(res, 200, challenge);
+          json(res, 200, challenge);
         } catch (error) { json(res, 500, { error: safeMessage(error) }); }
       }}),
       web.webServer.register({ kind: "exact", path: AUTH_LOGOUT_PATH, handler: async (req, res) => {
         if (req.method !== "POST" || !trusted(req)) return json(res, req.method === "POST" ? 403 : 405, { error: "forbidden" });
-        cancellation.abort(new Error("sign-in cancelled")); await operation?.catch(() => {}); await logout(store); state = { status: "signed-out" }; json(res, 200, { ok: true });
+        try {
+          cancellation?.abort(new Error("sign-in cancelled"));
+          await operation?.catch(() => {});
+          await logout(store);
+          state = { status: "signed-out" };
+          json(res, 200, { ok: true });
+        } catch (error) { json(res, 500, { error: safeMessage(error) }); }
       }}),
     ];
-    return async () => { cancellation.abort(new Error("plugin disposed")); await operation?.catch(() => {}); for (const dispose of routes) dispose(); };
+    return async () => {
+      cancellation?.abort(new Error("plugin disposed"));
+      await operation?.catch(() => {});
+      for (const dispose of routes) dispose();
+    };
   }, "dsh-codex-oauth: Web OAuth routes"));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-oauth",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Use a ChatGPT Codex subscription in DeepSeek Harness through standalone OAuth",
   "repository": {
     "type": "git",
@@ -12,7 +12,7 @@
   },
   "keywords": ["dsh-plugin", "deepseek-harness", "openai-codex", "oauth"],
   "license": "MIT",
-  "scripts": { "test": "node test/smoke.mjs" },
+  "scripts": { "build": "node scripts/build-client.mjs", "test": "npm run build && node test/smoke.mjs && node test/web-auth.mjs" },
   "type": "module",
   "main": "lib/index.js",
   "bin": { "dsh-openai-codex": "bin/dsh-openai-codex.js" },
@@ -25,6 +25,7 @@
       "platform": "web"
     }
   },
+  "devDependencies": { "esbuild": "^0.28.2" },
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.1",
     "@deepseek-ai/cordis": "^4.0.1",