dsh-openai-subscription 0.1.2 → 0.1.4

package/dist/driver.d.ts

@@ -0,0 +1,12 @@
+import type { ShellExecutor } from '@deepseek-ai/dsh-shell';
+import { type OAuthCredential } from './oauth.js';
+export declare const VERIFICATION_URL = "https://auth.openai.com/codex/device";
+export declare const DRIVER_DEVICE = "\nconst out = (o) => process.stdout.write(JSON.stringify(o) + '\\n')\nprocess.stdout.on('error', () => {})\ntry {\n  const { pathToFileURL } = await import('node:url')\n  const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)\n  const credential = await openaiCodexOAuth.login({\n    signal: AbortSignal.timeout(15 * 60 * 1000),\n    notify: (n) => out({ ...n, type: 'notice' }),\n    prompt: async (p) => {\n      if (p.type === 'select') return 'device_code'\n      throw new Error('Unsupported authorization interaction')\n    },\n  })\n  out({ type: 'result', credential })\n} catch (error) {\n  out({ type: 'error', message: error instanceof Error ? error.message : String(error) })\n}\n";
+export declare const DRIVER_REFRESH = "\nconst out = (o) => process.stdout.write(JSON.stringify(o) + '\\n')\nprocess.stdout.on('error', () => {})\ntry {\n  const { readFileSync } = await import('node:fs')\n  const { pathToFileURL } = await import('node:url')\n  const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)\n  const credential = JSON.parse(readFileSync(0, 'utf8') || '{}')\n  const refreshed = await openaiCodexOAuth.refresh(credential, AbortSignal.timeout(90 * 1000))\n  out({ type: 'result', credential: refreshed })\n} catch (error) {\n  out({ type: 'error', message: error instanceof Error ? error.message : String(error) })\n}\n";
+export declare function parseDriverMessage(line: string): Record<string, unknown> | null;
+/** Bounded streaming reader; disposal/cancellation always reaps its process. */
+export declare function runDeviceDriver(shell: ShellExecutor, modulePath: string, signal: AbortSignal, notify: (code: string, url: string) => void, options?: {
+    timeoutMs?: number;
+    codeTimeoutMs?: number;
+    pollMs?: number;
+}): Promise<OAuthCredential | null>;

package/dist/driver.js

@@ -0,0 +1,136 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { SubscriptionError, oauthFailureCode } from './errors.js';
+import { normalizeOAuthCredential } from './oauth.js';
+import { buildNodeCommand } from './platform.js';
+export const VERIFICATION_URL = 'https://auth.openai.com/codex/device';
+const MAX_OUTPUT = 256 * 1024;
+const DEVICE_TIMEOUT = 15 * 60 * 1000;
+// Catch import failures as well as OAuth errors. Tokens only travel over stdin/stdout,
+// never in command arguments or environment variables.
+export const DRIVER_DEVICE = `
+const out = (o) => process.stdout.write(JSON.stringify(o) + '\\n')
+process.stdout.on('error', () => {})
+try {
+  const { pathToFileURL } = await import('node:url')
+  const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)
+  const credential = await openaiCodexOAuth.login({
+    signal: AbortSignal.timeout(15 * 60 * 1000),
+    notify: (n) => out({ ...n, type: 'notice' }),
+    prompt: async (p) => {
+      if (p.type === 'select') return 'device_code'
+      throw new Error('Unsupported authorization interaction')
+    },
+  })
+  out({ type: 'result', credential })
+} catch (error) {
+  out({ type: 'error', message: error instanceof Error ? error.message : String(error) })
+}
+`;
+export const DRIVER_REFRESH = `
+const out = (o) => process.stdout.write(JSON.stringify(o) + '\\n')
+process.stdout.on('error', () => {})
+try {
+  const { readFileSync } = await import('node:fs')
+  const { pathToFileURL } = await import('node:url')
+  const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)
+  const credential = JSON.parse(readFileSync(0, 'utf8') || '{}')
+  const refreshed = await openaiCodexOAuth.refresh(credential, AbortSignal.timeout(90 * 1000))
+  out({ type: 'result', credential: refreshed })
+} catch (error) {
+  out({ type: 'error', message: error instanceof Error ? error.message : String(error) })
+}
+`;
+export function parseDriverMessage(line) {
+    try {
+        const value = JSON.parse(line);
+        return typeof value === 'object' && value !== null && !Array.isArray(value)
+            ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Bounded streaming reader; disposal/cancellation always reaps its process. */
+export async function runDeviceDriver(shell, modulePath, signal, notify, options = {}) {
+    if (signal.aborted)
+        return null;
+    const timeout = AbortSignal.timeout(options.timeoutMs ?? DEVICE_TIMEOUT);
+    const combined = AbortSignal.any([signal, timeout]);
+    const proc = shell.start(shell.resolve({
+        command: buildNodeCommand(DRIVER_DEVICE, modulePath),
+        signal: combined,
+        stdoutMaxBytes: MAX_OUTPUT,
+    }));
+    let buffer = '';
+    let total = 0;
+    let codeReceived = false;
+    let credential = null;
+    const codeDeadline = Date.now() + (options.codeTimeoutMs ?? 45_000);
+    try {
+        while (true) {
+            if (signal.aborted)
+                return null;
+            if (timeout.aborted || (!codeReceived && Date.now() >= codeDeadline))
+                throw new SubscriptionError('timeout');
+            const read = proc.readOutput();
+            total += Buffer.byteLength(read.delta);
+            if (read.lossy || total > MAX_OUTPUT)
+                throw new SubscriptionError('invalid-response');
+            buffer += read.delta;
+            // Read final unterminated JSON too, then drain any bytes that arrive
+            // between this read and observing process completion.
+            const lines = buffer.split('\n');
+            buffer = lines.pop() ?? '';
+            if (proc.status !== 'running' && buffer.trim()) {
+                lines.push(buffer);
+                buffer = '';
+            }
+            for (const line of lines) {
+                const message = parseDriverMessage(line);
+                if (message === null)
+                    continue;
+                if (message.type === 'error')
+                    throw new SubscriptionError(oauthFailureCode(message.message));
+                if (message.type === 'result') {
+                    credential = normalizeOAuthCredential(message.credential);
+                    if (credential === null)
+                        throw new SubscriptionError('invalid-response');
+                    break;
+                }
+                if (message.type === 'notice' && typeof message.userCode === 'string' && /^[A-Za-z0-9-]{3,32}$/.test(message.userCode)) {
+                    codeReceived = true;
+                    // Never forward an arbitrary URL supplied by a dependency.
+                    notify(message.userCode, VERIFICATION_URL);
+                }
+            }
+            if (credential !== null)
+                break;
+            if (proc.status !== 'running') {
+                // A close between readOutput() and status can make final bytes available.
+                const tail = proc.readOutput();
+                if (tail.delta || tail.lossy) {
+                    total += Buffer.byteLength(tail.delta);
+                    if (tail.lossy || total > MAX_OUTPUT)
+                        throw new SubscriptionError('invalid-response');
+                    buffer += tail.delta;
+                    continue;
+                }
+                throw new SubscriptionError(proc.sandbox?.denied ? 'access-denied' : 'process-exited');
+            }
+            await delay(options.pollMs ?? 250, undefined, { signal: combined }).catch(() => { });
+        }
+    }
+    finally {
+        try {
+            if (proc.status === 'running')
+                proc.kill();
+        }
+        finally {
+            await proc.done;
+        }
+        // Sandbox facts may only be stamped at process close, after a result line.
+        if (!signal.aborted && proc.sandbox?.denied)
+            throw new SubscriptionError('access-denied');
+    }
+    return signal.aborted ? null : credential;
+}

package/dist/errors.d.ts

@@ -0,0 +1,13 @@
+/** Stable, non-sensitive failures shared by the host's public boundaries. */
+export declare const FAILURE_CODES: readonly ['credentials-unavailable', 'shell-unavailable', 'timer-unavailable', 'component-unavailable', 'runtime-unsupported', 'busy', 'invalid-method', 'not-connected', 'not-refreshable', 'device-auth-disabled', 'access-denied', 'authorization-expired', 'rate-limited', 'network', 'timeout', 'invalid-response', 'process-exited', 'credential-write-failed', 'credential-changed', 'settings-unavailable', 'models-unavailable', 'models-empty', 'models-confirmation-required', 'settings-conflict', 'settings-write-failed', 'ownership-save-failed', 'cancelled', 'unknown'];
+export type FailureCode = typeof FAILURE_CODES[number];
+/** The marker survives RPC implementations which serialize only Error.message. */
+export declare class SubscriptionError extends Error {
+    readonly code: FailureCode;
+    constructor(code: FailureCode);
+}
+export declare function failureCode(error: unknown, fallback?: FailureCode): FailureCode;
+/** Classify internal OAuth diagnostics, but never return the diagnostic itself. */
+export declare function oauthFailureCode(error: unknown): FailureCode;
+/** Logs deliberately omit raw server responses, paths, tokens and account ids. */
+export declare function logFailure(operation: string, error: unknown): void;

package/dist/errors.js

@@ -0,0 +1,58 @@
+/** Stable, non-sensitive failures shared by the host's public boundaries. */
+export const FAILURE_CODES = [
+    'credentials-unavailable', 'shell-unavailable', 'timer-unavailable', 'component-unavailable',
+    'runtime-unsupported', 'busy', 'invalid-method', 'not-connected', 'not-refreshable',
+    'device-auth-disabled', 'access-denied', 'authorization-expired', 'rate-limited',
+    'network', 'timeout', 'invalid-response', 'process-exited', 'credential-write-failed',
+    'credential-changed', 'settings-unavailable', 'models-unavailable', 'models-empty',
+    'models-confirmation-required', 'settings-conflict', 'settings-write-failed',
+    'ownership-save-failed', 'cancelled', 'unknown',
+];
+/** The marker survives RPC implementations which serialize only Error.message. */
+export class SubscriptionError extends Error {
+    code;
+    constructor(code) {
+        super(`[openai-subscription:${code}]`);
+        this.code = code;
+        this.name = 'SubscriptionError';
+    }
+}
+export function failureCode(error, fallback = 'unknown') {
+    if (error instanceof SubscriptionError)
+        return error.code;
+    const code = typeof error === 'object' && error !== null ? error.code : undefined;
+    if (code === 'SETTINGS_CONFLICT')
+        return 'settings-conflict';
+    if (code === 'EACCES' || code === 'EPERM')
+        return 'access-denied';
+    return fallback;
+}
+/** Classify internal OAuth diagnostics, but never return the diagnostic itself. */
+export function oauthFailureCode(error) {
+    if (error instanceof SubscriptionError)
+        return error.code;
+    const message = typeof error === 'string' ? error
+        : error instanceof Error ? error.message : '';
+    const text = message.slice(0, 8192);
+    if (/access_denied|access denied|permission denied|\b403\b|sandbox.*den/i.test(text))
+        return 'access-denied';
+    if (/expired_token|invalid_grant|invalid_token|\b401\b|token.*expired/i.test(text))
+        return 'authorization-expired';
+    if (/authorization_pending/i.test(text))
+        return 'unknown';
+    if (/\b404\b|not enabled|device.{0,20}disabled/i.test(text))
+        return 'device-auth-disabled';
+    if (/\b429\b|rate.limit|slow_down|too many requests/i.test(text))
+        return 'rate-limited';
+    if (/timeout|timed? ?out|TimeoutError/i.test(text))
+        return 'timeout';
+    if (/fetch failed|network|ENOTFOUND|ECONN|EAI_AGAIN|certificate|TLS|proxy/i.test(text))
+        return 'network';
+    if (/ERR_MODULE_NOT_FOUND|Cannot find (module|package)|does not provide an export/i.test(text))
+        return 'component-unavailable';
+    return 'unknown';
+}
+/** Logs deliberately omit raw server responses, paths, tokens and account ids. */
+export function logFailure(operation, error) {
+    console.error(`[openai-subscription] ${operation}: ${failureCode(error)}`);
+}

package/dist/host.d.ts

@@ -1,3 +1,5 @@
+export { authModuleCandidates } from './platform.js';
+import { type FailureCode } from './errors.js';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import type { Context } from '@deepseek-ai/cordis';
 /** Stable progress keys let the browser localize notices without exposing diagnostics. */
@@ -5,6 +7,7 @@ type FlowNoticeKind = 'requesting-code' | 'enter-code' | 'refreshing' | 'models-
 /** Host-side notice queued for the polling client. Mirrors `AuthorizationNotice`. */
 interface FlowNotice {
     kind?: FlowNoticeKind;
+    errorCode?: FailureCode;
     message: string;
     url?: string;
     code?: string;
@@ -15,24 +18,28 @@ interface FlowState {
     done: boolean;
     outcome: 'authorized' | 'cancelled' | 'failed' | null;
     error: string | null;
+    errorCode?: FailureCode;
+    completedAt?: number;
     controller: AbortController;
     task: Promise<void> | null;
 }
 /** `openaiSubscription/status` reply: semantic UI facts, never raw account metadata. */
-type StatusResult = {
-    configured: false;
+interface StatusResult {
+    configured: boolean;
     ready: boolean;
-} | {
-    configured: true;
-    ready: boolean;
-    refreshable: boolean;
-    modelsSynced: boolean;
-    modelCount: number;
-};
+    unavailableReason?: FailureCode;
+    refreshable?: boolean;
+    credentialState?: 'valid' | 'expired' | 'unknown';
+    cleanupAvailable?: boolean;
+    flowPending?: boolean;
+    modelsSynced?: boolean;
+    modelCount?: number;
+}
 /** `openaiSubscription/authorize` reply. */
 type AuthorizeResult = {
     started: false;
     error: string;
+    errorCode: FailureCode;
 } | {
     started: true;
 };
@@ -40,6 +47,7 @@ type AuthorizeResult = {
 interface ModelSyncResult {
     synced: true;
     count: number;
+    warningCode?: 'ownership-save-failed';
 }
 /** `openaiSubscription/poll` reply. */
 type PollResult = {
@@ -53,6 +61,7 @@ type PollResult = {
     notices: FlowNotice[];
     outcome: FlowState['outcome'];
     error: string | null;
+    errorCode?: FailureCode;
 };
 declare class OpenAISubscriptionController extends TypertRemoteService {
     private registeredAuthorization;
@@ -62,13 +71,18 @@ declare class OpenAISubscriptionController extends TypertRemoteService {
     private syncingModels;
     private modelSyncController;
     private modelDiscovery;
+    private disconnecting;
     constructor(ctx: Context);
     private credentials;
     private shell;
-    private timer;
     private authorization;
     private llm;
     private ensureAuthorizationFlow;
+    /**
+     * Locate the OpenAI auth module without spawning a shell. Probes the pi-ai
+     * copy shipped inside the running DSH first; returns '' when nothing hits.
+     */
+    private probeInProcessModule;
     private locateAuthModule;
     private runDevice;
     private runRefresh;
@@ -76,23 +90,27 @@ declare class OpenAISubscriptionController extends TypertRemoteService {
     private mirrorToPiAi;
     /** Keep one cancellable model sync in flight so login, refresh, and UI actions cannot race. */
     private synchronizeModels;
+    /** Bound this read even if an older adapter ignores AbortSignal. No writes are raced. */
+    private readBuiltinModels;
     /** Fetch the account-scoped catalog and replace only this plugin's previous rows. */
     private performModelSync;
     /** Remove only unchanged dynamic rows, preserving every local model and profile field. */
     private removeManagedPiRoute;
     private beginLogin;
     private registerAuthorizationFlow;
-    private shq;
     status(): Promise<StatusResult>;
-    authorize(method: unknown): Promise<AuthorizeResult>;
+    private readStatus;
+    authorize(method?: unknown): Promise<AuthorizeResult>;
     poll(): Promise<PollResult>;
     cancel(): Promise<{
         ok: true;
     }>;
-    syncModels(): Promise<ModelSyncResult>;
-    /** Cancel active authorization and remove plugin-managed credentials and settings. */
+    syncModels(confirmed?: unknown): Promise<ModelSyncResult>;
+    /** Serialize disconnect with authorization and sync, including other tabs. */
     logout(): Promise<{
         ok: true;
     }>;
+    /** Cancel active authorization and remove plugin-managed credentials and settings. */
+    private performLogout;
 }
 export default OpenAISubscriptionController;