dsh-openai-subscription 0.1.9 → 0.1.10

package/dist/client.js

@@ -127,6 +127,7 @@ const ZH = {
     'error.network': '无法连接服务，请检查网络后重试。',
     'error.invalid-response': '服务返回了无效响应，请重试或更新 DSH。',
     'error.process-exited': '登录进程提前退出，请重新连接或更新 DSH。',
+    'error.sign-in-timeout': '等待时间过长，本次登录已结束。请重新连接并在 9 分钟内完成验证。',
     'error.credential-write-failed': '无法保存本机授权，请检查本机权限后重试；也可断开以清理残留数据。',
     'error.credential-changed': '本机授权已被其他操作更改，请重新读取状态后重试。',
     'error.settings-unavailable': '设置服务不可用，请重启 DSH 后重试。',
@@ -263,6 +264,7 @@ const EN = {
     'error.network': 'The service could not be reached. Check the network and retry.',
     'error.invalid-response': 'The service returned an invalid response. Retry or update DSH.',
     'error.process-exited': 'The sign-in process exited early. Reconnect or update DSH.',
+    'error.sign-in-timeout': 'Sign-in took too long, so this attempt ended. Reconnect and confirm within 9 minutes.',
     'error.credential-write-failed': 'Local authorization could not be saved. Check local permissions and retry, or disconnect to clean up remaining data.',
     'error.credential-changed': 'Another operation changed local authorization. Reload status and retry.',
     'error.settings-unavailable': 'The settings service is unavailable. Restart DSH and retry.',
@@ -305,6 +307,11 @@ window.__ModuleLoader__.load({
 .oasub-wrap {
   --oasub-section-inset: 20px;
   --oasub-card-border-width: 1px;
+  --oasub-dot-size: 8px;
+  /* Status rows and notices share one line box so a leading marker can be
+     centered on the first text line by arithmetic instead of guesswork. */
+  --oasub-status-line-height: 22px;
+  --oasub-notice-line-height: 18px;
   /* One control boundary for every button and picker: the host's own control
      border step, so plugin controls carry the same weight as DSH's. */
   --oasub-control-border: var(--dsw-alias-border-l3, rgba(15, 17, 21, .16));
@@ -346,9 +353,9 @@ window.__ModuleLoader__.load({
 }
 .oasub-status-line { display: flex; align-items: flex-start; justify-content: space-between; gap: 12px; }
 .oasub-status-copy { display: flex; flex-direction: column; gap: 3px; min-width: 0; }
-.oasub-status-title { display: flex; align-items: center; gap: 8px; font-size: 15px; font-weight: 600; line-height: 22px; }
+.oasub-status-title { display: flex; align-items: center; gap: 8px; font-size: 15px; font-weight: 600; line-height: var(--oasub-status-line-height); }
 .oasub-status-detail { color: var(--dsw-alias-label-tertiary, #81858c); font-size: 12px; line-height: 18px; }
-.oasub-dot { width: 8px; height: 8px; border-radius: 999px; background: var(--dsw-alias-label-tertiary, #81858c); }
+.oasub-dot { flex: none; width: var(--oasub-dot-size); height: var(--oasub-dot-size); border-radius: 999px; background: var(--dsw-alias-label-tertiary, #81858c); }
 .oasub-dot.success { background: var(--dsw-alias-state-success-primary, #22c55e); }
 .oasub-dot.warning { background: var(--dsw-alias-state-warn-primary, #f59e0b); }
 .oasub-pill {
@@ -475,8 +482,11 @@ window.__ModuleLoader__.load({
   color: var(--dsw-alias-label-secondary, #61666b);
   background: var(--dsw-alias-bg-layer-2, #f5f6f7);
   font-size: 12px;
-  line-height: 18px;
+  line-height: var(--oasub-notice-line-height);
 }
+/* The row stays top-aligned so wrapped text keeps a stable first line; the
+   marker therefore centers on that line instead of the row's top edge. */
+.oasub-notice > .oasub-dot { margin-top: calc((var(--oasub-notice-line-height) - var(--oasub-dot-size)) / 2); }
 .oasub-notice.success { border-color: color-mix(in srgb, var(--dsw-alias-state-success-primary, #22c55e) 40%, transparent); }
 .oasub-notice.warning { border-color: color-mix(in srgb, var(--dsw-alias-state-warn-primary, #f59e0b) 45%, transparent); }
 .oasub-notice.error { border-color: color-mix(in srgb, var(--dsw-alias-state-error-primary, #dc2626) 45%, transparent); color: var(--dsw-alias-state-error-primary, #b91c1c); }
@@ -548,7 +558,7 @@ window.__ModuleLoader__.load({
             'credentials-unavailable', 'shell-unavailable', 'timer-unavailable', 'component-unavailable',
             'runtime-unsupported', 'busy', 'invalid-method', 'not-connected', 'not-refreshable',
             'device-auth-disabled', 'access-denied', 'authorization-expired', 'rate-limited', 'network',
-            'timeout', 'invalid-response', 'process-exited', 'credential-write-failed', 'credential-changed',
+            'timeout', 'sign-in-timeout', 'invalid-response', 'process-exited', 'credential-write-failed', 'credential-changed',
             'settings-unavailable', 'models-unavailable', 'models-empty', 'models-confirmation-required',
             'settings-conflict', 'settings-write-failed', 'ownership-save-failed', 'cancelled', 'unknown',
             'invalid-context-window', 'context-window-exceeded', 'model-not-found',

package/dist/driver.d.ts

@@ -1,12 +1,23 @@
 import type { ShellExecutor } from '@deepseek-ai/dsh-shell';
 import { type OAuthCredential } from './oauth.js';
 export declare const VERIFICATION_URL = "https://auth.openai.com/codex/device";
+/**
+ * Abandon the device-code wait just before the executor's own hard deadline.
+ * DSH's default bash executor arms `timeoutMs` with `onExpiry: 'kill'` and caps
+ * it at its `maxTimeoutMs` (600000ms today), so a request that never names a
+ * timeout is SIGKILLed after the 120000ms default — before any device flow
+ * could finish — and a silently killed child cannot report a reason of its own.
+ */
+export declare const DEVICE_TIMEOUT_MS: number;
+/** Requested executor deadline: the largest value DSH's bash executor accepts. */
+export declare const DEVICE_SHELL_TIMEOUT_MS: number;
 export declare const DRIVER_DEVICE = "\nconst out = (o) => process.stdout.write(JSON.stringify(o) + '\\n')\nprocess.stdout.on('error', () => {})\ntry {\n  const { pathToFileURL } = await import('node:url')\n  const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)\n  const credential = await openaiCodexOAuth.login({\n    signal: AbortSignal.timeout(15 * 60 * 1000),\n    notify: (n) => out({ ...n, type: 'notice' }),\n    prompt: async (p) => {\n      if (p.type === 'select') return 'device_code'\n      throw new Error('Unsupported authorization interaction')\n    },\n  })\n  out({ type: 'result', credential })\n} catch (error) {\n  out({ type: 'error', message: error instanceof Error ? error.message : String(error) })\n}\n";
 export declare const DRIVER_REFRESH = "\nconst out = (o) => process.stdout.write(JSON.stringify(o) + '\\n')\nprocess.stdout.on('error', () => {})\ntry {\n  const { readFileSync } = await import('node:fs')\n  const { pathToFileURL } = await import('node:url')\n  const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)\n  const credential = JSON.parse(readFileSync(0, 'utf8') || '{}')\n  const refreshed = await openaiCodexOAuth.refresh(credential, AbortSignal.timeout(90 * 1000))\n  out({ type: 'result', credential: refreshed })\n} catch (error) {\n  out({ type: 'error', message: error instanceof Error ? error.message : String(error) })\n}\n";
 export declare function parseDriverMessage(line: string): Record<string, unknown> | null;
 /** Bounded streaming reader; disposal/cancellation always reaps its process. */
 export declare function runDeviceDriver(shell: ShellExecutor, modulePath: string, signal: AbortSignal, notify: (code: string, url: string) => void, options?: {
     timeoutMs?: number;
+    shellTimeoutMs?: number;
     codeTimeoutMs?: number;
     pollMs?: number;
 }): Promise<OAuthCredential | null>;

package/dist/driver.js

@@ -1,10 +1,19 @@
 import { setTimeout as delay } from 'node:timers/promises';
-import { SubscriptionError, failureCode, oauthFailureCode } from './errors.js';
+import { SubscriptionError, failureCode, logDriverStderr, oauthFailureCode } from './errors.js';
 import { normalizeOAuthCredential } from './oauth.js';
 import { buildNodeCommand } from './platform.js';
 export const VERIFICATION_URL = 'https://auth.openai.com/codex/device';
 const MAX_OUTPUT = 256 * 1024;
-const DEVICE_TIMEOUT = 15 * 60 * 1000;
+/**
+ * Abandon the device-code wait just before the executor's own hard deadline.
+ * DSH's default bash executor arms `timeoutMs` with `onExpiry: 'kill'` and caps
+ * it at its `maxTimeoutMs` (600000ms today), so a request that never names a
+ * timeout is SIGKILLed after the 120000ms default — before any device flow
+ * could finish — and a silently killed child cannot report a reason of its own.
+ */
+export const DEVICE_TIMEOUT_MS = 570 * 1000;
+/** Requested executor deadline: the largest value DSH's bash executor accepts. */
+export const DEVICE_SHELL_TIMEOUT_MS = 600 * 1000;
 // Catch import failures as well as OAuth errors. Tokens only travel over stdin/stdout,
 // never in command arguments or environment variables.
 export const DRIVER_DEVICE = `
@@ -54,11 +63,14 @@ export function parseDriverMessage(line) {
 export async function runDeviceDriver(shell, modulePath, signal, notify, options = {}) {
     if (signal.aborted)
         return null;
-    const timeout = AbortSignal.timeout(options.timeoutMs ?? DEVICE_TIMEOUT);
+    const timeout = AbortSignal.timeout(options.timeoutMs ?? DEVICE_TIMEOUT_MS);
     const combined = AbortSignal.any([signal, timeout]);
     const spec = shell.resolve({
         command: buildNodeCommand(DRIVER_DEVICE, modulePath),
         signal: combined,
+        // Without an explicit request the executor applies its own short default
+        // deadline and kills the child while the user is still entering the code.
+        timeoutMs: options.shellTimeoutMs ?? DEVICE_SHELL_TIMEOUT_MS,
         stdoutMaxBytes: MAX_OUTPUT,
     });
     let proc;
@@ -80,12 +92,11 @@ export async function runDeviceDriver(shell, modulePath, signal, notify, options
     let codeReceived = false;
     let credential = null;
     const codeDeadline = Date.now() + (options.codeTimeoutMs ?? 45_000);
+    const diagnostics = proc;
     try {
         while (true) {
             if (signal.aborted)
                 return null;
-            if (timeout.aborted || (!codeReceived && Date.now() >= codeDeadline))
-                throw new SubscriptionError('timeout');
             const read = proc.readOutput();
             total += Buffer.byteLength(read.delta);
             if (read.lossy || total > MAX_OUTPUT)
@@ -129,8 +140,21 @@ export async function runDeviceDriver(shell, modulePath, signal, notify, options
                     buffer += tail.delta;
                     continue;
                 }
+                logDriverStderr(diagnostics.observed?.stderr, 'device sign-in');
+                // Our own wait is the only other ending: an expired device flow.
+                if (combined.aborted)
+                    throw new SubscriptionError('sign-in-timeout');
+                // A handle may omit `signal` entirely, so only a real terminating signal
+                // (the executor's deadline SIGKILL/SIGTERM) or a code already on screen
+                // identifies an interrupted sign-in rather than a refused launch.
+                if (codeReceived || proc.signal != null)
+                    throw new SubscriptionError('sign-in-timeout');
                 throw new SubscriptionError(proc.sandbox?.denied ? 'access-denied' : 'process-exited');
             }
+            // Only a wait that produced no message may expire: an authorization that
+            // landed within this poll window is still a success, not a timeout.
+            if (timeout.aborted || (!codeReceived && Date.now() >= codeDeadline))
+                throw new SubscriptionError('timeout');
             await delay(options.pollMs ?? 250, undefined, { signal: combined }).catch(() => { });
         }
     }

package/dist/errors.d.ts

@@ -1,5 +1,5 @@
 /** Stable, non-sensitive failures shared by the host's public boundaries. */
-export declare const FAILURE_CODES: readonly ['credentials-unavailable', 'shell-unavailable', 'timer-unavailable', 'component-unavailable', 'runtime-unsupported', 'busy', 'invalid-method', 'not-connected', 'not-refreshable', 'device-auth-disabled', 'access-denied', 'authorization-expired', 'rate-limited', 'network', 'timeout', 'invalid-response', 'process-exited', 'credential-write-failed', 'credential-changed', 'settings-unavailable', 'models-unavailable', 'models-empty', 'models-confirmation-required', 'settings-conflict', 'settings-write-failed', 'ownership-save-failed', 'invalid-context-window', 'context-window-exceeded', 'model-not-found', 'cancelled', 'unknown'];
+export declare const FAILURE_CODES: readonly ['credentials-unavailable', 'shell-unavailable', 'timer-unavailable', 'component-unavailable', 'runtime-unsupported', 'busy', 'invalid-method', 'not-connected', 'not-refreshable', 'device-auth-disabled', 'access-denied', 'authorization-expired', 'rate-limited', 'network', 'timeout', 'sign-in-timeout', 'invalid-response', 'process-exited', 'credential-write-failed', 'credential-changed', 'settings-unavailable', 'models-unavailable', 'models-empty', 'models-confirmation-required', 'settings-conflict', 'settings-write-failed', 'ownership-save-failed', 'invalid-context-window', 'context-window-exceeded', 'model-not-found', 'cancelled', 'unknown'];
 export type FailureCode = typeof FAILURE_CODES[number];
 /** The marker survives RPC implementations which serialize only Error.message. */
 export declare class SubscriptionError extends Error {
@@ -11,3 +11,14 @@ export declare function failureCode(error: unknown, fallback?: FailureCode): Fai
 export declare function oauthFailureCode(error: unknown): FailureCode;
 /** Logs deliberately omit raw server responses, paths, tokens and account ids. */
 export declare function logFailure(operation: string, error: unknown): void;
+/**
+ * One bounded, redacted line of a failed child's stderr. The driver protocol
+ * travels on stdout, so its stderr is what actually explains an early exit;
+ * dropping it entirely made such failures undiagnosable. Anything that looks
+ * like a credential is withheld rather than printed.
+ */
+export declare function logDriverStderr(stderr: {
+    readFrom(fromByte: number): {
+        text: string;
+    };
+} | undefined, operation: string): void;

package/dist/errors.js

@@ -3,7 +3,7 @@ export const FAILURE_CODES = [
     'credentials-unavailable', 'shell-unavailable', 'timer-unavailable', 'component-unavailable',
     'runtime-unsupported', 'busy', 'invalid-method', 'not-connected', 'not-refreshable',
     'device-auth-disabled', 'access-denied', 'authorization-expired', 'rate-limited',
-    'network', 'timeout', 'invalid-response', 'process-exited', 'credential-write-failed',
+    'network', 'timeout', 'sign-in-timeout', 'invalid-response', 'process-exited', 'credential-write-failed',
     'credential-changed', 'settings-unavailable', 'models-unavailable', 'models-empty',
     'models-confirmation-required', 'settings-conflict', 'settings-write-failed',
     'ownership-save-failed', 'invalid-context-window', 'context-window-exceeded', 'model-not-found',
@@ -57,3 +57,28 @@ export function oauthFailureCode(error) {
 export function logFailure(operation, error) {
     console.error(`[openai-subscription] ${operation}: ${failureCode(error)}`);
 }
+/** Journal-like token shapes never reach the console, even from a failed child. */
+const SENSITIVE_IN_DIAGNOSTIC = /(access|refresh|id|session|bearer|api)[_-]?token|authorization_code|code_verifier|eyJ[A-Za-z0-9_-]{8,}/i;
+/**
+ * One bounded, redacted line of a failed child's stderr. The driver protocol
+ * travels on stdout, so its stderr is what actually explains an early exit;
+ * dropping it entirely made such failures undiagnosable. Anything that looks
+ * like a credential is withheld rather than printed.
+ */
+export function logDriverStderr(stderr, operation) {
+    if (stderr === undefined)
+        return;
+    let text;
+    try {
+        text = stderr.readFrom(0).text;
+    }
+    catch {
+        return;
+    }
+    const line = text.split('\n')
+        .map((entry) => entry.replace(/[\u0000-\u001f\u007f]+/g, ' ').trim())
+        .find((entry) => entry !== '' && !/^\(node:\d+\)/.test(entry) && !/^at\s/.test(entry) && !/ExperimentalWarning|--trace-warnings/.test(entry));
+    if (line === undefined || SENSITIVE_IN_DIAGNOSTIC.test(line))
+        return;
+    console.error(`[openai-subscription] ${operation} child stderr: ${line.length > 200 ? line.slice(0, 200) + '…' : line}`);
+}

package/dist/host.js

@@ -2,7 +2,7 @@
 // OAuth is delegated to the OpenAI Codex integration bundled with DSH.
 import { resolveAuthModule, buildNodeCommand, runtimeSupported } from './platform.js';
 export { authModuleCandidates } from './platform.js';
-import { DRIVER_REFRESH, parseDriverMessage, runDeviceDriver } from './driver.js';
+import { DRIVER_REFRESH, DEVICE_SHELL_TIMEOUT_MS, DEVICE_TIMEOUT_MS, parseDriverMessage, runDeviceDriver } from './driver.js';
 import { SubscriptionError, failureCode, oauthFailureCode, logFailure } from './errors.js';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { normalizeOAuthCredential } from './oauth.js';
@@ -172,7 +172,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
         notify({ kind: 'requesting-code', message: '正在向 OpenAI 请求设备登录码…' });
         const granted = await runDeviceDriver(shell, modulePath, control.signal, (code, url) => {
             notify({ kind: 'enter-code', message: '请在 OpenAI 验证页面输入设备码。', code, url });
-        });
+        }, { timeoutMs: DEVICE_TIMEOUT_MS, shellTimeoutMs: DEVICE_SHELL_TIMEOUT_MS });
         if (granted === null || control.aborted())
             return null;
         await credentials.modifyRecord(KEY, async (current) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-openai-subscription",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "ChatGPT subscription sign-in for DeepSeek Harness via OpenAI device authorization.",
   "type": "module",
   "packageManager": "pnpm@10.6.3",