nterminal 1.3.15 → 1.3.16

package/dist/client/index.html

@@ -12,7 +12,7 @@
     <link rel="icon" type="image/png" sizes="64x64" href="/icons/favicon-64.png" />
     <link rel="icon" type="image/png" sizes="96x96" href="/icons/favicon-96.png" />
     <title>NTerminal</title>
-    <script type="module" crossorigin src="/assets/index-BiIblEKQ.js"></script>
+    <script type="module" crossorigin src="/assets/index-tUmhlnUC.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-D1X7cDQ9.css">
   </head>
   <body>

package/dist/server/accounts/accountService.d.ts

@@ -56,6 +56,7 @@ export declare class AccountService {
     private readonly loginLauncher;
     private readonly loginTimeoutMs;
     private readonly loginExitWaitMs;
+    private readonly releaseCodexDaemon;
     constructor(config: AppConfig, terminalManager: TerminalManager, options?: {
         homeDir?: string;
         now?: () => Date;
@@ -70,6 +71,7 @@ export declare class AccountService {
         loginLauncher?: LoginLauncher;
         loginTimeoutMs?: number;
         loginExitWaitMs?: number;
+        releaseCodexDaemon?: (pid: number, mayStop: () => Promise<boolean>) => Promise<boolean>;
     });
     private mutate;
     synchronize(): Promise<void>;
@@ -91,6 +93,8 @@ export declare class AccountService {
     private removeUnlocked;
     private beginLoginUnlocked;
     private completeLoginUnlocked;
+    private markApplicationPending;
+    private applySelectedAccount;
     private renameUnlocked;
     private cancelLoginUnlocked;
     private refreshUnlocked;

package/dist/server/accounts/accountService.js

@@ -8,6 +8,7 @@ import { accountReloginReason } from '../../shared/accountRelogin.js';
 import { ProviderRequestError, requestAccountUsage, requestTokenRefresh, unavailableUsage } from './providerRequests.js';
 import { createPtyLoginLauncher, LOGIN_TIMEOUT_MS, LoginSessionError, ProviderLoginSession, validateLoginCode } from './loginSession.js';
 import { readBootTimeSecondsAsync, readProcessStartTicksAsync } from '../terminal/procfs.js';
+import { releaseIdleCodexDaemon } from './codexDaemonAuth.js';
 const VAULT_DIRECTORY = 'credential-vault';
 const VAULT_INDEX = 'index.json';
 const VAULT_KEY = 'key';
@@ -76,6 +77,7 @@ export class AccountService {
     loginLauncher;
     loginTimeoutMs;
     loginExitWaitMs;
+    releaseCodexDaemon;
     constructor(config, terminalManager, options = {}) {
         this.config = config;
         this.terminalManager = terminalManager;
@@ -101,6 +103,8 @@ export class AccountService {
         this.loginLauncher = options.loginLauncher ?? createPtyLoginLauncher();
         this.loginTimeoutMs = options.loginTimeoutMs ?? LOGIN_TIMEOUT_MS;
         this.loginExitWaitMs = options.loginExitWaitMs ?? LOGIN_COMPLETE_EXIT_WAIT_MS;
+        this.releaseCodexDaemon = options.releaseCodexDaemon ?? (options.processProbe || options.processLister || options.processSnapshot
+            ? async () => false : (pid, mayStop) => releaseIdleCodexDaemon(this.homeDir, pid, mayStop));
     }
     // Reject overlapping mutations instead of accumulating requests behind OAuth I/O.
     async mutate(operation) {
@@ -278,7 +282,7 @@ export class AccountService {
         const pendingReady = new Map();
         await Promise.all(['codex', 'claude'].map(async (provider) => {
             const credentials = refreshed.pending[provider] ? await this.readCredentialFile(provider).catch(() => null) : null;
-            pendingReady.set(provider, { ready: Boolean(credentials), suggestedLabel: credentials ? suggestedLabel(refreshed, provider, credentials) : null });
+            pendingReady.set(provider, { ready: Boolean(credentials && hasOAuthCredential(provider, credentials)), suggestedLabel: credentials ? suggestedLabel(refreshed, provider, credentials) : null });
         }));
         this.expireLoginNotices();
         return {
@@ -303,6 +307,9 @@ export class AccountService {
         if (index.active[provider] === profile.id) {
             if (clearExternalSwitch(index, provider))
                 await this.writeIndex(index);
+            const credentials = await this.readCredentialFile(provider);
+            if (credentials)
+                await this.applySelectedAccount(index, profile, credentials);
             this.clearTerminationAcknowledgement(provider);
             return this.status();
         }
@@ -311,6 +318,7 @@ export class AccountService {
         try {
             await this.writeCredentialFile(provider, credentials);
             index.active[provider] = profile.id;
+            this.markApplicationPending(index, profile);
             clearExternalSwitch(index, provider);
             await this.writeIndex(index);
         }
@@ -324,6 +332,7 @@ export class AccountService {
         // The selected profile's vault copy is exactly what was just published, so
         // it already is the active backup. The previous account kept its archive.
         this.clearTerminationAcknowledgement(provider);
+        await this.applySelectedAccount(index, profile, credentials);
         return this.status();
     }
     async removeUnlocked(provider, profileId) {
@@ -401,27 +410,102 @@ export class AccountService {
         const pending = index.pending[provider];
         if (!pending)
             throw new AccountServiceError('account_login_not_pending');
-        if (!await this.readCredentialFile(provider))
-            throw new AccountServiceError('account_login_not_complete');
         // Let the CLI finish its own post-login writes before the file is captured.
         const session = this.loginSessions.get(provider);
-        if (session?.running && !await session.waitForExit(this.loginExitWaitMs))
-            await session.terminate();
+        if (!session)
+            throw new AccountServiceError('account_login_process_unavailable');
+        if (session.running)
+            await session.waitForExit(this.loginExitWaitMs);
+        if (!session.completed)
+            throw new AccountServiceError('account_login_not_complete');
         const credentials = await this.readCredentialFile(provider);
-        if (!credentials)
+        if (!credentials || !hasOAuthCredential(provider, credentials))
             throw new AccountServiceError('account_login_not_complete');
         const profile = await this.storeProfile(index, provider, credentials, label);
         // Back up the new active login before committing it as active.
         await this.writeVaultCredentials(profile.id, credentials);
         index.active[provider] = profile.id;
+        this.markApplicationPending(index, profile);
         delete index.pending[provider];
         clearExternalSwitch(index, provider);
         await this.writeIndex(index);
         if (this.loginSessions.get(provider) === session)
             this.loginSessions.delete(provider);
         this.clearTerminationAcknowledgement(provider);
+        await this.applySelectedAccount(index, profile, credentials);
         return this.status();
     }
+    markApplicationPending(index, profile) {
+        index.application ??= {};
+        index.application[profile.provider] = { profileId: profile.id, state: 'pending', reason: 'setup_failed', checkedAt: this.now().toISOString() };
+    }
+    // Credential storage is committed before runtime preparation. A failed check
+    // must never roll back a successful sign-in or delete its valid tokens.
+    async applySelectedAccount(index, profile, credentials) {
+        this.markApplicationPending(index, profile);
+        const application = index.application[profile.provider];
+        await this.writeIndex(index);
+        try {
+            if (!hasOAuthCredential(profile.provider, credentials))
+                throw new Error('missing credential');
+            const stillSelected = async () => {
+                const live = await this.readCredentialFile(profile.provider);
+                return live !== null && hashCredential(live) === hashCredential(credentials);
+            };
+            if (!await stillSelected())
+                throw new Error('credential changed');
+            if (profile.provider === 'claude') {
+                const settings = await this.readClaudeSettings();
+                if (settings.hasCompletedOnboarding !== true) {
+                    if (this.runningPanes().some(pane => pane.provider === 'claude') || await this.processProbe('claude')) {
+                        application.reason = 'sessions_running';
+                        return;
+                    }
+                    if (!await stillSelected())
+                        throw new Error('credential changed');
+                    const latest = await this.readClaudeSettings();
+                    // Skip only the already-completed login wizard, never project trust,
+                    // permissions, sandbox settings or user preferences.
+                    await atomicWrite(path.join(this.homeDir, '.claude.json'), JSON.stringify({ ...latest, hasCompletedOnboarding: true }, null, 2), 0o600);
+                }
+            }
+            else {
+                const processes = await this.processLister('codex');
+                const daemons = processes.filter(isCodexDaemon);
+                if (processes.some(entry => !isCodexDaemon(entry)) || this.runningPanes().some(pane => pane.provider === 'codex')) {
+                    application.reason = 'sessions_running';
+                    return;
+                }
+                if (daemons.length > 0) {
+                    application.reason = 'daemon_unverified';
+                    // Multiple homes/daemons are intentionally not guessed at.
+                    if (daemons.length !== 1)
+                        return;
+                    const pid = daemons[0].pid;
+                    const released = await this.releaseCodexDaemon(pid, async () => {
+                        const latest = await this.processLister('codex');
+                        return !this.disposed && await stillSelected()
+                            && !this.runningPanes().some(pane => pane.provider === 'codex')
+                            && latest.length === 1 && latest[0].pid === pid && isCodexDaemon(latest[0])
+                            && !(await this.listProcessSnapshot()).some(entry => entry.ppid === pid);
+                    });
+                    if (!released || (await this.processLister('codex')).length > 0)
+                        return;
+                }
+            }
+            if (!await stillSelected())
+                throw new Error('credential changed');
+            application.state = 'ready';
+            application.reason = null;
+        }
+        catch {
+            application.reason = 'setup_failed';
+        }
+        finally {
+            application.checkedAt = this.now().toISOString();
+            await this.writeIndex(index);
+        }
+    }
     async renameUnlocked(provider, profileId, label) {
         const index = await this.readIndex();
         const profile = index.profiles.find((candidate) => candidate.id === profileId && candidate.provider === provider);
@@ -457,6 +541,8 @@ export class AccountService {
             await this.removeCredentialFile(provider);
         }
         delete index.pending[provider];
+        if (index.application)
+            delete index.application[provider];
         await this.writeIndex(index);
         this.clearTerminationAcknowledgement(provider);
         return this.status();
@@ -527,15 +613,16 @@ export class AccountService {
     loginState(provider, ready) {
         const session = this.loginSessions.get(provider);
         if (!session) {
-            return ready ? { phase: 'done' } : {
+            return {
                 phase: 'failed',
                 message: 'The sign-in process is no longer running (NTerminal may have restarted). Cancel to restore the previous account, then try again.'
             };
         }
         const state = session.state();
+        if (state.phase === 'failed')
+            return state;
         if (ready) {
-            // The credential exists; wait for the CLI to report success or exit.
-            if (session.succeeded || !session.running)
+            if (session.completed)
                 return { phase: 'done' };
             return { ...state, phase: 'completing' };
         }
@@ -641,6 +728,7 @@ export class AccountService {
         return {
             provider,
             activeProfileId: activeId,
+            ...(index.application?.[provider]?.profileId === activeId && !pending ? { application: index.application[provider] } : {}),
             profiles: index.profiles.filter((candidate) => candidate.provider === provider).map(toPublicProfile),
             runningPanes: running.filter((pane) => pane.provider === provider),
             runningProcesses,
@@ -711,7 +799,10 @@ export class AccountService {
             if (index.pending[provider])
                 continue;
             try {
+                const previousId = index.active[provider];
                 await this.captureActiveCredential(index, provider);
+                if (index.active[provider] !== previousId && index.application)
+                    delete index.application[provider];
                 await this.backfillAccountEmails(index, provider);
                 this.diagnosticSignatures.delete(`account.refresh_scan:${provider}:`);
             }
@@ -1056,6 +1147,7 @@ export class AccountService {
                 profiles,
                 active: isRecord(parsed.active) ? parsed.active : {},
                 pending: isRecord(parsed.pending) ? parsed.pending : {},
+                application: parseApplications(parsed.application),
                 ...(externalSwitch ? { externalSwitch } : {})
             };
         }
@@ -1426,6 +1518,28 @@ function clearExternalSwitch(index, provider) {
     index.externalSwitch = rest;
     return true;
 }
+function hasOAuthCredential(provider, document) {
+    const tokens = provider === 'codex' ? document.tokens : document.claudeAiOauth;
+    if (!isRecord(tokens))
+        return false;
+    const access = provider === 'codex' ? tokens.access_token : tokens.accessToken;
+    const refresh = provider === 'codex' ? tokens.refresh_token : tokens.refreshToken;
+    return typeof access === 'string' && access.length > 0 && typeof refresh === 'string' && refresh.length > 0;
+}
+function parseApplications(value) {
+    const result = {};
+    if (!isRecord(value))
+        return result;
+    for (const provider of ['codex', 'claude']) {
+        const entry = value[provider];
+        if (isRecord(entry) && typeof entry.profileId === 'string' && typeof entry.checkedAt === 'string'
+            && (entry.state === 'ready' || entry.state === 'pending')
+            && (entry.reason === null || entry.reason === 'sessions_running' || entry.reason === 'daemon_unverified' || entry.reason === 'setup_failed')) {
+            result[provider] = { profileId: entry.profileId, state: entry.state, reason: entry.reason, checkedAt: entry.checkedAt };
+        }
+    }
+    return result;
+}
 function parseExternalSwitches(value) {
     const result = {};
     for (const provider of ['codex', 'claude']) {