nterminal 1.3.8 → 1.3.9

package/dist/client/index.html

@@ -12,8 +12,8 @@
     <link rel="icon" type="image/png" sizes="64x64" href="/icons/favicon-64.png" />
     <link rel="icon" type="image/png" sizes="96x96" href="/icons/favicon-96.png" />
     <title>NTerminal</title>
-    <script type="module" crossorigin src="/assets/index-BOvp6zV9.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CWRDvfyP.css">
+    <script type="module" crossorigin src="/assets/index-D7fYqfyY.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CFEvEJOV.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/accounts/accountService.d.ts

@@ -1,7 +1,7 @@
 import type { AppConfig } from '../config.js';
 import type { TerminalManager } from '../terminal/TerminalManager.js';
-import type { TerminalSummary } from '../../shared/types.js';
 import type { AccountProvider, AccountStatusResponse, AccountRunningProcess, AccountRefreshStatus, AccountUsageResponse } from '../../shared/protocol.js';
+import { type LoginLauncher } from './loginSession.js';
 export type AccountDiagnostic = {
     event: 'account.refresh' | 'account.refresh_scan';
     provider?: AccountProvider;
@@ -49,6 +49,11 @@ export declare class AccountService {
     private readonly paneProcessResolver;
     private readonly processTerminator;
     private readonly processSnapshotReader;
+    private readonly loginSessions;
+    private readonly loginNotices;
+    private readonly loginLauncher;
+    private readonly loginTimeoutMs;
+    private readonly loginExitWaitMs;
     constructor(config: AppConfig, terminalManager: TerminalManager, options?: {
         homeDir?: string;
         now?: () => Date;
@@ -59,15 +64,16 @@ export declare class AccountService {
         processSnapshot?: () => Promise<ProcessSnapshotEntry[]>;
         fetcher?: typeof fetch;
         onDiagnostic?: (event: AccountDiagnostic) => void;
+        loginLauncher?: LoginLauncher;
+        loginTimeoutMs?: number;
+        loginExitWaitMs?: number;
     });
     private mutate;
     synchronize(): Promise<void>;
     select(provider: AccountProvider, profileId: string): Promise<AccountStatusResponse>;
     remove(provider: AccountProvider, profileId: string): Promise<AccountStatusResponse>;
-    beginLogin(provider: AccountProvider): Promise<{
-        terminal: TerminalSummary;
-        command: string;
-    }>;
+    beginLogin(provider: AccountProvider): Promise<AccountStatusResponse>;
+    submitLoginCode(provider: AccountProvider, code: unknown): Promise<AccountStatusResponse>;
     completeLogin(provider: AccountProvider, label: string): Promise<AccountStatusResponse>;
     cancelLogin(provider: AccountProvider): Promise<AccountStatusResponse>;
     refresh(provider: AccountProvider, profileId?: string): Promise<AccountStatusResponse>;
@@ -85,6 +91,11 @@ export declare class AccountService {
     private refreshUnlocked;
     start(): void;
     dispose(): void;
+    private loginProcessIds;
+    private stopLoginSession;
+    private expireLogin;
+    private expireLoginNotices;
+    private loginState;
     private refreshExpiringProfiles;
     private refreshAndRecord;
     private reportDiagnostic;

package/dist/server/accounts/accountService.js

@@ -6,6 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { accountReloginReason } from '../../shared/accountRelogin.js';
 import { ProviderRequestError, requestAccountUsage, requestTokenRefresh, unavailableUsage } from './providerRequests.js';
+import { createPtyLoginLauncher, LOGIN_TIMEOUT_MS, LoginSessionError, ProviderLoginSession, validateLoginCode } from './loginSession.js';
 const VAULT_DIRECTORY = 'credential-vault';
 const VAULT_INDEX = 'index.json';
 const VAULT_KEY = 'key';
@@ -23,6 +24,9 @@ const PROVIDER_TERMINATE_GRACE_MS = 2_000;
 const TERMINATION_ACKNOWLEDGEMENT_TTL_MS = 5 * 60_000;
 const USAGE_CACHE_TTL_MS = 2 * 60_000;
 const USAGE_FAILURE_TTL_MS = 30_000;
+const LOGIN_COMPLETE_EXIT_WAIT_MS = 5_000;
+const LOGIN_NOTICE_TTL_MS = 10 * 60_000;
+const LOGIN_EXPIRY_RETRY_MS = 500;
 export class AccountServiceError extends Error {
     code;
     constructor(code, message = code) {
@@ -33,7 +37,7 @@ export class AccountServiceError extends Error {
     get statusCode() {
         if (this.code === 'preview_mode')
             return 403;
-        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred'].includes(this.code))
+        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred', 'account_login_code_not_expected', 'account_login_process_unavailable', 'account_login_code_attempts_exceeded'].includes(this.code))
             return 409;
         return 400;
     }
@@ -64,6 +68,12 @@ export class AccountService {
     paneProcessResolver;
     processTerminator;
     processSnapshotReader;
+    // In-popup sign-ins: one private PTY per provider, never a workspace terminal.
+    loginSessions = new Map();
+    loginNotices = new Map();
+    loginLauncher;
+    loginTimeoutMs;
+    loginExitWaitMs;
     constructor(config, terminalManager, options = {}) {
         this.config = config;
         this.terminalManager = terminalManager;
@@ -75,13 +85,17 @@ export class AccountService {
         this.now = options.now ?? (() => new Date());
         this.fetcher = options.fetcher ?? ((...args) => fetch(...args));
         this.onDiagnostic = options.onDiagnostic ?? (() => undefined);
-        this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, await this.listProcessSnapshot()));
+        // The in-popup login CLI is NTerminal's own child, not a user session.
+        this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, withoutProcessTrees(await this.listProcessSnapshot(), this.loginProcessIds())));
         this.paneProcessResolver = options.paneProcessResolver ?? (options.processLister
             ? async () => new Map()
             : async () => resolvePaneProcesses(this.config.tmuxSocket, await this.listProcessSnapshot()));
         this.processProbe = options.processProbe ?? (async (provider) => (await this.processLister(provider)).length > 0);
-        this.processTerminator = options.processTerminator ?? terminateProviderProcesses;
+        this.processTerminator = options.processTerminator ?? ((provider, processes) => terminateProviderProcesses(provider, processes, this.loginProcessIds()));
         this.processSnapshotReader = options.processSnapshot ?? listUserProcesses;
+        this.loginLauncher = options.loginLauncher ?? createPtyLoginLauncher();
+        this.loginTimeoutMs = options.loginTimeoutMs ?? LOGIN_TIMEOUT_MS;
+        this.loginExitWaitMs = options.loginExitWaitMs ?? LOGIN_COMPLETE_EXIT_WAIT_MS;
     }
     // Reject overlapping mutations instead of accumulating requests behind OAuth I/O.
     async mutate(operation) {
@@ -112,6 +126,32 @@ export class AccountService {
     beginLogin(provider) {
         return this.mutate(() => this.beginLoginUnlocked(provider));
     }
+    // Forwards a pasted Claude authorization code to the login CLI. Only a
+    // strictly shaped `code#state` value is written, followed by Enter.
+    async submitLoginCode(provider, code) {
+        if (this.config.previewMode)
+            throw new AccountServiceError('preview_mode');
+        if (this.disposed)
+            throw new AccountServiceError('account_operation_busy');
+        const valid = validateLoginCode(provider, code);
+        if (!valid)
+            throw new AccountServiceError(provider === 'claude' ? 'account_login_code_invalid' : 'account_login_code_not_expected');
+        const index = await this.readIndex();
+        if (!index.pending[provider])
+            throw new AccountServiceError('account_login_not_pending');
+        const session = this.loginSessions.get(provider);
+        if (!session)
+            throw new AccountServiceError('account_login_process_unavailable');
+        try {
+            session.submitCode(valid);
+        }
+        catch (error) {
+            if (error instanceof LoginSessionError)
+                throw new AccountServiceError(error.code);
+            throw error;
+        }
+        return this.status();
+    }
     completeLogin(provider, label) {
         return this.mutate(() => this.completeLoginUnlocked(provider, label));
     }
@@ -229,6 +269,7 @@ export class AccountService {
         await Promise.all(['codex', 'claude'].map(async (provider) => {
             pendingReady.set(provider, Boolean(refreshed.pending[provider] && await this.readCredentialFile(provider).catch(() => null)));
         }));
+        this.expireLoginNotices();
         return {
             providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, processes.get(provider) ?? [], processCheckUnavailable, pendingReady.get(provider) === true))
         };
@@ -305,28 +346,36 @@ export class AccountService {
         index.pending[provider] = {
             provider,
             previousProfileId: index.active[provider] ?? null,
-            startedAt: this.now().toISOString(),
-            terminalId: null
+            startedAt: this.now().toISOString()
         };
         delete index.active[provider];
         await this.writeIndex(index);
-        let terminal;
+        let session;
         try {
+            // `codex login` revokes the tokens of an auth.json it finds, so the CLI
+            // must start only after the archived live file is gone.
             if (current)
                 await this.removeCredentialFile(provider);
-            terminal = await this.terminalManager.createTerminal({ cwd: this.config.workspaceRoot, cols: 100, rows: 30 });
-            const command = provider === 'codex' ? 'codex login --device-auth' : 'claude auth login';
-            const wrote = await this.terminalManager.writeToTerminal(terminal.id, `${command}\r`);
-            if (!wrote)
-                throw new AccountServiceError('account_login_terminal_unavailable');
-            index.pending[provider].terminalId = terminal.id;
-            await this.writeIndex(index);
+            await this.stopLoginSession(provider);
+            let launched;
+            try {
+                launched = this.loginLauncher(provider, { homeDir: this.homeDir });
+            }
+            catch {
+                throw new AccountServiceError('account_login_process_unavailable');
+            }
+            session = new ProviderLoginSession(provider, launched, () => this.now().getTime(), this.loginTimeoutMs, (expired) => void this.expireLogin(provider, expired));
+            this.loginSessions.set(provider, session);
+            this.loginNotices.delete(provider);
             this.clearTerminationAcknowledgement(provider);
-            return { terminal, command };
+            return this.status();
         }
         catch (error) {
-            if (terminal)
-                await this.terminalManager.closeTerminal(terminal.id);
+            if (session) {
+                if (this.loginSessions.get(provider) === session)
+                    this.loginSessions.delete(provider);
+                await session.terminate();
+            }
             if (current)
                 await this.writeCredentialFile(provider, current);
             if (index.active[provider] === undefined && index.pending[provider]?.previousProfileId) {
@@ -342,6 +391,12 @@ export class AccountService {
         const pending = index.pending[provider];
         if (!pending)
             throw new AccountServiceError('account_login_not_pending');
+        if (!await this.readCredentialFile(provider))
+            throw new AccountServiceError('account_login_not_complete');
+        // Let the CLI finish its own post-login writes before the file is captured.
+        const session = this.loginSessions.get(provider);
+        if (session?.running && !await session.waitForExit(this.loginExitWaitMs))
+            await session.terminate();
         const credentials = await this.readCredentialFile(provider);
         if (!credentials)
             throw new AccountServiceError('account_login_not_complete');
@@ -352,10 +407,14 @@ export class AccountService {
         delete index.pending[provider];
         clearExternalSwitch(index, provider);
         await this.writeIndex(index);
+        if (this.loginSessions.get(provider) === session)
+            this.loginSessions.delete(provider);
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
     async cancelLoginUnlocked(provider) {
+        // Stop the CLI first so it cannot write a credential after the restore.
+        await this.stopLoginSession(provider);
         const index = await this.readIndex();
         const pending = index.pending[provider];
         if (!pending)
@@ -395,6 +454,68 @@ export class AccountService {
         if (this.refreshTimer)
             clearInterval(this.refreshTimer);
         this.refreshTimer = null;
+        // The pending entry survives in the index; after a restart the dialog
+        // reports the missing login process and offers to cancel and restore.
+        for (const session of this.loginSessions.values())
+            session.dispose();
+        this.loginSessions.clear();
+    }
+    loginProcessIds() {
+        return [...this.loginSessions.values()].filter((session) => session.running).map((session) => session.pid);
+    }
+    async stopLoginSession(provider) {
+        const session = this.loginSessions.get(provider);
+        if (!session)
+            return;
+        this.loginSessions.delete(provider);
+        await session.terminate();
+    }
+    // Timeout: stop the CLI and restore the previous credential through the
+    // normal cancel path, retrying while another account operation holds the lock.
+    async expireLogin(provider, session) {
+        await session.terminate();
+        for (let attempt = 0; attempt < 120 && !this.disposed; attempt += 1) {
+            if (this.loginSessions.get(provider) !== session)
+                return;
+            try {
+                await this.cancelLogin(provider);
+                this.loginNotices.set(provider, { code: 'login_timed_out', at: this.now().toISOString() });
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof AccountServiceError) || error.code !== 'account_operation_busy')
+                    return;
+                await sleep(LOGIN_EXPIRY_RETRY_MS);
+            }
+        }
+    }
+    expireLoginNotices() {
+        for (const [provider, notice] of this.loginNotices) {
+            if (this.now().getTime() - Date.parse(notice.at) > LOGIN_NOTICE_TTL_MS)
+                this.loginNotices.delete(provider);
+        }
+    }
+    loginState(provider, ready) {
+        const session = this.loginSessions.get(provider);
+        if (!session) {
+            return ready ? { phase: 'done' } : {
+                phase: 'failed',
+                message: 'The sign-in process is no longer running (NTerminal may have restarted). Cancel to restore the previous account, then try again.'
+            };
+        }
+        const state = session.state();
+        if (ready) {
+            // The credential exists; wait for the CLI to report success or exit.
+            if (session.succeeded || !session.running)
+                return { phase: 'done' };
+            return { ...state, phase: 'completing' };
+        }
+        if (state.phase === 'done') {
+            return session.running ? { ...state, phase: 'completing' } : {
+                ...state, phase: 'failed', message: 'The CLI reported success, but no credential file was written. Cancel and try again.'
+            };
+        }
+        return state;
     }
     async refreshExpiringProfiles() {
         if (this.refreshInFlight || this.disposed || this.config.previewMode || this.operationInFlight)
@@ -495,7 +616,8 @@ export class AccountService {
             runningProcesses,
             processCheckUnavailable,
             terminationAcknowledged: this.hasTerminationAcknowledgement(provider),
-            pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady, terminalId: pending.terminalId ?? null } : null,
+            pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady, login: this.loginState(provider, pendingReady) } : null,
+            loginNotice: pending ? null : this.loginNotices.get(provider) ?? null,
             lastExternalSwitch: index.externalSwitch?.[provider] ?? null,
             credentialPresent: Boolean(profile || pending || false)
         };
@@ -1043,8 +1165,8 @@ function displayProcessCommand(command) {
     const basename = path.basename(command);
     return basename.length <= 80 ? basename : basename.slice(0, 80);
 }
-async function terminateProviderProcesses(provider, _processes) {
-    const snapshot = await listUserProcesses();
+async function terminateProviderProcesses(provider, _processes, excludedRoots = []) {
+    const snapshot = withoutProcessTrees(await listUserProcesses(), excludedRoots);
     const daemons = provider === 'codex' ? snapshot.filter(isCodexDaemon) : [];
     // Shared daemon descendants include work for multiple TUI clients. Stop the
     // interactive clients first, then let the daemon's lifecycle command stop it.
@@ -1062,7 +1184,7 @@ async function terminateProviderProcesses(provider, _processes) {
         signalProcess(pid, 'SIGTERM');
     if (targetPids.length > 0) {
         await sleep(PROVIDER_TERMINATE_GRACE_MS);
-        const survivors = new Set(providerProcessTree(provider, await listUserProcesses()));
+        const survivors = new Set(providerProcessTree(provider, withoutProcessTrees(await listUserProcesses(), excludedRoots)));
         for (const pid of targetPids)
             if (survivors.has(pid))
                 signalProcess(pid, 'SIGKILL');
@@ -1085,6 +1207,21 @@ async function stopCodexDaemon(daemons) {
     }
     throw new AccountServiceError('codex_daemon_stop_failed');
 }
+// Drops the given processes and all their descendants from a snapshot.
+function withoutProcessTrees(entries, roots) {
+    if (roots.length === 0)
+        return entries;
+    const excluded = new Set(roots);
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const entry of entries)
+            if (excluded.has(entry.ppid) && !excluded.has(entry.pid)) {
+                excluded.add(entry.pid);
+                changed = true;
+            }
+    }
+    return entries.filter((entry) => !excluded.has(entry.pid));
+}
 function daemonDescendants(entries) {
     const parents = new Map(entries.map((entry) => [entry.pid, entry.ppid]));
     const daemons = new Set(entries.filter(isCodexDaemon).map((entry) => entry.pid));