openmausbot 0.1.62 → 0.1.65

package/dist-server/prepare-cloudflared.js

@@ -35,6 +35,12 @@ var CLOUDFLARED_ASSETS = Object.freeze({
     binarySha256: "fcfb02b575a52ca1af2e3267af4e1517bcdeb30ac48c834c69abaed3c0576ad2",
     archive: false
   }),
+  "linux-arm64": Object.freeze({
+    name: "cloudflared-linux-arm64",
+    sha256: "7747d94570fb390cf47dcb4f9555c193c6355cda9793f0d878d9049e5d6a7790",
+    binarySha256: "7747d94570fb390cf47dcb4f9555c193c6355cda9793f0d878d9049e5d6a7790",
+    archive: false
+  }),
   "win32-x64": Object.freeze({
     name: "cloudflared-windows-amd64.exe",
     sha256: "c29eee2b121f5436a642eed69fd9767da7e7b8c510fa50aaa130337f931357b5",
@@ -97,8 +103,10 @@ function executableTarget(value) {
     if (cpu === 16777223) return "darwin-x64";
     throw new Error(`unsupported cloudflared Mach-O CPU type 0x${cpu.toString(16)}`);
   }
-  if (bytes.length >= 20 && bytes.subarray(0, 4).equals(Buffer.from([127, 69, 76, 70])) && bytes[4] === 2 && bytes[5] === 1 && bytes.readUInt16LE(18) === 62) {
-    return "linux-x64";
+  if (bytes.length >= 20 && bytes.subarray(0, 4).equals(Buffer.from([127, 69, 76, 70])) && bytes[4] === 2 && bytes[5] === 1) {
+    const machine = bytes.readUInt16LE(18);
+    if (machine === 62) return "linux-x64";
+    if (machine === 183) return "linux-arm64";
   }
   if (bytes.length >= 64 && bytes[0] === 77 && bytes[1] === 90) {
     const pe = bytes.readUInt32LE(60);

package/dist-server/server/attachments.js

@@ -35,12 +35,24 @@ const IMAGE_MIMES = {
     "image/gif": ".gif",
     "image/webp": ".webp",
 };
-/** Useful document formats accepted by the phone share sheet.
+/** Useful document and audio formats accepted by the upload endpoint.
  * Generic archives, binaries, HTML, SVG, and executable/script mimes stay
  * out. Office/OpenDocument packages are allowed because they are documents,
  * despite using ZIP internally. The claimed mime determines the extension;
  * an attacker-controlled filename never does. */
 const FILE_MIMES = {
+    "audio/opus": ".opus",
+    "audio/ogg": ".ogg",
+    "audio/mpeg": ".mp3",
+    "audio/mp4": ".m4a",
+    "audio/x-m4a": ".m4a",
+    "audio/aac": ".aac",
+    "audio/wav": ".wav",
+    "audio/x-wav": ".wav",
+    "audio/wave": ".wav",
+    "audio/flac": ".flac",
+    "audio/x-flac": ".flac",
+    "audio/webm": ".webm",
     "text/plain": ".txt",
     "text/markdown": ".md",
     "text/csv": ".csv",
@@ -225,7 +237,7 @@ export function extensionForFileMime(mime) {
 export function sanitizeSharedFileName(name, mime) {
     const extension = extensionForFileMime(mime);
     if (!extension)
-        throw statusError(400, "content-type must be a supported document type");
+        throw statusError(400, "content-type must be a supported document or audio type");
     const normalized = name.normalize("NFKC").trim();
     if (!normalized)
         throw statusError(400, "name is required");
@@ -256,7 +268,7 @@ export function sanitizeSharedFileName(name, mime) {
 export async function saveFile(chunks, originalName, mime, options = {}) {
     const normalized = normalizedMime(mime);
     if (!normalized || !extensionForFileMime(normalized)) {
-        throw statusError(400, "content-type must be a supported document type");
+        throw statusError(400, "content-type must be a supported document or audio type");
     }
     const name = sanitizeSharedFileName(originalName, normalized);
     const extension = extensionForFileMime(normalized);

package/dist-server/server/auto-approve.js

@@ -11,27 +11,13 @@
 // backstop for the obvious catastrophes. Real containment is the
 // sandbox and the bot's own computer, not a regex.
 import { approvalModeFor } from "../shared/approval-mode.js";
-/** The mode a turn actually runs under, given where the turn came from.
- *
- * Full and Custom are Codex's: on any other engine they fall to Ask, so a
- * hand-edited record cannot hand Claude a bypass it was never granted.
- *
- * And Full is a decision the person made about THEIR OWN sessions with a
- * bot — "run without asking me". A turn started by another bot is not one
- * of those: the person never saw the request, and the sender may itself be
- * unattended or working off a page it just read. A Full target reached that
- * way runs as Approve for me instead — ordinary requests still flow, the
- * destructive and sensitive guards card, an unattended sender's block holds,
- * and every answer goes through the fold and into the decision log, where a
- * driver-side Full accept never appears. A webhook or scheduled turn on a
- * Full bot is unchanged: the person opted into that, and the docs say so. */
+/** Full access is the person's explicit grant to this receiving bot, including
+ * delegated work. It never inherits the sender's mode or elevates another bot.
+ * Custom is a provider-config choice rather than an app Full-access grant, so
+ * peer-started Custom turns still use Auto and its unattended downgrade.
+ * Provider support and grant confirmation are checked by the caller. */
 export function approvalModeForOrigin(mode, origin) {
-    // Provider support is settled by supportsApprovalMode at the call site;
-    // this only answers who STARTED the turn. A permissive mode is the
-    // person's grant to the bot they talk to, not to every teammate that can
-    // reach it, so a peer-started turn runs one notch down and still gets the
-    // unattended downgrade after this.
-    if ((mode === "full" || mode === "custom") && origin.peerInitiated)
+    if (mode === "custom" && origin.peerInitiated)
         return "auto";
     return mode;
 }

package/dist-server/server/config.js

@@ -216,6 +216,8 @@ const defaultModelSelectionSchema = z.object({
     effort: z.enum(EFFORT_LEVELS).optional(),
 });
 const appConfigSchema = z.object({
+    /** Verified by the dedicated domain endpoint, never a generic config patch. */
+    customDomain: z.string().optional(),
     defaultModelSelection: defaultModelSelectionSchema.optional(),
     /** CLI-only launch preferences. Never enable remote access implicitly. */
     cliStartup: z.object({
@@ -261,7 +263,7 @@ const appConfigSchema = z.object({
 const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
 });
-const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true });
+const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true });
 const jsonObjectSchema = z.record(z.string(), z.json());
 /** Resolve a canonical profile record to its exact durable Electron
  * partition identity. Callers must never substitute the display/API id. */
@@ -543,6 +545,8 @@ export function saveConfig(patch) {
     // scalar, not a section: the merge loop above only walks objects
     if (checkedPatch.language !== undefined)
         disk.language = checkedPatch.language;
+    if (checkedPatch.customDomain !== undefined)
+        disk.customDomain = checkedPatch.customDomain;
     // A selection is replaced as one value, so changing engines also clears
     // an effort level omitted from the new selection.
     if (checkedPatch.defaultModelSelection !== undefined) {

package/dist-server/server/custom-domain.js

@@ -0,0 +1,182 @@
+import { randomBytes } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpsRequest } from "node:https";
+import { BlockList, isIP } from "node:net";
+const CHECK_TIMEOUT_MS = 8_000;
+const MAX_RESPONSE_BYTES = 16_384;
+const DESCRIPTOR_PATH = "/.well-known/openmausbot/environment";
+export const CUSTOM_DOMAIN_CHALLENGE_PATH = "/.well-known/openmausbot/domain-check/";
+export class CustomDomainError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.name = "CustomDomainError";
+        this.status = status;
+    }
+}
+/** A public domain on standard HTTPS, never an invitation or arbitrary URL. */
+export function normalizeCustomDomain(raw) {
+    const value = raw.trim();
+    // Reject characters URL parsing otherwise removes or interprets as secrets.
+    // eslint-disable-next-line no-control-regex
+    if (!value || value.length > 512 || /[\s\u0000-\u001f\u007f\\?#@%]/.test(value)) {
+        throw new CustomDomainError("Enter a domain such as bots.yourcompany.com, without a path, password, or pairing code.");
+    }
+    try {
+        const url = new URL(value.includes("://") ? value : `https://${value}`);
+        const host = url.hostname.toLowerCase().replace(/\.$/, "");
+        if (url.protocol !== "https:" || url.port || url.pathname !== "/" || url.username || url.password
+            || isIP(host) || host.startsWith("[") || host.length > 253 || !host.includes(".")
+            || !host.split(".").every((part) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(part))
+            || /(?:^|\.)(?:localhost|local|internal|invalid|test)$/.test(host))
+            throw new Error("invalid origin");
+        return `https://${host}`;
+    }
+    catch {
+        throw new CustomDomainError("Use a public domain with HTTPS on port 443, without a path or pairing code.");
+    }
+}
+const excludedAddresses = new BlockList();
+for (const [address, prefix] of [
+    ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8],
+    ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24],
+    ["192.88.99.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24],
+    ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4],
+])
+    excludedAddresses.addSubnet(address, prefix, "ipv4");
+for (const [address, prefix] of [
+    ["2001::", 23], ["2001:db8::", 32], ["2002::", 16], ["3fff::", 20],
+])
+    excludedAddresses.addSubnet(address, prefix, "ipv6");
+const globalIpv6 = new BlockList();
+globalIpv6.addSubnet("2000::", 3, "ipv6");
+/** Exclude private, mapped/NAT64, multicast, documentation, and reserved ranges. */
+export function isPublicDomainAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return !excludedAddresses.check(address, "ipv4");
+    return family === 6 && globalIpv6.check(address, "ipv6") && !excludedAddresses.check(address, "ipv6");
+}
+function withAbort(promise, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(new CustomDomainError("The domain check timed out. Check DNS, HTTPS, and your reverse proxy, then try again."));
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function requestJson(url, address, signal) {
+    return new Promise((resolve, reject) => {
+        // Pin the validated DNS result for both requests. TLS/SNI and Host still use
+        // the original domain, so a DNS rebind cannot reach a private IP afterwards.
+        const lookup = (_hostname, options, callback) => {
+            if (options.all)
+                callback(null, [address]);
+            else
+                callback(null, address.address, address.family);
+        };
+        const request = httpsRequest(url, {
+            method: "GET", agent: false, lookup, signal, rejectUnauthorized: true,
+            headers: { Accept: "application/json", "User-Agent": "OpenMausBot-domain-check" },
+        }, (response) => {
+            // Node's HTTPS client does not follow Location redirects.
+            if (response.statusCode !== 200) {
+                response.destroy();
+                reject(new CustomDomainError("The domain did not return the OpenMausBot verification page. Check your reverse proxy; redirects are not supported."));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            response.on("error", reject);
+            response.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_RESPONSE_BYTES) {
+                    response.destroy();
+                    reject(new CustomDomainError("The domain returned an unexpected response. Check that it points to OpenMausBot."));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on("end", () => {
+                try {
+                    resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+                }
+                catch {
+                    reject(new CustomDomainError("The domain did not return OpenMausBot data. Check that it points to this server."));
+                }
+            });
+        });
+        request.on("error", reject);
+        request.end();
+    });
+}
+/** Verification only: callers persist the returned origin after success. The
+ * public challenge endpoint reveals no account credentials and grants no access. */
+export function createCustomDomainVerifier(dependencies) {
+    const lookup = dependencies.lookup ?? ((hostname) => dnsLookup(hostname, { all: true, verbatim: true }));
+    const request = dependencies.request ?? requestJson;
+    let inFlight = false;
+    let active = null;
+    return {
+        challenge(token) {
+            if (!active || Date.now() >= active.expiresAt || token !== active.token)
+                return null;
+            return { environmentId: dependencies.environmentId, proof: active.proof };
+        },
+        async verify(raw) {
+            const origin = normalizeCustomDomain(raw);
+            if (inFlight)
+                throw new CustomDomainError("A domain check is already running. Wait for it to finish, then try again.", 409);
+            inFlight = true;
+            const controller = new AbortController();
+            const timeoutMs = dependencies.timeoutMs ?? CHECK_TIMEOUT_MS;
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                let addresses;
+                try {
+                    addresses = await withAbort(lookup(new URL(origin).hostname), controller.signal);
+                }
+                catch (error) {
+                    if (error instanceof CustomDomainError)
+                        throw error;
+                    throw new CustomDomainError("The domain could not be found in DNS. Add its A or AAAA record and allow time for it to become available.");
+                }
+                if (!addresses.length || addresses.some((entry) => !isPublicDomainAddress(entry.address)
+                    || isIP(entry.address) !== entry.family)) {
+                    throw new CustomDomainError("The domain must resolve only to public internet addresses. Local, private, and reserved addresses cannot be connected here.");
+                }
+                // Prefer IPv4 where both exist; use the exact same address for proof.
+                const address = addresses.find((entry) => entry.family === 4) ?? addresses[0];
+                const descriptor = await withAbort(request(new URL(DESCRIPTOR_PATH, origin), address, controller.signal), controller.signal);
+                if (!descriptor || typeof descriptor !== "object"
+                    || Reflect.get(descriptor, "environmentId") !== dependencies.environmentId) {
+                    throw new CustomDomainError("This domain does not point to this OpenMausBot server. Check its DNS and reverse proxy configuration.");
+                }
+                active = {
+                    token: randomBytes(32).toString("hex"), proof: randomBytes(32).toString("hex"),
+                    expiresAt: Date.now() + timeoutMs,
+                };
+                const proof = await withAbort(request(new URL(`${CUSTOM_DOMAIN_CHALLENGE_PATH}${active.token}`, origin), address, controller.signal), controller.signal);
+                if (!proof || typeof proof !== "object" || Reflect.get(proof, "environmentId") !== dependencies.environmentId
+                    || Reflect.get(proof, "proof") !== active.proof) {
+                    throw new CustomDomainError("The domain could not prove it reaches this server. Forward all OpenMausBot routes through your reverse proxy and try again.");
+                }
+                return { origin, verifiedAt: new Date().toISOString() };
+            }
+            catch (error) {
+                if (error instanceof CustomDomainError)
+                    throw error;
+                throw new CustomDomainError("A secure connection to the domain could not be verified. Check its HTTPS certificate, firewall, and reverse proxy.");
+            }
+            finally {
+                clearTimeout(timer);
+                controller.abort();
+                active = null;
+                inFlight = false;
+            }
+        },
+    };
+}

package/dist-server/server/drivers/codex-device-auth.js

@@ -0,0 +1,234 @@
+import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+import { killCliTree, spawnCli } from "../procs.js";
+const DEVICE_URL = "https://auth.openai.com/codex/device";
+const MAX_OUTPUT = 16_384;
+// Two configured instances can use the same on-disk login. Only the auth
+// operation is exclusive: normal turns are not blocked by this lock.
+const authenticatingHomes = new Set();
+function canonicalPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        const parent = dirname(path);
+        return parent === path ? path : join(canonicalPath(parent), basename(path));
+    }
+}
+export function codexDevicePrompt(output) {
+    const clean = stripVTControlCharacters(output);
+    // Chunks may stop halfway through a code. Never publish the incomplete
+    // final line before its newline arrives.
+    const lines = clean.split(/\r?\n/).slice(0, -1).map((line) => line.trim());
+    // Do not turn arbitrary output into a link, or pass through query tokens.
+    if (!lines.some((line) => /^https:\/\/auth\.openai\.com\/codex\/device\/?$/.test(line)))
+        return null;
+    const userCode = lines.find((line) => /^[A-Z0-9]{4,8}-[A-Z0-9]{4,8}$/.test(line));
+    return userCode ? { authorizationUrl: DEVICE_URL, userCode } : null;
+}
+function loginFailure(output) {
+    if (/(unexpected argument|unrecognized (argument|option)|unknown option).*device-auth/i.test(output)) {
+        return "This server's Codex CLI needs updating for browser sign-in. Run npm install -g @openai/codex@latest on the server, then try again.";
+    }
+    if (/device.{0,40}(disabled|not enabled|not allowed)|enable.{0,40}device/i.test(output)) {
+        return "Enable device-code login in your ChatGPT security settings or ask your workspace admin to allow it, then try again.";
+    }
+    if (/expired|expiration|timed out/i.test(output)) {
+        return "The ChatGPT sign-in code expired. Start sign-in again for a new code.";
+    }
+    return "ChatGPT sign-in did not finish. Check the server's connection and that device-code login is enabled in ChatGPT, then try again.";
+}
+/** A fixed Codex login command, not a remotely accessible terminal. CLI
+ * output stays in bounded private memory; only a device URL/code is exposed. */
+export class CodexDeviceAuthController {
+    flow = null;
+    disposed = false;
+    options;
+    constructor(options) { this.options = options; }
+    async start() {
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing in.");
+        if (this.flow?.status.phase === "waiting") {
+            if (this.flow.ready)
+                return { ...this.flow.status, phase: "waiting" };
+            throw new Error("A ChatGPT sign-in is already starting. Please wait for the code.");
+        }
+        await this.flow?.stopping;
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing in.");
+        const env = this.options.environment();
+        const home = env.HOME || env.USERPROFILE || homedir();
+        if (!isAbsolute(home) || (env.CODEX_HOME && !isAbsolute(env.CODEX_HOME))) {
+            throw new Error("Use an absolute HOME and CODEX_HOME path for this server's Codex provider before signing in.");
+        }
+        const homeKey = canonicalPath(resolve(env.CODEX_HOME || join(home, ".codex")));
+        if (authenticatingHomes.has(homeKey)) {
+            throw new Error("A ChatGPT sign-in is already running for this server account. Finish or cancel it before starting another.");
+        }
+        authenticatingHomes.add(homeKey);
+        return new Promise((resolveStart, reject) => {
+            const flow = {
+                status: {
+                    phase: "waiting", flowId: randomUUID(), authorizationUrl: null,
+                    expiresAt: new Date(Date.now() + (this.options.lifetimeMs ?? 15 * 60_000)).toISOString(),
+                },
+                child: null, ready: false, resolve: resolveStart, reject, homeKey,
+                startupTimer: setTimeout(() => this.finish(flow, "failed", "Codex did not provide a sign-in code in time. Check the server connection and update Codex, then try again."), this.options.startupTimeoutMs ?? 30_000),
+                expiryTimer: setTimeout(() => this.finish(flow, "expired", "The ChatGPT sign-in code expired. Start sign-in again."), this.options.lifetimeMs ?? 15 * 60_000),
+            };
+            flow.startupTimer.unref();
+            flow.expiryTimer.unref();
+            this.flow = flow;
+            // Never overwrite a working login just because Connect was clicked twice.
+            this.run(flow, ["login", "status"], env, home, (code, output) => {
+                if (code === 0 && /^logged in.*chatgpt\b/im.test(output)) {
+                    this.finish(flow, "succeeded");
+                }
+                else if (code === 0 && /^logged in\b/im.test(output)) {
+                    this.finish(flow, "failed", "Codex already has a different sign-in method on this server. Ask the server administrator to review it before changing accounts.");
+                }
+                else if (code !== 0 && /^not logged in\b/im.test(output)) {
+                    this.run(flow, ["login", "--device-auth"], env, home, (loginCode, loginOutput) => {
+                        if (loginCode !== 0 || !flow.ready) {
+                            this.finish(flow, "failed", loginFailure(loginOutput));
+                            return;
+                        }
+                        // A successful command is not enough: verify credentials using the
+                        // same executable and environment that will run this client's bots.
+                        flow.startupTimer = setTimeout(() => this.finish(flow, "failed", "Codex finished sign-in but could not confirm the account. Refresh Settings and try again."), this.options.startupTimeoutMs ?? 30_000);
+                        flow.startupTimer.unref();
+                        this.run(flow, ["login", "status"], env, home, (statusCode, statusOutput) => {
+                            this.finish(flow, statusCode === 0 && /^logged in.*chatgpt\b/im.test(statusOutput) ? "succeeded" : "failed", "Codex finished sign-in but did not confirm a ChatGPT account. Refresh Settings and try again.");
+                        });
+                    }, true);
+                }
+                else
+                    this.finish(flow, "failed", "Codex could not confirm the existing sign-in on this server. Update Codex and check its login status before trying again.");
+            });
+        });
+    }
+    async get(flowId) {
+        if (!flowId || this.flow?.status.flowId !== flowId)
+            throw new Error("This sign-in is no longer available. Start sign-in again.");
+        return { ...this.flow.status };
+    }
+    async cancel() {
+        if (this.flow?.status.phase === "waiting")
+            this.finish(this.flow, "cancelled", "ChatGPT sign-in cancelled.");
+        await this.flow?.stopping;
+        if (this.flow?.terminationFailed)
+            throw new Error(this.flow.status.message);
+    }
+    async dispose() {
+        this.disposed = true;
+        await this.cancel();
+        this.flow = null;
+    }
+    run(flow, args, env, cwd, done, parsePrompt = false) {
+        if (flow.status.phase !== "waiting")
+            return;
+        let child;
+        try {
+            child = spawnCli(this.options.cli, args, { env: { ...env, NO_COLOR: "1" }, cwd, stdio: ["pipe", "pipe", "pipe"] });
+        }
+        catch {
+            this.finish(flow, "failed", "Codex could not start on this server. Install or update the configured Codex CLI, then try again.");
+            return;
+        }
+        flow.child = child;
+        child.stdin.end();
+        let output = "";
+        const receive = (chunk) => {
+            if (flow.status.phase !== "waiting")
+                return;
+            if (output.length + chunk.length > MAX_OUTPUT) {
+                this.finish(flow, "failed", "Codex returned an unexpected sign-in response. Update the server's Codex CLI and try again.");
+                return;
+            }
+            output += chunk.toString("utf8");
+            const prompt = parsePrompt && !flow.ready ? codexDevicePrompt(output) : null;
+            if (prompt) {
+                flow.status = { ...flow.status, ...prompt };
+                flow.ready = true;
+                clearTimeout(flow.startupTimer);
+                flow.resolve({ ...flow.status, phase: "waiting" });
+            }
+        };
+        child.stdout.on("data", receive);
+        child.stderr.on("data", receive);
+        child.once("error", (error) => {
+            const message = error.code === "ENOENT"
+                ? "Codex is not installed on this server. Run npm install -g @openai/codex@latest on the server, then try again."
+                : "Codex could not start on this server. Check the configured CLI path and its executable permissions.";
+            this.finish(flow, "failed", message);
+        });
+        child.once("close", (code) => {
+            if (flow.child === child)
+                flow.child = null;
+            if (flow.status.phase === "waiting")
+                done(code, stripVTControlCharacters(output));
+            output = "";
+        });
+    }
+    finish(flow, phase, message) {
+        if (flow.status.phase !== "waiting")
+            return;
+        clearTimeout(flow.startupTimer);
+        clearTimeout(flow.expiryTimer);
+        flow.status = {
+            phase, flowId: flow.status.flowId, authorizationUrl: null, expiresAt: null,
+            ...(phase !== "succeeded" && message ? { message } : {}),
+        };
+        if (!flow.ready) {
+            if (phase === "succeeded")
+                flow.resolve({ ...flow.status, phase });
+            else
+                flow.reject(new Error(message ?? "ChatGPT sign-in did not finish."));
+        }
+        flow.stopping = this.stopChild(flow).catch(() => false).then((stopped) => {
+            const release = () => authenticatingHomes.delete(flow.homeKey);
+            if (stopped) {
+                release();
+                return;
+            }
+            flow.terminationFailed = true;
+            flow.status = { ...flow.status, phase: "failed", message: "Codex could not be stopped on this server. Ask the server administrator to stop the login process before trying again." };
+            // Retain the credential-home lock until the OS actually reports exit.
+            const child = flow.child;
+            if (!child || child.exitCode !== null || child.signalCode !== null)
+                release();
+            else
+                child.once("close", release);
+        });
+        if (phase === "succeeded")
+            void this.options.onAuthenticated?.().catch(() => { });
+    }
+    async stopChild(flow) {
+        const child = flow.child;
+        if (!child || await killCliTree(child, this.options.terminateTimeoutMs ?? 1500))
+            return true;
+        // A broken CLI may ignore SIGTERM. Do not leave a stale device flow able
+        // to write credentials after the user cancelled it.
+        if (process.platform !== "win32" && child.pid) {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        }
+        else
+            child.kill("SIGKILL");
+        await new Promise((resolveStop) => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return resolveStop();
+            const timer = setTimeout(resolveStop, 1500);
+            timer.unref();
+            child.once("close", () => { clearTimeout(timer); resolveStop(); });
+        });
+        return child.exitCode !== null || child.signalCode !== null;
+    }
+}

package/dist-server/server/drivers/codex.js

@@ -23,6 +23,7 @@ import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { appendNative } from "./native.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
+import { CodexDeviceAuthController } from "./codex-device-auth.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -424,6 +425,11 @@ export const CodexDriver = {
             }
         };
         await refreshModels();
+        const authentication = new CodexDeviceAuthController({
+            cli: config.cli,
+            environment: childEnv,
+            onAuthenticated: refreshModels,
+        });
         const listeners = new Set();
         const active = new Map();
         const emit = (event) => {
@@ -1105,6 +1111,9 @@ export const CodexDriver = {
                 return models;
             },
             refreshModels,
+            startAuthentication: () => authentication.start(),
+            getAuthentication: (flowId) => authentication.get(flowId),
+            cancelAuthentication: () => authentication.cancel(),
             snapshot,
             adapter: {
                 provider: DRIVER_KIND,
@@ -1143,6 +1152,7 @@ export const CodexDriver = {
                 },
             },
             dispose: async () => {
+                await authentication.dispose();
                 await Promise.all([...active.values()].map(({ stop }) => stop()));
                 listeners.clear();
             },

package/dist-server/server/harness/registry.js

@@ -122,6 +122,10 @@ export class ProviderRegistry {
         const instance = this.get(instanceId);
         return instance?.startAuthentication ? instance.startAuthentication() : null;
     }
+    async getAuthentication(instanceId, flowId) {
+        const instance = this.get(instanceId);
+        return instance?.getAuthentication ? instance.getAuthentication(flowId) : null;
+    }
     async completeAuthentication(instanceId, flowId, callbackUrl) {
         const instance = this.get(instanceId);
         if (!instance?.completeAuthentication)
@@ -200,6 +204,9 @@ export class ProviderRegistry {
                 },
                 access: driver?.metadata.access ?? "subscription",
                 install: driver?.install,
+                authentication: inst.startAuthentication
+                    ? { method: inst.getAuthentication ? "device-code" : "browser" }
+                    : undefined,
                 cli: this.cliByInstance.get(inst.instanceId),
                 cliDefault: cliDefaultOf(driver),
                 // every copy of the driver's default binary on the augmented PATH —