openmausbot 0.1.97 → 0.1.99

package/dist-server/server/drivers/codex.js

@@ -10,7 +10,7 @@ import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
 //
 // resumeCursor is the codex thread id; a later turn tries thread/resume
 // and preserves that history or reports a failed resume.
-import { existsSync, mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -23,7 +23,7 @@ import { ChatGptPlanAuthController } from "./chatgpt-plan-auth.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { isHarnessOwnedMcpEnvName } from "../mcp-registry.js";
 import { newEventId, newId } from "../contracts.js";
-import { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
+import { decodeCodexSelection, OFFICIAL_CODEX_PROVIDER, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 import { codexLocalProviderArgs } from "./local-inject.js";
 import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
@@ -33,7 +33,8 @@ import { commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
 import { volatileContextNote, withContextNote } from "./prompt-split.js";
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
-import { codexAccountEmail } from "./codex-identity.js";
+import { codexAccountEmail, codexHome } from "./codex-identity.js";
+import { keyRejected, noteKeyAccepted, noteKeyRejected } from "../key-rejections.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { parseProtocolAskQuestions, questionAnswersById, questionChoices } from "../../shared/ask-question.js";
@@ -54,6 +55,30 @@ export function codexUserError(value, chatgptPlan) {
     }
     return value.slice(0, 400);
 }
+// Codex's own words when OpenAI refuses its stored ChatGPT login (codex-cli
+// 0.160 login/src/auth: workspace routing, token refresh, auth storage).
+const CODEX_SIGN_IN_REFUSED = /workspace routing discovery unauthorized|access token could not be refreshed|authentication session could not be refreshed|ChatGPT login is required|auth data is not available|please (?:log out and )?sign in again/i;
+/** A turn error (TurnError: message, codexErrorInfo) that says Codex's own
+ * sign-in was refused: `unauthorized`, a 401 from the model backend, or one
+ * of Codex's sign-in messages. A 401 from an MCP server or a tool reaches the
+ * model as a tool result, never as a turn error, so it cannot land here. */
+export function codexSignInRefused(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const { message, codexErrorInfo: info } = error;
+    if (info === "unauthorized")
+        return true;
+    if (info && typeof info === "object" &&
+        Object.values(info).some((variant) => variant?.httpStatusCode === 401))
+        return true;
+    return typeof message === "string" && CODEX_SIGN_IN_REFUSED.test(message);
+}
+export const CODEX_SIGN_IN_EXPIRED = "Codex's ChatGPT sign-in has expired. Sign in again in Settings → Model providers → Codex.";
+/** The plain sentence first, so a peer bot's one-line report keeps it;
+ * Codex's own words follow as the detail. */
+export function codexSignInExpired(raw) {
+    return `${CODEX_SIGN_IN_EXPIRED} Codex said: ${raw.slice(0, 300)}`;
+}
 class CodexRpcError extends Error {
     code;
     constructor(error) {
@@ -605,10 +630,47 @@ export const CodexDriver = {
         }
         else
             await refreshModels();
+        // Codex's own ChatGPT login (not ChatGPT plan, whose tokens OpenMausBot
+        // holds, nor Company routing) can be refused by OpenAI while `codex login
+        // status` still reports it. A refusal marks it the way a rejected API key
+        // is marked (key-rejections.ts): its credential home, plus the stored
+        // auth file, so a sign-in made anywhere else starts over. A later turn
+        // that succeeds, a new sign-in and sign-out clear it. Only a stored
+        // ChatGPT login is marked: an API-key login (`codex login --with-api-key`)
+        // cannot be fixed by the ChatGPT sign-in Settings offers.
+        const ownLogin = !plan && !config.managed;
+        const loginMark = () => {
+            const home = ownLogin ? codexHome(childEnv()) : null;
+            if (!home)
+                return null;
+            let stored = "";
+            try {
+                stored = readFileSync(join(home, "auth.json"), "utf8");
+            }
+            catch {
+                return null; /* keyring, or none */
+            }
+            try {
+                const auth = JSON.parse(stored);
+                const chatgpt = typeof auth.auth_mode === "string" ? /chatgpt/i.test(auth.auth_mode) : Boolean(auth.tokens);
+                if (!chatgpt)
+                    return null;
+            }
+            catch {
+                return null;
+            }
+            return [`codex-login:${home}`, stored];
+        };
+        const loginRefused = () => { const mark = loginMark(); if (mark)
+            noteKeyRejected(...mark); };
+        const loginAccepted = (mark = loginMark()) => { if (mark)
+            noteKeyAccepted(...mark); };
+        const loginRejected = () => { const mark = loginMark(); return mark !== null && keyRejected(...mark); };
         const authentication = new CodexDeviceAuthController({
             cli: config.cli,
             environment: childEnv,
-            onAuthenticated: refreshModels,
+            signInRejected: loginRejected,
+            onAuthenticated: async () => { loginAccepted(); await refreshModels(); },
         });
         const listeners = new Set();
         const active = new Map();
@@ -690,6 +752,12 @@ export const CodexDriver = {
             // a retry relaunches the whole app-server; the backoff is scaled down in
             // tests so a fake's transient failures don't stall real seconds
             const retryScale = Number(process.env.FAKE_CODEX_RETRY_SCALE ?? "1");
+            // Only a turn on the official provider says anything about Codex's
+            // ChatGPT login: a custom provider's 401 is its own key's, and its
+            // success proves nothing about ChatGPT. No model means the catalog's
+            // default, which is provider-qualified when config.toml picks another.
+            const chatgptTurn = ownLogin &&
+                decodeCodexSelection(turn.model || models.default).modelProvider === OFFICIAL_CODEX_PROVIDER;
             const launchAttempt = async (attempt) => {
                 const env = childEnv();
                 if (planToken)
@@ -784,6 +852,13 @@ export const CodexDriver = {
                 const state = {
                     settled: false,
                     lastError: "",
+                    // whether lastError went out marked setup (a sign-in to fix)
+                    lastErrorSetup: false,
+                    // an error Codex said it would retry itself (willRetry), kept only
+                    // to explain a turn that then fails without words of its own
+                    retryError: "",
+                    // Codex started recovering its model provider's sign-in this turn
+                    authRecovery: false,
                     lastText: "",
                     sawStreamDelta: false,
                     // codex reports token usage as a running total for this app-server
@@ -1122,6 +1197,25 @@ export const CodexDriver = {
                         message: `Codex automatic review ${outcome}${target}. Action did not run. Retry stays ${retryMode}. Select Ask for human approval in approval settings.`,
                     });
                 };
+                // The turn's failure, said once. An error notification and the
+                // turn/completed after it usually carry the same words; the second
+                // only speaks again to deliver a sign-in flag the first lacked.
+                // Codex's own refused sign-in reads as one plain sentence and marks
+                // the login, so Settings asks for a new sign-in too.
+                const turnError = (error) => {
+                    const raw = String(error.message);
+                    const refused = chatgptTurn && loginMark() !== null && (codexSignInRefused(error) ||
+                        (state.authRecovery && !/\b403\b|forbidden/i.test(raw) && /\b401\b|unauthorized/i.test(raw)));
+                    if (refused)
+                        loginRefused();
+                    const message = refused ? codexSignInExpired(raw) : codexUserError(raw, plan);
+                    const setup = refused || classifyError({ text: message }).reason === "auth";
+                    if (message === state.lastError && (state.lastErrorSetup || !setup))
+                        return;
+                    state.lastError = message;
+                    state.lastErrorSetup ||= setup;
+                    emit({ ...base(threadId, turnId), type: "runtime.error", message, ...(setup ? { setup: true } : {}) });
+                };
                 const handleNotification = (msg) => {
                     const p = msg.params ?? {};
                     // An app-server also emits notifications for native helper threads.
@@ -1322,27 +1416,43 @@ export const CodexDriver = {
                             if (reviewWarning && !timedOutReview)
                                 reviewNotice("warning");
                             const t = p.turn ?? {};
-                            const message = typeof t.error?.message === "string" ? codexUserError(t.error.message, plan) : "";
-                            if (t.status !== "completed" && message && message !== state.lastError) {
-                                state.lastError = message;
-                                emit({ ...base(threadId, turnId), type: "runtime.error", message,
-                                    ...(classifyError({ text: message }).reason === "auth" ? { setup: true } : {}),
-                                });
+                            if (t.status === "completed") {
+                                if (chatgptTurn)
+                                    loginAccepted();
+                            }
+                            else if (typeof t.error?.message === "string") {
+                                turnError(t.error);
+                            }
+                            else if (t.status === "failed" && !state.lastError && state.retryError) {
+                                // Codex gave up retrying without a final word: its last one
+                                turnError({ message: state.retryError });
                             }
                             void settle(t.status === "completed", t.status === "completed" ? null :
-                                (classifyError({ text: message || state.lastError }).reason === "provider_safety" ? "provider_safety" : (message || t.status || "failed")));
+                                (classifyError({ text: state.lastError }).reason === "provider_safety" ? "provider_safety" : (state.lastError || t.status || "failed")));
                             break;
                         }
-                        case "error":
-                            // shape drift: 0.144 sends {message}, 0.139 nests it under
-                            // {error:{message}} — surface either (agentcal armor)
-                            {
-                                const message = p.message ?? p.error?.message;
-                                if (message) {
-                                    state.lastError = codexUserError(String(message), plan);
-                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: state.lastError });
-                                }
+                        case "error": {
+                            // shape drift: 0.144 sends {message}, 0.139 and 0.160 nest it
+                            // under {error:{message, codexErrorInfo}} — surface either
+                            // (agentcal armor)
+                            const error = p.error && typeof p.error === "object" ? p.error : { message: p.message };
+                            if (!error.message)
+                                break;
+                            // 0.160 reports each of its own reconnects ("Reconnecting...
+                            // 1/5") with willRetry: true. Those are not the turn's failure;
+                            // the final error, or turn/completed, says how it ended.
+                            if (p.willRetry === true) {
+                                state.retryError = String(error.message);
+                                break;
                             }
+                            turnError(error);
+                            break;
+                        }
+                        case "modelProvider/authRecoveryStarted":
+                            state.authRecovery = true;
+                            break;
+                        case "modelProvider/authRecoveryCompleted":
+                            state.authRecovery = false;
                             break;
                     }
                 };
@@ -1732,8 +1842,10 @@ export const CodexDriver = {
                 }
                 catch (e) {
                     const failure = e instanceof Error ? e : { text: String(e) };
-                    const message = codexUserError(e instanceof Error ? e.message : String(e), plan);
-                    const needsAuth = /(?:\b401\b|unauthorized|missing bearer|authentication required)/i.test(message);
+                    const raw = e instanceof Error ? e.message : String(e);
+                    const refused = chatgptTurn && loginMark() !== null && codexSignInRefused({ message: raw });
+                    const message = refused ? codexSignInExpired(raw) : codexUserError(raw, plan);
+                    const needsAuth = refused || /(?:\b401\b|unauthorized|missing bearer|authentication required)/i.test(message);
                     const verdict = classifyError(failure);
                     // Three guards hold here: main's abandoned attempt never retries,
                     // neither does a Company session already recovered once from canonical
@@ -1767,6 +1879,8 @@ export const CodexDriver = {
                     // abandoned marks an attempt retired by a retry; its late rpc
                     // timeouts must neither report a spurious error nor relaunch again
                     if (!state.settled && !abandoned) {
+                        if (refused)
+                            loginRefused();
                         emit({
                             ...base(threadId, turnId),
                             type: "runtime.error",
@@ -1797,6 +1911,11 @@ export const CodexDriver = {
             const authenticated = await new Promise((resolve) => {
                 execCli(config.cli, ["login", "status"], { timeout: 8000, env }, (err, stdout, stderr) => resolve(!err && /^logged in\b/im.test(`${stdout}\n${stderr ?? ""}`)));
             });
+            // Signed in as far as the CLI knows, but OpenAI refused it on a real turn.
+            if (authenticated && loginRejected()) {
+                return { state: "available", version, authenticated: false, reason: CODEX_SIGN_IN_EXPIRED,
+                    update: await codexReleaseUpdate(version, config.cli), billing: "subscription" };
+            }
             // Display identity only, so Settings can say whose ChatGPT account the
             // bots run on; the status command above stays the authority on sign-in.
             const email = authenticated ? await codexAccountEmail(config.cli, env) : null;
@@ -1837,8 +1956,12 @@ export const CodexDriver = {
             },
             cancelAuthentication: () => (planAuth ?? authentication).cancel(),
             signOut: async () => {
-                if (!planAuth)
-                    return authentication.signOut();
+                if (!planAuth) {
+                    const mark = loginMark();
+                    await authentication.signOut();
+                    loginAccepted(mark);
+                    return;
+                }
                 planSigningOut = true;
                 planGeneration++;
                 try {

package/dist-server/server/drivers/device-auth.js

@@ -0,0 +1,343 @@
+import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+import { deviceSignInPrompt } from "../../shared/device-sign-in.js";
+import { killCliTree, spawnCli } from "../procs.js";
+const MAX_OUTPUT = 16_384;
+// Two configured instances can use the same on-disk login. Only the auth
+// operation is exclusive: normal turns are not blocked by this lock.
+const authenticatingHomes = new Set();
+/** The real path of a credential home, so two spellings of one home share
+ * one sign-in lock. A missing tail keeps its name under its real parent. */
+export function canonicalPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        const parent = dirname(path);
+        return parent === path ? path : join(canonicalPath(parent), basename(path));
+    }
+}
+/** A fixed login command, not a remotely accessible terminal. CLI output
+ * stays in bounded private memory; only a device page and code are exposed. */
+export class DeviceAuthController {
+    flow = null;
+    command = null;
+    disposed = false;
+    spec;
+    options;
+    constructor(spec, options) {
+        this.spec = spec;
+        this.options = options;
+    }
+    /** The credential home the lock is held on, for this environment. */
+    home(env, action) {
+        const { homeEnv, homeDir, product } = this.spec;
+        const home = env.HOME || env.USERPROFILE || homedir();
+        const named = env[homeEnv];
+        if (!isAbsolute(home) || (named && !isAbsolute(named))) {
+            throw new Error(`Use an absolute HOME and ${homeEnv} path for this server's ${product} provider before ${action}.`);
+        }
+        return { home, homeKey: canonicalPath(resolve(named || join(home, homeDir))) };
+    }
+    async start() {
+        const { product, account, status } = this.spec;
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing in.");
+        if (this.flow?.status.phase === "waiting") {
+            if (this.flow.ready)
+                return { ...this.flow.status, phase: "waiting" };
+            throw new Error(`A ${account} sign-in is already starting. Please wait for the code.`);
+        }
+        await this.flow?.stopping;
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing in.");
+        const env = this.options.environment();
+        const { home, homeKey } = this.home(env, "signing in");
+        if (authenticatingHomes.has(homeKey)) {
+            throw new Error(`A ${account} sign-in is already running for this server account. Finish or cancel it before starting another.`);
+        }
+        authenticatingHomes.add(homeKey);
+        return new Promise((resolveStart, reject) => {
+            const flow = {
+                status: {
+                    phase: "waiting", flowId: randomUUID(), authorizationUrl: null,
+                    expiresAt: new Date(Date.now() + (this.options.lifetimeMs ?? 15 * 60_000)).toISOString(),
+                },
+                child: null, ready: false, resolve: resolveStart, reject, homeKey,
+                startupTimer: setTimeout(() => this.finish(flow, "failed", `${product} did not provide a sign-in code in time. Check the server connection and update ${product}, then try again.`), this.options.startupTimeoutMs ?? 30_000),
+                expiryTimer: setTimeout(() => this.finish(flow, "expired", `The ${account} sign-in code expired. Start sign-in again.`), this.options.lifetimeMs ?? 15 * 60_000),
+            };
+            flow.startupTimer.unref();
+            flow.expiryTimer.unref();
+            this.flow = flow;
+            const login = () => this.run(flow, [...this.spec.loginArgs], env, home, (loginCode, loginOutput) => {
+                if (loginCode !== 0 || !flow.ready) {
+                    this.finish(flow, "failed", this.spec.failure(loginOutput));
+                    return;
+                }
+                // A successful command is not enough: confirm the sign-in the way
+                // this client's bots will find it, with the same executable and
+                // environment.
+                flow.startupTimer = setTimeout(() => this.finish(flow, "failed", `${product} finished sign-in but could not confirm the account. Refresh Settings and try again.`), this.options.startupTimeoutMs ?? 30_000);
+                flow.startupTimer.unref();
+                this.confirm(flow, env, home, (signedIn) => this.finish(flow, signedIn ? "succeeded" : "failed", `${product} finished sign-in but did not confirm a ${account} account. Refresh Settings and try again.`));
+            }, true);
+            // Never overwrite a working login just because Connect was clicked
+            // twice. One the provider refused is not working, whatever status says.
+            if (!status) {
+                login();
+                return;
+            }
+            this.run(flow, [...status.args], env, home, (code, output) => {
+                const state = status.read(code, output);
+                if (state === "signed-in" && !this.options.signInRejected?.())
+                    this.finish(flow, "succeeded");
+                else if (state === "signed-in" || state === "signed-out")
+                    login();
+                else if (state === "other")
+                    this.finish(flow, "failed", `${product} already has a different sign-in method on this server. Ask the server administrator to review it before changing accounts.`);
+                else
+                    this.finish(flow, "failed", `${product} could not confirm the existing sign-in on this server. Update ${product} and check its login status before trying again.`);
+            });
+        });
+    }
+    async get(flowId) {
+        if (!flowId || this.flow?.status.flowId !== flowId)
+            throw new Error("This sign-in is no longer available. Start sign-in again.");
+        return { ...this.flow.status };
+    }
+    async cancel() {
+        if (this.flow?.status.phase === "waiting")
+            this.finish(this.flow, "cancelled", `${this.spec.account} sign-in cancelled.`);
+        await this.flow?.stopping;
+        if (this.flow?.terminationFailed)
+            throw new Error(this.flow.status.message);
+        if (this.command && !await this.stopChild(this.command)) {
+            throw new Error(`${this.spec.product} could not be stopped on this server. Ask the server administrator to stop the account command before trying again.`);
+        }
+    }
+    async dispose() {
+        this.disposed = true;
+        await this.cancel();
+        this.flow = null;
+    }
+    /** Remove the sign-in the CLI stores for this server account so a
+     * different account can connect. A sign-in in progress is never pulled
+     * away underneath the browser completing it. */
+    async signOut() {
+        const { product, account, status, logoutArgs } = this.spec;
+        if (!status || !logoutArgs)
+            throw new Error(`Signing out of ${account} is not available from here.`);
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing out.");
+        if (this.flow?.status.phase === "waiting")
+            throw new Error(`Finish or cancel the ${account} sign-in in progress before signing out.`);
+        await this.flow?.stopping;
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing out.");
+        const env = this.options.environment();
+        const { home, homeKey } = this.home(env, "signing out");
+        if (authenticatingHomes.has(homeKey)) {
+            throw new Error(`A ${account} sign-in is running for this server account. Finish or cancel it before signing out.`);
+        }
+        authenticatingHomes.add(homeKey);
+        try {
+            const before = await this.exec([...status.args], env, home);
+            const state = status.read(before.code, before.output);
+            if (state === "signed-out")
+                return;
+            if (state !== "signed-in") {
+                throw new Error(`${product} did not confirm a ${account} sign-in. Other authentication methods will not be removed; ask the server administrator to check the account.`);
+            }
+            const logout = await this.exec([...logoutArgs], env, home);
+            if (logout.code !== 0)
+                throw new Error(`${product} could not remove the sign-in on this server. Check the server's ${product} installation and try again.`);
+            // The command's own report is not enough: confirm with the same status
+            // check that decides whether bots may run on this account.
+            const after = await this.exec([...status.args], env, home);
+            if (status.read(after.code, after.output) !== "signed-out") {
+                throw new Error(`${product} still reports a sign-in on this server. Update ${product} and check its login status before trying again.`);
+            }
+        }
+        finally {
+            // If the OS cannot stop a command, it may still change credentials.
+            // Keep the home reserved until that exact child actually exits.
+            const child = this.command;
+            if (child && child.exitCode === null && child.signalCode === null) {
+                child.once("close", () => authenticatingHomes.delete(homeKey));
+            }
+            else
+                authenticatingHomes.delete(homeKey);
+        }
+    }
+    /** After a login command succeeded: the status command when the CLI has
+     * one, else the stored sign-in a turn checks for. */
+    confirm(flow, env, home, done) {
+        const status = this.spec.status;
+        if (status) {
+            this.run(flow, [...status.args], env, home, (code, output) => done(status.read(code, output) === "signed-in"));
+            return;
+        }
+        let signedIn = false;
+        try {
+            signedIn = this.spec.signedIn?.(env) === true;
+        }
+        catch { /* unreadable: not signed in */ }
+        done(signedIn);
+    }
+    startFailure(error) {
+        const { product, install } = this.spec;
+        return error.code === "ENOENT"
+            ? `${product} is not installed on this server. ${install}`
+            : `${product} could not start on this server. Check the configured CLI path and its executable permissions.`;
+    }
+    /** One bounded, non-interactive command. Its output stays here; callers
+     * see an exit code and a status-line match, never the text. */
+    exec(args, env, cwd) {
+        const { product } = this.spec;
+        return new Promise((resolveExec, rejectExec) => {
+            if (this.disposed) {
+                rejectExec(new Error("This provider was removed. Refresh Settings before signing out."));
+                return;
+            }
+            let child;
+            try {
+                child = spawnCli(this.options.cli, args, { env: { ...env, NO_COLOR: "1" }, cwd, stdio: ["pipe", "pipe", "pipe"] });
+            }
+            catch {
+                rejectExec(new Error(`${product} could not start on this server. Install or update the configured ${product} CLI, then try again.`));
+                return;
+            }
+            this.command = child;
+            child.stdin.end();
+            let output = "";
+            const receive = (chunk) => {
+                if (output.length < MAX_OUTPUT)
+                    output += chunk.toString("utf8").slice(0, MAX_OUTPUT - output.length);
+            };
+            child.stdout.on("data", receive);
+            child.stderr.on("data", receive);
+            // A hung CLI must not hold the credential-home lock forever.
+            const timer = setTimeout(() => {
+                void this.stopChild(child).catch(() => false).then((stopped) => {
+                    if (!stopped)
+                        rejectExec(new Error(`${product} could not be stopped on this server. Ask the server administrator to stop the account command before trying again.`));
+                });
+            }, this.options.startupTimeoutMs ?? 30_000);
+            timer.unref();
+            child.once("error", (error) => {
+                clearTimeout(timer);
+                rejectExec(new Error(this.startFailure(error)));
+            });
+            child.once("close", (code) => {
+                clearTimeout(timer);
+                if (this.command === child)
+                    this.command = null;
+                resolveExec({ code, output: stripVTControlCharacters(output) });
+            });
+        });
+    }
+    run(flow, args, env, cwd, done, parsePrompt = false) {
+        const { product, provider } = this.spec;
+        if (flow.status.phase !== "waiting")
+            return;
+        let child;
+        try {
+            child = spawnCli(this.options.cli, args, { env: { ...env, NO_COLOR: "1" }, cwd, stdio: ["pipe", "pipe", "pipe"] });
+        }
+        catch {
+            this.finish(flow, "failed", `${product} could not start on this server. Install or update the configured ${product} CLI, then try again.`);
+            return;
+        }
+        flow.child = child;
+        child.stdin.end();
+        let output = "";
+        const receive = (chunk) => {
+            if (flow.status.phase !== "waiting")
+                return;
+            if (output.length + chunk.length > MAX_OUTPUT) {
+                this.finish(flow, "failed", `${product} returned an unexpected sign-in response. Update the server's ${product} CLI and try again.`);
+                return;
+            }
+            output += chunk.toString("utf8");
+            const prompt = parsePrompt && !flow.ready ? deviceSignInPrompt(provider, stripVTControlCharacters(output)) : null;
+            if (prompt) {
+                flow.status = { ...flow.status, ...prompt };
+                flow.ready = true;
+                clearTimeout(flow.startupTimer);
+                flow.resolve({ ...flow.status, phase: "waiting" });
+            }
+        };
+        child.stdout.on("data", receive);
+        child.stderr.on("data", receive);
+        child.once("error", (error) => this.finish(flow, "failed", this.startFailure(error)));
+        child.once("close", (code) => {
+            if (flow.child === child)
+                flow.child = null;
+            if (flow.status.phase === "waiting")
+                done(code, stripVTControlCharacters(output));
+            output = "";
+        });
+    }
+    finish(flow, phase, message) {
+        const { product, account } = this.spec;
+        if (flow.status.phase !== "waiting")
+            return;
+        clearTimeout(flow.startupTimer);
+        clearTimeout(flow.expiryTimer);
+        flow.status = {
+            phase, flowId: flow.status.flowId, authorizationUrl: null, expiresAt: null,
+            ...(phase !== "succeeded" && message ? { message } : {}),
+        };
+        if (!flow.ready) {
+            if (phase === "succeeded")
+                flow.resolve({ ...flow.status, phase });
+            else
+                flow.reject(new Error(message ?? `${account} sign-in did not finish.`));
+        }
+        flow.stopping = this.stopChild(flow.child).catch(() => false).then((stopped) => {
+            const release = () => authenticatingHomes.delete(flow.homeKey);
+            if (stopped) {
+                release();
+                return;
+            }
+            flow.terminationFailed = true;
+            flow.status = { ...flow.status, phase: "failed", message: `${product} could not be stopped on this server. Ask the server administrator to stop the login process before trying again.` };
+            // Retain the credential-home lock until the OS actually reports exit.
+            const child = flow.child;
+            if (!child || child.exitCode !== null || child.signalCode !== null)
+                release();
+            else
+                child.once("close", release);
+        });
+        if (phase === "succeeded")
+            void this.options.onAuthenticated?.().catch(() => { });
+    }
+    async stopChild(child) {
+        if (!child || await killCliTree(child, this.options.terminateTimeoutMs ?? 1500))
+            return true;
+        // A broken CLI may ignore SIGTERM. Do not leave a stale device flow able
+        // to write credentials after the user cancelled it.
+        if (process.platform !== "win32" && child.pid) {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        }
+        else
+            child.kill("SIGKILL");
+        await new Promise((resolveStop) => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return resolveStop();
+            const timer = setTimeout(resolveStop, 1500);
+            timer.unref();
+            child.once("close", () => { clearTimeout(timer); resolveStop(); });
+        });
+        return child.exitCode !== null || child.signalCode !== null;
+    }
+}