relmio 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -7,6 +7,25 @@ checks the registry separately after publication.
 
 ## Unreleased
 
+## [0.4.1] - 2026-08-14
+
+### Changed
+
+- Add a manual **Stop sign-in** action while a fresh ChatGPT login is pending,
+  then detect and reject results from superseded wizard attempts.
+
+### Fixed
+
+- Terminate the OAuth helper process tree when sign-in is stopped or Relmio
+  exits, preventing a rejected or abandoned attempt from continuing to hold
+  the `localhost:1455` callback port.
+
+### Security
+
+- Fail closed when OAuth process cleanup or credential promotion cannot be
+  confirmed, blocking another login until Relmio restarts instead of risking
+  an ambiguous helper or credential state.
+
 ## [0.4.0] - 2026-08-13
 
 ### Added

package/README.md

@@ -78,6 +78,11 @@ the private VPS/n8n sidecar and the separate local Docker endpoint paths.
 > OAuth extension captures that callback, temporarily disable it during local sign-in,
 > complete the wizard sign-in, and then re-enable it.
 
+While a fresh local login is pending, **Stop sign-in** terminates the helper
+Relmio started before allowing another attempt. Results from older tabs are
+rejected after a replacement starts. If cleanup cannot be confirmed, retry
+remains disabled; close the wizard and OAuth helper, then restart Relmio.
+
 <figure>
   <img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/examples/hosted-chat-connected.png" alt="Relmio hosted chat showing a connected ChatGPT session and a ready prompt field" width="720">
   <figcaption>Successful hosted-chat state: the browser extension completed the OAuth handoff and Relmio shows the ChatGPT session as connected.</figcaption>

package/docs/troubleshooting.md

@@ -146,7 +146,7 @@ bypassed.
 | `ChatGPT sign-in did not finish` appears immediately when refreshing an existing credential | Wizard versions through `0.1.3` attempted to reuse `~/.codex/auth.json`, but the bridge CLI requires an interactive terminal before replacing that file. | Update to `0.1.4` or newer. The wizard signs in through its own new credential file and leaves the Codex app credential untouched. |
 | The wizard keeps showing `Waiting for browser sign-in` after approval | Older versions waited for the OAuth helper process to close even after its credential file was ready. | Update to `0.1.5` or newer. Confirm the new **Credential updated** time appears before continuing. |
 | **Credential updated** still shows the old time | The callback reached an old/expired tab, was intercepted, or a different wizard session is open. | Close every old OAuth and wizard tab. Keep one current wizard open, select **Refresh ChatGPT sign-in**, and complete only the newly opened page. |
-| The fresh login cannot bind `localhost:1455` or reports the address is in use | Another OAuth helper or extension process already owns the local callback port. | Close other OAuth login tools and stale wizard processes, then retry. On macOS/Linux, inspect without killing anything using `lsof -nP -iTCP:1455 -sTCP:LISTEN`. |
+| The fresh login cannot bind `localhost:1455` or reports the address is in use | Another OAuth helper or extension process already owns the local callback port. | In the active wizard, use **Stop sign-in** before starting another attempt. If retry remains disabled because cleanup could not be confirmed, close the wizard and OAuth helper, confirm the port is free, and restart Relmio. On macOS/Linux, inspect without killing anything using `lsof -nP -iTCP:1455 -sTCP:LISTEN`. |
 | `SSH connection failed. Check the address, password, firewall, and confirmed fingerprint.` | The TCP connection, password authentication, or confirmed host identity did not succeed. | Copy the full address and port from the provider, confirm root password login is enabled, check the provider firewall, rescan and compare the fingerprint, then test `ssh -p 22 root@YOUR_VPS_IP` from the same computer. |
 | The VPS accepts only an SSH key or passkey | The current wizard supports live password authentication, not SSH keys. | Use the manual installation path or a provider-approved password-authenticated administrator account. Do not weaken SSH security or upload a private key into the wizard. |
 | The SSH fingerprint changed | The server was rebuilt, its host keys changed, or the connection may be reaching a different host. | Stop. Verify the address and the new fingerprint through the VPS provider console before confirming it. Never bypass the comparison. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Install private local OpenAI API and Codex endpoints with explicit provider credential boundaries, plus the existing isolated n8n sidecar.",
   "keywords": [
     "relmio",

package/src/services/oauth.js

@@ -10,6 +10,10 @@ const LOGIN_URL_TIMEOUT_MS = 15_000;
 const LOGIN_TIMEOUT_MS = 300_000;
 const PROCESS_TIMEOUT_MS = LOGIN_TIMEOUT_MS + 15_000;
 const CREDENTIAL_POLL_INTERVAL_MS = 100;
+const PROCESS_TERMINATION_GRACE_MS = 1_000;
+const PROCESS_TERMINATION_FORCE_WAIT_MS = 1_000;
+const TERMINATION_UNCONFIRMED_MESSAGE =
+  "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.";
 const LOGIN_URL_PREFIX = "OpenAI OAuth login URL: ";
 const OPENAI_AUTH_ORIGIN = "https://auth.openai.com";
 const SUPPORTED_LOOPBACK_REDIRECT_HOSTNAMES = new Set([
@@ -206,6 +210,11 @@ export async function startOAuthLogin({
   spawnProcess = spawn,
   createPendingId = randomUUID,
   waitForCredentialPoll = wait,
+  killProcess = process.kill,
+  terminationGraceMs = PROCESS_TERMINATION_GRACE_MS,
+  terminationForceWaitMs = PROCESS_TERMINATION_FORCE_WAIT_MS,
+  createTimer = setTimeout,
+  clearTimer = clearTimeout,
 } = {}) {
   const npxInvocation = createNpxInvocation({ platform, env, execPath });
   const authPath = resolveAuthPath({ env, homeDirectory });
@@ -241,6 +250,7 @@ export async function startOAuthLogin({
         shell: false,
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
+        ...(platform === "win32" ? {} : { detached: true }),
       },
     );
   } catch (error) {
@@ -251,6 +261,7 @@ export async function startOAuthLogin({
   }
   const loginOutput = { stdout: "", stderr: "" };
   let loginOutputBytes = 0;
+  let cancelAttempt = () => Promise.resolve();
   let resolveAuthorizationUrl;
   let rejectAuthorizationUrl;
   let authorizationUrlSettled = false;
@@ -280,7 +291,9 @@ export async function startOAuthLogin({
       settleAuthorizationUrl(
         new Error("The sign-in command returned too much output."),
       );
-      child.kill?.("SIGTERM");
+      void requestCancellation("The sign-in command returned too much output.").catch(
+        () => {},
+      );
       return;
     }
     loginOutput[stream] += output;
@@ -291,7 +304,7 @@ export async function startOAuthLogin({
       }
     } catch (error) {
       settleAuthorizationUrl(error);
-      child.kill?.("SIGTERM");
+      void requestCancellation(error.message).catch(() => {});
     }
   };
 
@@ -346,24 +359,273 @@ export async function startOAuthLogin({
     settleProcessClose(null, code);
   });
 
-  const loginUrlTimeout = setTimeout(() => {
-    settleAuthorizationUrl(
-      new Error("The sign-in command did not provide a fresh login link."),
+  const loginUrlTimeout = createTimer(() => {
+    const error = new Error(
+      "The sign-in command did not provide a fresh login link.",
     );
-    child.kill?.("SIGTERM");
+    settleAuthorizationUrl(error);
+    void requestCancellation(error.message).catch(() => {});
   }, LOGIN_URL_TIMEOUT_MS);
 
-  const savePendingCredential = async () => {
-    await readAuthContents({
-      authPath: pendingAuthPath,
-      fileSystem,
+  let keepPollingForCredential = true;
+  let cancellationRequested = false;
+  let rejectCancellation;
+  const cancellationPromise = new Promise((_, rejectPromise) => {
+    rejectCancellation = rejectPromise;
+  });
+  cancellationPromise.catch(() => {});
+
+  const promotionAuthPath = `${pendingAuthPath}.ready`;
+  let credentialPromotion;
+  let promotionPhase = "idle";
+  const promotionCancellationWaitMs =
+    terminationGraceMs + terminationForceWaitMs;
+  const createRetryBlockedError = () =>
+    Object.assign(new Error(TERMINATION_UNCONFIRMED_MESSAGE), {
+      retryBlocked: true,
     });
-    await fileSystem.chmod(pendingAuthPath, 0o600);
-    await fileSystem.copyFile(pendingAuthPath, authPath);
-    await fileSystem.chmod(authPath, 0o600);
+  const assertPromotionActive = () => {
+    if (cancellationRequested) {
+      throw new Error("ChatGPT sign-in did not finish. Start a fresh login.");
+    }
+  };
+  const savePendingCredential = () => {
+    if (credentialPromotion) {
+      return credentialPromotion;
+    }
+
+    credentialPromotion = (async () => {
+      promotionPhase = "staging";
+      try {
+        assertPromotionActive();
+        await readAuthContents({
+          authPath: pendingAuthPath,
+          fileSystem,
+        });
+        assertPromotionActive();
+        await fileSystem.chmod(pendingAuthPath, 0o600);
+        assertPromotionActive();
+        await fileSystem.copyFile(pendingAuthPath, promotionAuthPath);
+        assertPromotionActive();
+        await fileSystem.chmod(promotionAuthPath, 0o600);
+        assertPromotionActive();
+        promotionPhase = "committing";
+        await fileSystem.rename(promotionAuthPath, authPath);
+        promotionPhase = "committed";
+        await fileSystem.chmod(authPath, 0o600);
+      } catch (error) {
+        if (cancellationRequested && promotionPhase !== "committed") {
+          promotionPhase = "cancelled";
+        }
+        throw error;
+      }
+    })();
+    credentialPromotion.catch(() => {});
+    return credentialPromotion;
+  };
+
+  const waitForBoundedResult = (promise, milliseconds) =>
+    new Promise((resolvePromise) => {
+      let settled = false;
+      const timer = createTimer(() => {
+        if (!settled) {
+          settled = true;
+          resolvePromise(false);
+        }
+      }, milliseconds);
+      promise.then(
+        () => {
+          if (!settled) {
+            settled = true;
+            clearTimer(timer);
+            resolvePromise(true);
+          }
+        },
+        () => {
+          if (!settled) {
+            settled = true;
+            clearTimer(timer);
+            resolvePromise(true);
+          }
+        },
+      );
+    });
+
+  const waitForDuration = (milliseconds) =>
+    new Promise((resolvePromise) => {
+      createTimer(() => resolvePromise(true), milliseconds);
+    });
+
+  const waitForTaskkill = (taskkill, milliseconds) =>
+    new Promise((resolvePromise) => {
+      let settled = false;
+      const finish = (confirmed) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimer(timer);
+        resolvePromise(confirmed);
+      };
+      const timer = createTimer(() => finish(false), milliseconds);
+      taskkill?.once?.("error", () => finish(false));
+      taskkill?.once?.("close", (code) => finish(code === 0));
+      if (!taskkill?.once) {
+        finish(false);
+      }
+    });
+
+  let terminationPromise;
+  const terminateProcessTree = () => {
+    if (terminationPromise) {
+      return terminationPromise;
+    }
+
+    terminationPromise = (async () => {
+      const hasChildPid = Number.isSafeInteger(child.pid) && child.pid > 0;
+
+      if (platform === "win32" && hasChildPid) {
+        const runTaskkill = async (force, timeout) => {
+          try {
+            const taskkill = spawnProcess(
+              "taskkill",
+              ["/pid", String(child.pid), "/t", ...(force ? ["/f"] : [])],
+              {
+                shell: false,
+                stdio: "ignore",
+                windowsHide: true,
+              },
+            );
+            return await waitForTaskkill(taskkill, timeout);
+          } catch {
+            return false;
+          }
+        };
+        if (
+          (await runTaskkill(false, terminationGraceMs)) ||
+          (await runTaskkill(true, terminationForceWaitMs))
+        ) {
+          return;
+        }
+      } else if (hasChildPid) {
+        const processGroupIsGone = () => {
+          try {
+            killProcess(-child.pid, 0);
+            return false;
+          } catch (error) {
+            return error?.code === "ESRCH";
+          }
+        };
+        try {
+          killProcess(-child.pid, "SIGTERM");
+        } catch {
+          // The group may have already exited between launch and cancellation.
+        }
+        if (
+          processGroupIsGone() ||
+          ((await waitForDuration(terminationGraceMs)) && processGroupIsGone())
+        ) {
+          return;
+        }
+        try {
+          killProcess(-child.pid, "SIGKILL");
+        } catch {
+          // A final process-group check below determines whether it is gone.
+        }
+        if (
+          processGroupIsGone() ||
+          ((await waitForDuration(terminationForceWaitMs)) &&
+            processGroupIsGone())
+        ) {
+          return;
+        }
+      } else {
+        try {
+          child.kill?.("SIGTERM");
+        } catch {
+          // The process may have already exited before cancellation.
+        }
+        if (
+          processCloseSettled ||
+          (await waitForBoundedResult(
+            processClosePromise,
+            terminationGraceMs,
+          ))
+        ) {
+          return;
+        }
+        try {
+          child.kill?.("SIGKILL");
+        } catch {
+          // The direct child is only a last resort when no PID is available.
+        }
+        if (
+          processCloseSettled ||
+          (await waitForBoundedResult(
+            processClosePromise,
+            terminationForceWaitMs,
+          ))
+        ) {
+          return;
+        }
+      }
+
+      throw createRetryBlockedError();
+    })();
+    return terminationPromise;
+  };
+
+  cancelAttempt = async (
+    message = "ChatGPT sign-in stopped. Start a fresh login.",
+  ) => {
+    if (!cancellationRequested) {
+      cancellationRequested = true;
+      keepPollingForCredential = false;
+      rejectCancellation(new Error(message));
+    }
+    let promotionError;
+    try {
+      if (
+        credentialPromotion &&
+        !(await waitForBoundedResult(
+          credentialPromotion,
+          promotionCancellationWaitMs,
+        ))
+      ) {
+        promotionError = createRetryBlockedError();
+      }
+    } catch {
+      // Cancellation intentionally abandons a staged but unpromoted credential.
+    }
+    if (
+      promotionPhase === "committing" ||
+      promotionPhase === "committed"
+    ) {
+      promotionError = createRetryBlockedError();
+    }
+    let terminationError;
+    try {
+      await terminateProcessTree();
+    } catch (error) {
+      terminationError = error;
+    }
+    if (promotionError) {
+      throw promotionError;
+    }
+    if (terminationError) {
+      throw terminationError;
+    }
+  };
+
+  let cancellationResult;
+  const requestCancellation = (message) => {
+    if (!cancellationResult) {
+      cancellationResult = cancelAttempt(message);
+      cancellationResult.catch(() => {});
+    }
+    return cancellationResult;
   };
 
-  let keepPollingForCredential = true;
   const pendingCredentialPromise = (async () => {
     await authorizationUrlPromise;
     while (keepPollingForCredential) {
@@ -384,8 +646,9 @@ export async function startOAuthLogin({
 
   const completion = (async () => {
     let processTimeout;
+    let completedSuccessfully = false;
     try {
-      return await Promise.race([
+      const result = await Promise.race([
         pendingCredentialPromise,
         processClosePromise.then(async (code) => {
           if (code !== 0) {
@@ -396,27 +659,51 @@ export async function startOAuthLogin({
           await savePendingCredential();
           return { success: true };
         }),
+        cancellationPromise,
         new Promise((_, rejectPromise) => {
-          processTimeout = setTimeout(() => {
-            child.kill?.("SIGTERM");
-            rejectPromise(
-              new Error("The sign-in request expired. Start a fresh login."),
+          processTimeout = createTimer(() => {
+            const error = new Error(
+              "The sign-in request expired. Start a fresh login.",
             );
+            void requestCancellation(error.message).catch(() => {});
+            rejectPromise(error);
           }, PROCESS_TIMEOUT_MS);
         }),
       ]);
+      completedSuccessfully = result.success === true;
+      return result;
     } finally {
       keepPollingForCredential = false;
-      clearTimeout(processTimeout);
-      clearTimeout(loginUrlTimeout);
-      if (!processCloseSettled) {
-        child.kill?.("SIGTERM");
+      clearTimer(processTimeout);
+      clearTimer(loginUrlTimeout);
+      try {
+        await credentialPromotion;
+      } catch {
+        // A cancellation can abandon an attempt-local staged credential.
+      }
+      if (cancellationResult) {
+        try {
+          await cancellationResult;
+        } catch (error) {
+          if (error?.retryBlocked === true) {
+            throw error;
+          }
+        }
+      }
+      const committedBeforeFailure =
+        !completedSuccessfully && promotionPhase === "committed";
+      if (!completedSuccessfully || !processCloseSettled) {
+        await terminateProcessTree();
       }
       try {
         await fileSystem.rm(pendingAuthPath, { force: true });
+        await fileSystem.rm(promotionAuthPath, { force: true });
       } catch {
         // A failed cleanup must not hide the actionable sign-in result.
       }
+      if (committedBeforeFailure) {
+        throw createRetryBlockedError();
+      }
     }
   })();
   completion.catch(() => {});
@@ -435,22 +722,30 @@ export async function startOAuthLogin({
         },
       ),
     ]);
-    clearTimeout(loginUrlTimeout);
+    clearTimer(loginUrlTimeout);
     return {
       authorizationUrl,
       completion,
       cancel() {
-        child.kill?.("SIGTERM");
+        return requestCancellation();
       },
     };
   } catch (error) {
-    clearTimeout(loginUrlTimeout);
-    child.kill?.("SIGTERM");
+    clearTimer(loginUrlTimeout);
+    let retryBlocked = false;
     try {
-      await completion;
+      await requestCancellation(error.message);
+    } catch {
+      retryBlocked = true;
+    }
+    try {
+      await waitForBoundedResult(completion, promotionCancellationWaitMs);
     } catch {
       // Preserve the more specific authorization-link error.
     }
+    if (retryBlocked) {
+      error.retryBlocked = true;
+    }
     throw error;
   }
 }

package/src/ui/app.js

@@ -10,6 +10,10 @@ const state = {
   discovery: null,
   networks: null,
   installAttempted: false,
+  oauthAttemptId: null,
+  oauthRetryBlocked: false,
+  oauthLoginGeneration: 0,
+  oauthLoginWindow: null,
 };
 
 const element = (id) => document.getElementById(id);
@@ -245,16 +249,63 @@ function validateAuthorizationUrl(value) {
   return url.toString();
 }
 
-async function waitForOAuthCompletion() {
+function validateOAuthAttemptId(value) {
+  if (typeof value !== "string" || !/^[0-9a-f-]{8,128}$/iu.test(value)) {
+    throw new Error(
+      "The wizard returned an unexpected sign-in attempt. Start again.",
+    );
+  }
+  return value;
+}
+
+function setOAuthStopControlVisible(visible) {
+  const stopButton = element("stop-login-button");
+  stopButton.hidden = !visible;
+  stopButton.disabled = !visible;
+  stopButton.setAttribute("aria-busy", "false");
+}
+
+function blockOAuthRetry() {
+  state.oauthRetryBlocked = true;
+  state.oauthAttemptId = null;
+  state.oauthLoginWindow?.close?.();
+  state.oauthLoginWindow = null;
+  element("login-link").hidden = true;
+  element("login-link").removeAttribute("href");
+  setOAuthStopControlVisible(false);
+  const loginButton = element("login-button");
+  setBusy(loginButton, false);
+  loginButton.disabled = true;
+}
+
+async function waitForOAuthCompletion(expectedAttemptId) {
   for (let attempt = 0; attempt < 330; attempt += 1) {
     const result = await api("/api/oauth/status");
+    if (result.retryBlocked === true) {
+      const error = new Error(
+        result.error ??
+          "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.",
+      );
+      error.oauthRetryBlocked = true;
+      throw error;
+    }
+    if (result.attemptId !== expectedAttemptId) {
+      throw new Error(
+        "The ChatGPT sign-in was replaced by a newer attempt. Start again.",
+      );
+    }
     if (result.status === "success") {
       return;
     }
     if (result.status === "error") {
-      throw new Error(
+      const error = new Error(
         result.error ?? "ChatGPT sign-in did not finish. Start again.",
       );
+      error.oauthRetryBlocked = result.retryBlocked === true;
+      throw error;
+    }
+    if (result.status === "cancelled") {
+      throw new Error("ChatGPT sign-in was stopped. Start again.");
     }
     await delay(attempt < 40 ? 250 : 1_000);
   }
@@ -324,7 +375,9 @@ async function api(path, { method = "GET", body } = {}) {
     );
   }
   if (!response.ok) {
-    throw new Error(result.error ?? "The request failed.");
+    const error = new Error(result.error ?? "The request failed.");
+    error.oauthRetryBlocked = result.retryBlocked === true;
+    throw error;
   }
   return result;
 }
@@ -450,13 +503,21 @@ async function discover() {
 
 element("login-button").addEventListener("click", async (event) => {
   const button = event.currentTarget;
+  if (state.oauthRetryBlocked) {
+    return;
+  }
   const loginLink = element("login-link");
+  const loginGeneration = state.oauthLoginGeneration + 1;
+  state.oauthLoginGeneration = loginGeneration;
+  state.oauthAttemptId = null;
   const loginWindow = window.open("about:blank", "_blank");
+  state.oauthLoginWindow = loginWindow;
   let loginWindowNavigated = false;
   prepareOAuthPopup(loginWindow);
   clearError();
   loginLink.hidden = true;
   loginLink.removeAttribute("href");
+  setOAuthStopControlVisible(false);
   setBusy(button, true, "Waiting for browser sign-in…");
   setMessage(
     "Preparing a fresh ChatGPT sign-in. The existing local credential will be replaced only after sign-in succeeds.",
@@ -467,6 +528,12 @@ element("login-button").addEventListener("click", async (event) => {
       body: {},
     });
     const authorizationUrl = validateAuthorizationUrl(result.authorizationUrl);
+    const attemptId = validateOAuthAttemptId(result.attemptId);
+    if (state.oauthLoginGeneration !== loginGeneration) {
+      return;
+    }
+    state.oauthAttemptId = attemptId;
+    setOAuthStopControlVisible(true);
     loginLink.href = authorizationUrl;
     loginLink.hidden = false;
     if (loginWindow) {
@@ -477,7 +544,10 @@ element("login-button").addEventListener("click", async (event) => {
     setMessage(
       "Complete the newly opened sign-in within five minutes. If no tab opened, use “Open fresh ChatGPT sign-in” below. If an OpenAI OAuth browser extension intercepts the callback, disable it temporarily and start again.",
     );
-    await waitForOAuthCompletion();
+    await waitForOAuthCompletion(attemptId);
+    if (state.oauthLoginGeneration !== loginGeneration) {
+      return;
+    }
     loginLink.hidden = true;
     loginLink.removeAttribute("href");
     await refreshAuthStatus({ fresh: true });
@@ -485,9 +555,66 @@ element("login-button").addEventListener("click", async (event) => {
     if (loginWindow && !loginWindowNavigated) {
       loginWindow.close();
     }
-    showError(error);
+    if (state.oauthLoginGeneration === loginGeneration) {
+      if (error.oauthRetryBlocked === true) {
+        blockOAuthRetry();
+      }
+      showError(error);
+    }
   } finally {
-    setBusy(button, false);
+    if (state.oauthLoginGeneration === loginGeneration) {
+      state.oauthAttemptId = null;
+      state.oauthLoginWindow = null;
+      setOAuthStopControlVisible(false);
+      setBusy(button, false);
+      if (state.oauthRetryBlocked) {
+        button.disabled = true;
+      }
+    }
+  }
+});
+
+element("stop-login-button").addEventListener("click", async (event) => {
+  const stopButton = event.currentTarget;
+  const attemptId = state.oauthAttemptId;
+  const loginGeneration = state.oauthLoginGeneration;
+  if (typeof attemptId !== "string") {
+    return;
+  }
+  clearError();
+  setBusy(stopButton, true, "Stopping sign-in…");
+  try {
+    const result = await api("/api/oauth/cancel", {
+      method: "POST",
+      body: { attemptId },
+    });
+    if (
+      state.oauthLoginGeneration !== loginGeneration ||
+      result.attemptId !== attemptId ||
+      result.status !== "cancelled"
+    ) {
+      return;
+    }
+    state.oauthLoginGeneration += 1;
+    state.oauthAttemptId = null;
+    state.oauthLoginWindow?.close?.();
+    state.oauthLoginWindow = null;
+    element("login-link").hidden = true;
+    element("login-link").removeAttribute("href");
+    setBusy(element("login-button"), false);
+    setOAuthStopControlVisible(false);
+    setMessage("ChatGPT sign-in stopped. You can start again.");
+  } catch (error) {
+    if (state.oauthLoginGeneration === loginGeneration) {
+      if (error.oauthRetryBlocked === true) {
+        state.oauthLoginGeneration += 1;
+        blockOAuthRetry();
+      }
+      showError(error);
+      if (!state.oauthRetryBlocked) {
+        setBusy(stopButton, false);
+      }
+    }
   }
 });
 

package/src/ui/index.html

@@ -203,6 +203,9 @@
           >
             Open fresh ChatGPT sign-in
           </a>
+          <button id="stop-login-button" class="button secondary" type="button" hidden>
+            Stop ChatGPT sign-in
+          </button>
           <button id="signin-next" class="button primary" type="button" disabled>
             Continue to VPS
           </button>

package/src/web/server.js

@@ -31,6 +31,7 @@ import { startCodexDeviceLogin } from "../services/codex-login.js";
 const MAX_BODY_BYTES = 32 * 1024;
 const RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
 const RATE_LIMIT_MAX = 10;
+const OAUTH_SHUTDOWN_WAIT_MS = 2_000;
 
 const defaultServices = {
   getAuthStatus,
@@ -110,6 +111,37 @@ function enforceRateLimit(state, key) {
   state.rateLimits.set(key, recent);
 }
 
+function waitForBoundedResult(promise, milliseconds) {
+  if (!promise) {
+    return Promise.resolve(true);
+  }
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        resolvePromise(false);
+      }
+    }, milliseconds);
+    Promise.resolve(promise).then(
+      () => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolvePromise(true);
+        }
+      },
+      () => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolvePromise(true);
+        }
+      },
+    );
+  });
+}
+
 function readJsonBody(request) {
   return new Promise((resolve, reject) => {
     const chunks = [];
@@ -192,6 +224,32 @@ function safeErrorMessage(error) {
   return message;
 }
 
+async function cancelOAuthLogin(state, login) {
+  try {
+    await login.attempt.cancel();
+  } catch {
+    if (state.oauthLogin === login) {
+      login.status = "error";
+      login.retryBlocked = true;
+      login.error =
+        "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.";
+    }
+    state.oauthRetryBlocked = true;
+    state.oauthStartupError =
+      "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.";
+    throw Object.assign(
+      new Error(
+        "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.",
+      ),
+      { retryBlocked: true, statusCode: 409 },
+    );
+  }
+
+  if (state.oauthLogin === login && login.status === "pending") {
+    login.status = "cancelled";
+  }
+}
+
 async function loadDefaultUiFiles() {
   const files = await Promise.all([
     readFile(new URL("../ui/index.html", import.meta.url), "utf8"),
@@ -297,8 +355,16 @@ async function handleApi(request, response, path, state) {
   if (request.method === "GET" && path === "/api/oauth/status") {
     const login = state.oauthLogin;
     sendJson(response, 200, {
-      status: login?.status ?? "idle",
-      ...(login?.status === "error" ? { error: login.error } : {}),
+      status: login?.status ?? (state.oauthStartupError ? "error" : "idle"),
+      ...(login ? { attemptId: login.attemptId } : {}),
+      ...(login?.status === "error"
+        ? { error: login.error }
+        : state.oauthStartupError
+          ? { error: state.oauthStartupError }
+          : {}),
+      ...(state.oauthRetryBlocked || login?.retryBlocked === true
+        ? { retryBlocked: true }
+        : {}),
     });
     return;
   }
@@ -342,42 +408,146 @@ async function handleApi(request, response, path, state) {
         { statusCode: 403 },
       );
     }
+    if (state.closing) {
+      throw Object.assign(new Error("The local wizard is closing."), {
+        statusCode: 409,
+      });
+    }
+    if (state.oauthRetryBlocked || state.oauthLogin?.retryBlocked === true) {
+      throw Object.assign(
+        new Error(
+          "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.",
+        ),
+        { retryBlocked: true, statusCode: 409 },
+      );
+    }
+    if (state.oauthLoginStartInFlight) {
+      throw Object.assign(
+        new Error("A ChatGPT sign-in start is already in progress."),
+        { statusCode: 409 },
+      );
+    }
     enforceRateLimit(state, path);
-    if (state.oauthLogin?.status === "pending") {
-      state.oauthLogin.attempt.cancel();
-      try {
-        await state.oauthLogin.attempt.completion;
-      } catch {
-        // Starting again intentionally replaces the previous local attempt.
+    state.oauthLoginStartInFlight = true;
+    state.oauthStartupError = null;
+    let startAttempted = false;
+    let startPromise;
+    try {
+      const previousLogin = state.oauthLogin;
+      if (previousLogin?.status === "pending") {
+        await cancelOAuthLogin(state, previousLogin);
       }
-    }
 
-    const attempt = await state.services.startOAuthLogin();
-    const login = {
-      attempt,
-      error: null,
-      status: "pending",
-    };
-    state.oauthLogin = login;
-    attempt.completion.then(
-      () => {
-        if (state.oauthLogin === login) {
-          login.status = "success";
-        }
-      },
-      (error) => {
-        if (state.oauthLogin === login) {
-          login.status = "error";
-          login.error = safeErrorMessage(error);
+      if (state.closing) {
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
+      if (
+        state.oauthLogin === previousLogin &&
+        previousLogin?.status !== "pending" &&
+        previousLogin?.retryBlocked !== true
+      ) {
+        state.oauthLogin = null;
+      }
+      startAttempted = true;
+      startPromise = Promise.resolve(state.services.startOAuthLogin());
+      state.oauthLoginStartPromise = startPromise;
+      const attempt = await startPromise;
+      const login = {
+        attempt,
+        attemptId: randomUUID(),
+        error: null,
+        retryBlocked: false,
+        status: "pending",
+      };
+      state.oauthLogin = login;
+      attempt.completion.then(
+        () => {
+          if (
+            state.oauthLogin === login &&
+            login.status === "pending" &&
+            !state.closing
+          ) {
+            login.status = "success";
+          }
+        },
+        (error) => {
+          if (
+            state.oauthLogin === login &&
+            login.status === "pending" &&
+            !state.closing
+          ) {
+            login.status = "error";
+            login.error = safeErrorMessage(error);
+            if (error?.retryBlocked === true) {
+              login.retryBlocked = true;
+              state.oauthRetryBlocked = true;
+              state.oauthStartupError = login.error;
+            }
+          }
+        },
+      );
+      if (state.closing) {
+        try {
+          await cancelOAuthLogin(state, login);
+        } catch {
+          // The server is already closing and must not restart this helper.
         }
-      },
-    );
-    sendJson(response, 200, { authorizationUrl: attempt.authorizationUrl });
-    return;
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
+      sendJson(response, 200, {
+        authorizationUrl: attempt.authorizationUrl,
+        attemptId: login.attemptId,
+      });
+      return;
+    } catch (error) {
+      const message = safeErrorMessage(error);
+      if (startAttempted) {
+        state.oauthStartupError = message;
+      }
+      if (error?.retryBlocked === true) {
+        state.oauthRetryBlocked = true;
+        state.oauthStartupError = message;
+      }
+      throw error;
+    } finally {
+      if (state.oauthLoginStartPromise === startPromise) {
+        state.oauthLoginStartPromise = null;
+      }
+      state.oauthLoginStartInFlight = false;
+    }
   }
 
   const body = await readJsonBody(request);
 
+  if (path === "/api/oauth/cancel") {
+    requireLiveLocalAction(state, "Live ChatGPT sign-in");
+    const login = state.oauthLogin;
+    if (
+      !login ||
+      login.status !== "pending" ||
+      !body ||
+      typeof body !== "object" ||
+      Array.isArray(body) ||
+      typeof body.attemptId !== "string" ||
+      body.attemptId !== login.attemptId
+    ) {
+      throw Object.assign(
+        new Error("The ChatGPT sign-in attempt has already changed. Start again."),
+        { statusCode: 409 },
+      );
+    }
+    await cancelOAuthLogin(state, login);
+    sendJson(response, 200, {
+      status: login.status,
+      attemptId: login.attemptId,
+    });
+    return;
+  }
+
   if (path === "/api/local/plan") {
     const plan = createLocalDeploymentPlan({
       target: body.target,
@@ -670,6 +840,7 @@ function createRequestHandler(state) {
       if (!response.headersSent) {
         sendJson(response, error.statusCode ?? 400, {
           error: safeErrorMessage(error),
+          ...(error.retryBlocked === true ? { retryBlocked: true } : {}),
         });
       } else {
         response.end();
@@ -684,6 +855,7 @@ export async function startWizardServer({
   uiFiles,
   port = 0,
   previewMode = false,
+  oauthShutdownWaitMs = OAUTH_SHUTDOWN_WAIT_MS,
 } = {}) {
   if (typeof sessionToken !== "string" || sessionToken.length < 32) {
     throw new TypeError("A strong wizard session token is required.");
@@ -699,12 +871,17 @@ export async function startWizardServer({
     discovery: null,
     networksByContainer: new Map(),
     oauthLogin: null,
+    oauthRetryBlocked: false,
+    oauthStartupError: null,
+    oauthLoginStartInFlight: false,
+    oauthLoginStartPromise: null,
     localPlan: null,
     localInstallInFlight: false,
     codexLogin: null,
     codexLoginStartInFlight: false,
     rateLimits: new Map(),
     previewMode: previewMode === true,
+    oauthShutdownWaitMs,
     closing: false,
   };
   const server = createServer(createRequestHandler(state));
@@ -724,13 +901,26 @@ export async function startWizardServer({
     origin: state.origin,
     async close() {
       state.closing = true;
-      state.oauthLogin?.attempt.cancel();
+      await waitForBoundedResult(
+        state.oauthLoginStartPromise,
+        state.oauthShutdownWaitMs,
+      );
+      if (state.oauthLogin?.status === "pending") {
+        try {
+          await cancelOAuthLogin(state, state.oauthLogin);
+        } catch {
+          // The bounded OAuth cancellation result must not prevent server shutdown.
+        }
+      }
       const codexLogin = state.codexLogin;
       state.codexLogin = null;
       codexLogin?.cancel();
       state.connection?.close();
       state.connection = null;
-      await new Promise((resolve) => server.close(resolve));
+      await waitForBoundedResult(
+        new Promise((resolve) => server.close(resolve)),
+        state.oauthShutdownWaitMs,
+      );
     },
   };
 }