refactor(oauth): retire the producerless paste-code authorization presentation (#3399)

* refactor(oauth): retire the paste-code authorization presentation

Every OAuth provider that survives on main enrols through a device flow:
the Host opens the provider's page in a browser and the provider hands the
credential back. `request_authorization_code` — the presentation where the
user copies a code out of the browser and pastes it into Maka — had no
producer left. Nothing selected it, so its decoders, its pending-code state
machine, and the PKCE/loopback authorization builders behind it were reached
only by their own tests.

Removed, from the wire inward:

- `request_authorization_code` leaves `OAuthPresentationMethod`, and the
  request/result unions collapse to the single shape the method carries. The
  decoder still validates the arriving method, so a peer offering anything
  else is refused rather than silently presented.
- The coordinator's `#present` overloads, its authorization-timeout bounds,
  and `#exchangeCode` go with it. `#exchangeCodexCode` stays: the Codex
  device flow exchanges a code the provider returns, not one the user pastes.
- Desktop drops the pending-code state machine and the paste branch of the
  IPC surface. `complete-authorization` stays — device flows drive
  `getAuthUrl -> openAuthUrl -> completeAuthorization`.
- `oauth-login.ts` loses `buildOAuthLoginAuthorization`,
  `exchangeOAuthAuthorizationCode`, and the redirect/state/PKCE helpers only
  they called. The token-endpoint transport stays; device flows use it.
- `@maka/core` loses `parsePastedAuthorization`, `constantTimeStringEqual`,
  `PENDING_AUTHORIZATION_TTL_MS`, the PKCE challenge helpers, and the
  `invalid_paste_code` / `authorization_expired` failure reasons. The Codex
  device flow receives its verifier from the provider rather than deriving
  one, so nothing computes a PKCE challenge any more.

The seven transport tests that reached the streaming and bounding behaviour
through `exchangeOAuthAuthorizationCode` now drive
`requestOAuthTokenEndpointJson` directly. That behaviour is still live for
device flows, so the coverage moves rather than disappears.

`RUNTIME_HOST_COMPATIBILITY_EPOCH` 31 -> 32: an older Client still offers the
removed presentation and an older Host still asks for it, and neither side can
carry the authorization code the other expects.

Closes #3219

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

* docs(desktop): drop the loopback PKCE mentions from the login-flow hook

The hook's header and its wait comment still described a loopback PKCE
alternative that no provider takes now that the paste-code presentation is
gone. Both paths through it are device-code polling.

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

* refactor(oauth): remove what the paste-code teardown orphaned

Self-review of the previous commit found code the removal left behind but
nothing reports: biome does not flag unused private functions, and the
compiler is happy to keep a field no one reads.

- `oauth-provider-contracts.ts` — the xAI contract still declared
  `authorizationEndpoint`, `redirectUri`, `authorizationExtras` and
  `presentation: 'loopback'`. The live enrolment reads `clientId`,
  `deviceEndpoint`, `deviceGrant`, `scope`, `tokenEndpoint` and
  `defaultTokenLifetimeSeconds` and nothing else. `presentation: 'loopback'`
  was the worst of them: it asserted a flow xAI does not take, in the table a
  reader consults to learn what it does take.
- `oauth-coordinator.ts` — `randomOpaqueValue` generated the verifier and
  state for the removed authorization request; it and its `randomBytes`
  import had no caller left.
- `oauth-login.ts` — `assertOpaqueValue` was called only from the deleted
  exchange, and `OAuthLoginProvider` was only a parameter of the deleted
  authorization input. No module imports either.
- `runtime-host-oauth-presentation.ts` — `OAuthExternalPresentation.method`
  lost its only reader when the Desktop attempt record stopped storing the
  presentation method. It was written as a constant and read by no one.
- `protocol/oauth.ts` — `safeInteger` decoded the quota window fields that
  left with the account-usage operation in #3183. A drive-by on my own prior
  PR, in the file this change already rewrites.

Test-side: the off-contract method in the protocol test is cast through
`unknown` and named, so it reads as a value arriving from an older peer
rather than as a claim that the string is `open_external`; two imports that
were already dead on main in `oauth-coordinator.test.ts` go with it.

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

Author: Joob1n

apps/desktop/src/main/__tests__/runtime-host-oauth-ipc-main.test.ts

@@ -10,7 +10,7 @@ import {
 } from '../runtime-host-oauth-ipc-main.js';
 import { RuntimeHostOAuthPresentation } from '../runtime-host-oauth-presentation.js';
 
-test('presents both Host OAuth methods without exposing the authorization URL', async () => {
+test('presents the Host OAuth handoff without exposing the authorization URL', async () => {
   const opened: string[] = [];
   const presentation = new RuntimeHostOAuthPresentation(async (url) => {
     opened.push(url);
@@ -21,27 +21,9 @@ test('presents both Host OAuth methods without exposing the authorization URL',
     'DEVICE-CODE',
     new AbortController().signal,
   );
-  assert.deepEqual(await external.presented, {
-    method: 'open_external',
-    stateHint: 'DEVICE-CODE',
-  });
+  assert.deepEqual(await external.presented, { stateHint: 'DEVICE-CODE' });
 
-  const pasted = presentation.expect('code-attempt');
-  const code = presentation.requestAuthorizationCode(
-    'https://auth.example/authorize',
-    'STATE-HINT',
-    new AbortController().signal,
-  );
-  assert.deepEqual(await pasted.presented, {
-    method: 'request_authorization_code',
-    stateHint: 'STATE-HINT',
-  });
-  assert.equal(presentation.submitAuthorizationCode('code-attempt', 'code#state'), true);
-  assert.equal(await code, 'code#state');
-  assert.deepEqual(opened, [
-    'https://auth.example/device',
-    'https://auth.example/authorize',
-  ]);
+  assert.deepEqual(opened, ['https://auth.example/device']);
 });
 
 test('adapts every Host OAuth provider through one Desktop flow', async () => {
@@ -86,9 +68,8 @@ test('adapts every Host OAuth provider through one Desktop flow', async () => {
     },
     startOAuthLogin: async (nextAttemptId, connectionId) => {
       attemptId = nextAttemptId;
-      // Codex device login presents with `open_external`; the paste-code
-      // presentation this fixture used has no producer, so asserting it proved
-      // the desktop bridge against a flow no provider takes.
+      // Codex device login presents through `open_external`: the browser
+      // carries the authorization and the Host writes the credential back.
       void presentation
         .openExternal(
           'https://codex.example/authorize',

apps/desktop/src/main/runtime-host-oauth-ipc-main.ts

@@ -58,7 +58,6 @@ export interface RuntimeHostOAuthIpcDeps {
 
 interface ActiveOAuthAttempt {
   readonly provider: OAuthLoginProvider;
-  readonly presentationMethod: OAuthExternalPresentation['method'];
 }
 
 /** Adapts the existing Desktop OAuth UI to the Host's provider-neutral OAuth operations. */
@@ -88,7 +87,6 @@ export function registerRuntimeHostOAuthIpc(deps: RuntimeHostOAuthIpcDeps): void
         const presented = await waitForPresentation(deps.client, attemptId, expectation.presented);
         activeAttempts.set(attemptId, {
           provider,
-          presentationMethod: presented.method,
         });
         return { authRequestId: attemptId, stateHint: presented.stateHint };
       } catch (error) {
@@ -110,22 +108,13 @@ export function registerRuntimeHostOAuthIpc(deps: RuntimeHostOAuthIpcDeps): void
     });
     deps.ipcMain.handle(
       channel('complete-authorization'),
-      async (_event, attemptId: unknown, authorizationCode: unknown) => {
+      async (_event, attemptId: unknown) => {
         if (typeof attemptId !== 'string') {
           return actionFailure('OAuth authorization is not active', 'authorization_pending');
         }
-        const attempt = providerAttempt(activeAttempts, attemptId, provider);
-        if (!attempt) {
+        if (!providerAttempt(activeAttempts, attemptId, provider)) {
           return actionFailure('OAuth authorization is not active', 'authorization_pending');
         }
-        if (attempt.presentationMethod === 'request_authorization_code') {
-          if (typeof authorizationCode !== 'string' || authorizationCode.length === 0) {
-            return actionFailure('OAuth authorization code is required', 'invalid_paste_code');
-          }
-          if (!deps.presentation.submitAuthorizationCode(attemptId, authorizationCode)) {
-            return actionFailure('OAuth authorization is not active', 'authorization_pending');
-          }
-        }
         try {
           const terminal = await waitForTerminal(deps.client, attemptId);
           activeAttempts.delete(attemptId);
@@ -295,7 +284,6 @@ function providerDisabled() {
 function actionFailure(
   message: string,
   reason:
-    | 'invalid_paste_code'
     | 'authorization_pending'
     | 'authorization_cancelled'
     | 'authorization_denied'

apps/desktop/src/main/runtime-host-oauth-presentation.ts

@@ -3,7 +3,6 @@ import type { OAuthPresentationBackend } from '@maka/runtime-host/client';
 const PRESENTATION_TIMEOUT_MS = 30_000;
 
 export interface OAuthExternalPresentation {
-  readonly method: 'open_external' | 'request_authorization_code';
   readonly stateHint: string;
 }
 
@@ -23,8 +22,6 @@ export class RuntimeHostOAuthPresentation implements OAuthPresentationBackend {
     let resolvePresented!: (presentation: OAuthExternalPresentation) => void;
     let rejectPresented!: (reason?: unknown) => void;
     let presentedSettled = false;
-    let resolveAuthorizationCode: ((value: string) => void) | undefined;
-    let rejectAuthorizationCode: ((reason?: unknown) => void) | undefined;
     const presented = new Promise<OAuthExternalPresentation>((accept, decline) => {
       resolvePresented = accept;
       rejectPresented = decline;
@@ -43,30 +40,13 @@ export class RuntimeHostOAuthPresentation implements OAuthPresentationBackend {
       resolve: (presentation) => {
         clearTimeout(timer);
         presentedSettled = true;
-        if (presentation.method === 'open_external' && this.#pending === pending) {
-          this.#pending = undefined;
-        }
+        if (this.#pending === pending) this.#pending = undefined;
         resolvePresented(presentation);
       },
       reject: (reason) => {
         clearTimeout(timer);
         if (this.#pending === pending) this.#pending = undefined;
         if (!presentedSettled) rejectPresented(reason);
-        rejectAuthorizationCode?.(reason);
-      },
-      authorizationCode: (signal) =>
-        new Promise<string>((resolveCode, rejectCode) => {
-          resolveAuthorizationCode = resolveCode;
-          rejectAuthorizationCode = rejectCode;
-          signal.addEventListener(
-            'abort',
-            () => pending.reject(signal.reason),
-            { once: true },
-          );
-        }),
-      submitAuthorizationCode: (value) => {
-        if (this.#pending === pending) this.#pending = undefined;
-        resolveAuthorizationCode?.(value);
       },
     };
     this.#pending = pending;
@@ -91,34 +71,13 @@ export class RuntimeHostOAuthPresentation implements OAuthPresentationBackend {
     try {
       await this.openSystemBrowser(url);
       signal.throwIfAborted();
-      pending.resolve({ method: 'open_external', stateHint });
+      pending.resolve({ stateHint });
     } catch (error) {
       pending.reject(error);
       throw error;
     }
   }
 
-  async requestAuthorizationCode(
-    url: string,
-    stateHint: string,
-    signal: AbortSignal,
-  ): Promise<string> {
-    signal.throwIfAborted();
-    const pending = this.#pending;
-    if (!pending) throw new Error('Desktop has no matching OAuth presentation request');
-    await this.openSystemBrowser(url);
-    signal.throwIfAborted();
-    pending.resolve({ method: 'request_authorization_code', stateHint });
-    return pending.authorizationCode(signal);
-  }
-
-  submitAuthorizationCode(attemptId: string, authorizationCode: string): boolean {
-    const pending = this.#pending;
-    if (!pending || pending.attemptId !== attemptId) return false;
-    pending.submitAuthorizationCode(authorizationCode);
-    return true;
-  }
-
   cancel(attemptId: string, reason: unknown = new Error('OAuth presentation cancelled')): void {
     if (this.#pending?.attemptId === attemptId) this.#pending.reject(reason);
   }
@@ -128,6 +87,4 @@ interface PendingPresentation {
   readonly attemptId: string;
   resolve(presentation: OAuthExternalPresentation): void;
   reject(reason?: unknown): void;
-  authorizationCode(signal: AbortSignal): Promise<string>;
-  submitAuthorizationCode(value: string): void;
 }

apps/desktop/src/renderer/locales/settings-provider-copy.ts

@@ -170,7 +170,7 @@ const zhCopy = {
     copilotDescription: '导入兼容 GitHub 凭据连接 Copilot 订阅。', serviceUnavailable: '登录服务暂时不可用，请检查网络后重试。',
     aria: 'OAuth 登录',
     staleState: 'OAuth 登录状态暂时没刷新成功，已保留上一次状态。',
-    codexDetail: '点击下方按钮打开设备授权页，并在页面中输入这里显示的登录码。', xaiDetail: '点击下方按钮打开浏览器登录，授权完成后会自动回写。', deviceCode: '登录码：', stateHint: '提示：state 以', startsWith: '开头。',
+    codexDetail: '点击下方按钮打开设备授权页，并在页面中输入这里显示的登录码。', xaiDetail: '点击下方按钮打开浏览器登录，授权完成后会自动回写。', deviceCode: '登录码：',
     openingBrowser: '打开浏览器…', logout: '退出登录', loggingOut: '退出中…',
     copilotSubtitle: '导入兼容的 GitHub 登录；token 不会暴露给渲染进程。', copilotImported: '已导入 GitHub Copilot 订阅账号。',
     copilotSetup: '请配置具有 Copilot Requests 权限的 fine-grained PAT；普通 gh auth login 可能不包含该权限。', importing: '导入中…',
@@ -304,7 +304,7 @@ const enCopy: ProviderSettingsCopy = {
     copilotDescription: 'Import compatible GitHub credentials to connect a Copilot subscription.', serviceUnavailable: 'The sign-in service is temporarily unavailable. Check the network and try again.',
     aria: 'OAuth sign-in',
     staleState: 'OAuth sign-in status could not be refreshed. The last known state is preserved. ',
-    codexDetail: 'Open the device page below and enter the sign-in code shown here.', xaiDetail: 'Open the browser below to sign in. Authorization is written back automatically.', deviceCode: 'Sign-in code:', stateHint: 'Tip: state begins with', startsWith: '.',
+    codexDetail: 'Open the device page below and enter the sign-in code shown here.', xaiDetail: 'Open the browser below to sign in. Authorization is written back automatically.', deviceCode: 'Sign-in code:',
     openingBrowser: 'Opening browser…', logout: 'Sign out', loggingOut: 'Signing out…',
     copilotSubtitle: 'Import a compatible GitHub sign-in. The token is never exposed to the renderer.', copilotImported: 'GitHub Copilot subscription account imported.',
     copilotSetup: 'Configure a fine-grained PAT with Copilot Requests permission. A normal gh auth login may not include it.', importing: 'Importing…',

apps/desktop/src/renderer/settings/use-connection-detail.ts

@@ -38,8 +38,8 @@ import { runtimeHostOAuthLoginBridge } from './runtime-host-settings-bridge.js';
 // Maps an OAuth model-connection provider type to the browser-assisted login
 // service that can re-run its authorization from inside the connection dialog. Only
 // the browser-assisted services (Codex and xAI) are one-button-drivable
-// here; Claude's paste-code flow and plain API-key providers return null so the
-// notice falls back to prose instead of rendering a dead button.
+// here; plain API-key providers return null so the notice falls back to
+// prose instead of rendering a dead button.
 export interface OAuthLoginService {
   bridge: OAuthLoginFlowBridge;
   display: { name: string; shortName: string };

apps/desktop/src/renderer/settings/use-oauth-login-flow.ts

@@ -6,17 +6,15 @@ import { createOneShotActionGuard, teardownPendingAuthorization } from './oauth-
 import { getProviderSettingsCopy } from '../locales/settings-provider-copy';
 
 
-// Shared browser-assisted OAuth login-flow controller (device-code
-// polling / loopback PKCE depending on the provider).
+// Shared browser-assisted OAuth login-flow controller (device-code polling).
 //
 // Extracted from the SubscriptionLoginModal `startLogin` flow so BOTH the
 // OAuth catalog login modals (Codex / xAI) AND the model
 // connection detail sheet's 重新登录 affordance drive the same
 // getAuthUrl -> openAuthUrl -> refresh -> completeAuthorization sequence with
 // one authRequestId lifecycle, one synchronous pending-action guard, and
-// cancellation-on-unmount. Claude's paste-code flow is deliberately NOT
-// routed through this hook -- it needs a manual authorization-code step and
-// its own experimental gate, so it keeps its bespoke card.
+// cancellation-on-unmount. Every OAuth provider hands authorization to the
+// browser, so this is the only login shape the renderer drives.
 //
 // GitHub Copilot rides the same controller through the `direct` account
 // flow (#1042): importing an existing GitHub login is one bridge call, so
@@ -206,7 +204,7 @@ export function useOAuthLoginFlow(params: {
       }
       const refreshed = await refresh();
       if (!oauthLoginFlowMountedRef.current || !refreshed) return;
-      // Loopback / polling -- wait for the backend to complete.
+      // Wait for the backend to finish polling the provider.
       const result = await bridge.completeAuthorization(payload.authRequestId);
       if (!oauthLoginFlowMountedRef.current) return;
       authRequestIdRef.current = null;

packages/core/src/__tests__/oauth-subscription.test.ts

@@ -1,69 +1,11 @@
 import { strict as assert } from 'node:assert';
-import { createHash } from 'node:crypto';
 import { describe, it } from 'node:test';
 
-import {
-  PKCE_VERIFIER_LENGTH_BYTES,
-  base64urlEncode,
-  constantTimeStringEqual,
-  parsePastedAuthorization,
-  pkceCodeChallenge,
-  type Sha256Digest,
-} from '../oauth-subscription.js';
-
-const nodeSha256: Sha256Digest = {
-  digest(input: string): Uint8Array {
-    return new Uint8Array(createHash('sha256').update(input, 'utf8').digest());
-  },
-};
+import { base64urlEncode } from '../oauth-subscription.js';
 
 describe('OAuth subscription helpers', () => {
   it('matches base64url encoding for empty and reserved bytes', () => {
     assert.equal(base64urlEncode(new Uint8Array()), '');
     assert.equal(base64urlEncode(new Uint8Array([0xfb, 0xff, 0xbf])), '-_-_');
   });
-
-  it('produces the RFC PKCE challenge with a safe verifier length', () => {
-    const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
-    assert.equal(
-      pkceCodeChallenge(verifier, nodeSha256),
-      'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
-    );
-    assert.equal(PKCE_VERIFIER_LENGTH_BYTES, 32);
-  });
-
-  it('parses only the strict code-state pasted shape', () => {
-    assert.deepEqual(parsePastedAuthorization('abc_123-XYZ#state_value-42'), {
-      code: 'abc_123-XYZ',
-      state: 'state_value-42',
-    });
-    assert.deepEqual(parsePastedAuthorization('  \n  abc#xyz  \n'), {
-      code: 'abc',
-      state: 'xyz',
-    });
-
-    const invalid: unknown[] = [
-      null,
-      '   ',
-      'abc',
-      '#xyz',
-      'abc#',
-      'abc!#xyz',
-      'abc#xy z',
-      'abc#xy#z',
-    ];
-    for (const value of invalid) assert.equal(parsePastedAuthorization(value), null);
-  });
-
-  it('compares equal and unequal strings without widening the contract', () => {
-    const cases = [
-      ['abc', 'abc', true],
-      ['', '', true],
-      ['abc', 'abcd', false],
-      ['abc', 'abd', false],
-    ] as const;
-    for (const [left, right, expected] of cases) {
-      assert.equal(constantTimeStringEqual(left, right), expected);
-    }
-  });
 });