fix(login): make sign-in cancellable and accept a provider's plain id

Four defects in the login flows, all reachable from a normal sign-in.

The editor extension armed a cancel callback and never called it: the
progress notification was not cancellable and no prompt received a
cancellation token, so an OAuth flow waiting on a browser round trip had
no way out at all. One login-wide cancellable notification now owns
cancellation, and its token reaches every quick pick and input box.

A second sign-in request started a rival flow behind a competing set of
prompts; it now joins the one already running. A completed sign-in that
failed only on the status refresh afterwards was reported as failed,
sending the user back to a screen they had just finished.

`--provider` matched a platform id or a display name, but a catalog
provider's id carries an internal prefix and its label is a product
name, so the id printed everywhere else - deepseek - matched neither.

A cancelled OpenAI Codex sign-in returned before tearing its wait down,
leaving both the callback timeout and the listening callback server to
hold the host event loop for the remainder of two minutes.

Author: elkaix

.changeset/login-cancel-and-provider-id.md

@@ -0,0 +1,5 @@
+---
+"@pythoughts/pythinker-code": patch
+---
+
+Accept a provider's plain id for `--provider` at login, so a catalog provider no longer has to be named by its full display name, and stop a cancelled OpenAI Codex sign-in from holding the process open for the rest of its two-minute callback timeout. In the editor extension, signing in now shows one cancellable progress notification, a repeated sign-in joins the one already running instead of opening a second set of prompts, and a completed sign-in is no longer reported as failed when the status refresh behind it fails.

apps/pythinker-code/test/cli/login.test.ts

@@ -87,7 +87,11 @@ vi.mock('@pythoughts/pythinker-code-oauth', async () => {
 vi.mock('#/utils/open-url', () => ({ openUrl: vi.fn() }));
 
 import { password, select } from '@clack/prompts';
-import { createPythinkerHarness } from '@pythoughts/pythinker-code-sdk';
+import {
+  createPythinkerHarness,
+  fetchCatalog,
+  type Catalog,
+} from '@pythoughts/pythinker-code-sdk';
 
 import { registerLoginCommand } from '#/cli/sub/login';
 import { openUrl } from '#/utils/open-url';
@@ -159,6 +163,26 @@ describe('pythinker login', () => {
     return stderrSpy.mock.calls.map((call: unknown[]) => String(call[0]));
   }
 
+  /** One connectable catalog provider, enough for `buildPlatformOptions` to list it. */
+  function catalogWithDeepSeek(): Catalog {
+    return {
+      deepseek: {
+        id: 'deepseek',
+        name: 'DeepSeek',
+        npm: '@ai-sdk/openai-compatible',
+        api: 'https://api.example.com/v1',
+        models: {
+          'deepseek-chat': {
+            id: 'deepseek-chat',
+            name: 'DeepSeek Chat',
+            tool_call: true,
+            limit: { context: 128_000, output: 8_192 },
+          },
+        },
+      },
+    };
+  }
+
   it('registers a `login` subcommand with a --provider option on the program', () => {
     const program = new Command('pythinker');
     registerLoginCommand(program);
@@ -285,6 +309,44 @@ describe('pythinker login', () => {
     expect(exitSpy.mock.calls[0]?.[0]).toBe(0);
   });
 
+  it('--provider matches a catalog provider by its bare id', async () => {
+    // A catalog provider's option value carries the internal `catalog:` prefix
+    // and its label is a product name, so the id printed everywhere else —
+    // `deepseek` — used to match neither and the login failed outright.
+    mockStatus.mockResolvedValue({ providers: [] });
+    mockGetConfig.mockResolvedValue({ providers: {}, models: {} });
+    vi.mocked(fetchCatalog).mockResolvedValueOnce(catalogWithDeepSeek());
+    vi.mocked(password).mockResolvedValue('sk-test-key');
+    vi.mocked(select)
+      .mockResolvedValueOnce('deepseek/deepseek-chat')
+      .mockResolvedValueOnce('off');
+
+    await runLogin(['login', '--provider', 'DeepSeek API']);
+
+    expect(select).not.toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Select a provider' }),
+    );
+    expect(mockSetConfig).toHaveBeenCalled();
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(0);
+
+    // The bare id resolves the same option the label does.
+    vi.mocked(select).mockReset();
+    mockSetConfig.mockClear();
+    exitSpy.mockClear();
+    vi.mocked(fetchCatalog).mockResolvedValueOnce(catalogWithDeepSeek());
+    vi.mocked(select)
+      .mockResolvedValueOnce('deepseek/deepseek-chat')
+      .mockResolvedValueOnce('off');
+
+    await runLogin(['login', '--provider', 'deepseek']);
+
+    expect(select).not.toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Select a provider' }),
+    );
+    expect(mockSetConfig).toHaveBeenCalled();
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(0);
+  });
+
   it('--provider with an unknown value exits non-zero, names the input, and never runs the picker', async () => {
     await runLogin(['login', '--provider', 'nope']);
 

apps/vscode/src/auth/vscode-login-ui.ts

@@ -51,10 +51,14 @@ const BUILT_IN_CATALOG_JSON: string | undefined =
 const CATALOG_FETCH_TIMEOUT_MS = 10_000;
 
 /** One quick pick for the effort level, from a list of supported levels. */
-async function promptEffortLevel(levels: readonly string[]): Promise<string | undefined> {
+async function promptEffortLevel(
+  levels: readonly string[],
+  token: vscode.CancellationToken,
+): Promise<string | undefined> {
   const selected = await vscode.window.showQuickPick(
     levels.map((level) => ({ label: level })),
     { title: "Select effort level", placeHolder: "Select effort level", ignoreFocusOut: true },
+    token,
   );
   return selected?.label;
 }
@@ -69,6 +73,10 @@ function createProgressHandle(title: string): LoginProgressSpinnerHandle {
   const finished = new Promise<void>((resolve) => {
     resolveFinished = resolve;
   });
+  // Deliberately not cancellable: these track one step of a login, but the only
+  // thing a cancel could do is abort the whole flow, and a Cancel button that
+  // silently means more than its label is worse than none. The login-wide
+  // progress notification the handler opens owns cancellation for every step.
   void vscode.window.withProgress(
     { location: vscode.ProgressLocation.Notification, title, cancellable: false },
     () => finished,
@@ -92,8 +100,16 @@ function createProgressHandle(title: string): LoginProgressSpinnerHandle {
  * Build a `LoginUi` for the extension host, rendering every prompt with VS
  * Code's own widgets. The webview keeps receiving the OAuth device URL it
  * already renders (`Events.LoginUrl`), so the pending-login screen still works.
+ *
+ * `token` is the login-wide cancellation token owned by the caller. Every quick
+ * pick and input box receives it, so cancelling closes whichever prompt is open
+ * instead of leaving the user staring at a widget the flow has already given
+ * up on; network waits are cancelled through `cancelInFlight`.
  */
-export function createVscodeLoginUi(ctx: HandlerContext): LoginUi {
+export function createVscodeLoginUi(
+  ctx: HandlerContext,
+  token: vscode.CancellationToken,
+): LoginUi {
   let cancelInFlight: (() => void) | undefined;
 
   function openBrowser(url: string): void {
@@ -168,38 +184,46 @@ export function createVscodeLoginUi(ctx: HandlerContext): LoginUi {
         description: option.description,
         value: option.value,
       }));
-      const selected = await vscode.window.showQuickPick(items, {
-        title: "Select a provider",
-        placeHolder: "Select a provider",
-        ignoreFocusOut: true,
-      });
+      const selected = await vscode.window.showQuickPick(
+        items,
+        { title: "Select a provider", placeHolder: "Select a provider", ignoreFocusOut: true },
+        token,
+      );
       if (selected === undefined) return undefined;
       return { platformId: selected.value, catalog };
     },
     async promptApiKey(platformName, subtitleLines, promptOptions: ApiKeyPromptOptions = {}) {
       const emptyMessage = promptOptions.emptyMessage ?? "API key cannot be empty.";
-      return vscode.window.showInputBox({
-        title: promptOptions.title ?? `Enter API key for ${platformName}`,
-        // An input box prompt is a single line, so newlines would collapse.
-        prompt: subtitleLines?.join(" — "),
-        password: promptOptions.secret !== false,
-        ignoreFocusOut: true,
-        validateInput: (input: string) => (input.length === 0 ? emptyMessage : undefined),
-      });
+      return vscode.window.showInputBox(
+        {
+          title: promptOptions.title ?? `Enter API key for ${platformName}`,
+          // An input box prompt is a single line, so newlines would collapse.
+          prompt: subtitleLines?.join(" — "),
+          password: promptOptions.secret !== false,
+          ignoreFocusOut: true,
+          validateInput: (input: string) => (input.length === 0 ? emptyMessage : undefined),
+        },
+        token,
+      );
     },
     async promptModelSelectionForOpenPlatform(models, platform) {
       const items = models.map((model) => ({
         label: model.displayName ?? model.id,
         model,
       }));
-      const selected = await vscode.window.showQuickPick(items, {
-        title: `Select a model for ${platform.name}`,
-        placeHolder: "Select a model",
-        ignoreFocusOut: true,
-      });
+      const selected = await vscode.window.showQuickPick(
+        items,
+        {
+          title: `Select a model for ${platform.name}`,
+          placeHolder: "Select a model",
+          ignoreFocusOut: true,
+        },
+        token,
+      );
       if (selected === undefined) return undefined;
       const effort = await promptEffortLevel(
         effortLevelsForModel(managedModelToAlias(platform.id, selected.model)),
+        token,
       );
       if (effort === undefined) return undefined;
       return { model: selected.model, effort };
@@ -209,14 +233,19 @@ export function createVscodeLoginUi(ctx: HandlerContext): LoginUi {
         label: model.name ?? model.id,
         model,
       }));
-      const selected = await vscode.window.showQuickPick(items, {
-        title: `Select a model for ${providerId}`,
-        placeHolder: "Select a model",
-        ignoreFocusOut: true,
-      });
+      const selected = await vscode.window.showQuickPick(
+        items,
+        {
+          title: `Select a model for ${providerId}`,
+          placeHolder: "Select a model",
+          ignoreFocusOut: true,
+        },
+        token,
+      );
       if (selected === undefined) return undefined;
       const effort = await promptEffortLevel(
         effortLevelsForModel(catalogModelToAlias(providerId, selected.model)),
+        token,
       );
       if (effort === undefined) return undefined;
       return { model: selected.model, effort };

apps/vscode/src/handlers/auth.handler.ts

@@ -1,34 +1,82 @@
 import { runLogin } from "@pythoughts/pythinker-code-sdk";
+import * as vscode from "vscode";
 
 import { Methods } from "../../shared/bridge";
 import type { LoginResult } from "../../shared/legacy-sdk";
 import type { LoginStatus } from "../../shared/types";
 import { createVscodeLoginUi } from "../auth/vscode-login-ui";
 import { updateLoginContext } from "../utils/context";
-import type { Handler } from "./types";
+import type { Handler, HandlerContext } from "./types";
+
+/**
+ * The login in flight, if any. Login owns modal UI — a second concurrent flow
+ * would open a competing set of quick picks and race to write credentials — so
+ * a repeated request joins the running one instead of starting a rival.
+ */
+let loginInFlight: Promise<LoginResult> | undefined;
+
+async function runLoginOnce(ctx: HandlerContext): Promise<LoginResult> {
+  // Owned here rather than inside the UI: the token has to exist before
+  // `runLogin` starts, and cancelling has to reach whichever prompt is open,
+  // not only the step that happens to hold a spinner.
+  const cancellation = new vscode.CancellationTokenSource();
+  const ui = createVscodeLoginUi(ctx, cancellation.token);
+  try {
+    // One login-wide progress notification, cancellable: the OAuth flows wait
+    // minutes on a browser round trip with no per-step spinner of their own,
+    // so this is the only surface that can offer a way out of them.
+    const success = await vscode.window.withProgress(
+      {
+        location: vscode.ProgressLocation.Notification,
+        title: "Signing in to Pythinker",
+        cancellable: true,
+      },
+      async (_progress, token) => {
+        token.onCancellationRequested(() => {
+          ui.cancelInFlight?.();
+          cancellation.cancel();
+        });
+        // `runLogin` resolves true only when credentials were written; a false
+        // result is a user cancellation or a failure the flow already reported.
+        return runLogin(ui);
+      },
+    );
+    // Credentials are already on disk at this point, so a status refresh that
+    // fails is a stale badge, not a failed login — reporting it as one would
+    // send the webview back to the sign-in screen the user just completed.
+    await updateLoginContext(ctx.harness).catch((statusError: unknown) => {
+      ctx.logError("Unable to refresh login status after a successful login", statusError);
+    });
+    return { success };
+  } catch (error) {
+    ctx.logError("Pythinker login failed", error);
+    await updateLoginContext(ctx.harness).catch((statusError: unknown) => {
+      ctx.logError("Unable to refresh login status after a failed login", statusError);
+    });
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  } finally {
+    cancellation.dispose();
+  }
+}
 
 export const authHandlers: Record<string, Handler<any, any>> = {
   [Methods.CheckLoginStatus]: async (_, ctx): Promise<LoginStatus> => {
     return { loggedIn: await updateLoginContext(ctx.harness) };
   },
 
   [Methods.Login]: async (_, ctx): Promise<LoginResult> => {
-    try {
-      // `runLogin` resolves true only when credentials were written; a false
-      // result is a user cancellation or a failure the flow already reported.
-      const success = await runLogin(createVscodeLoginUi(ctx));
-      await updateLoginContext(ctx.harness);
-      return { success };
-    } catch (error) {
-      ctx.logError("Pythinker login failed", error);
-      await updateLoginContext(ctx.harness).catch((statusError: unknown) => {
-        ctx.logError("Unable to refresh login status after a failed login", statusError);
-      });
-      return {
-        success: false,
-        error: error instanceof Error ? error.message : String(error),
-      };
-    }
+    if (loginInFlight !== undefined) return loginInFlight;
+    const pending = runLoginOnce(ctx);
+    loginInFlight = pending;
+    void pending.finally(() => {
+      // Identity-checked so a slow flow that lost the slot cannot clear a newer
+      // one and strand every later login on a cached result.
+      if (loginInFlight === pending) loginInFlight = undefined;
+    });
+    return pending;
   },
 
   [Methods.Logout]: async (_, ctx): Promise<LoginResult> => {