Findings

• [Major] Garbled localized strings introduced in OAuth provider metadata and error messaging — this regresses user-facing copy quality and can confuse users during login failures, evidence apps/desktop/src/main/codex-oauth-ipc.ts:43, apps/desktop/src/main/codex-oauth-ipc.ts:174
  Suggested fix:

  const CHATGPT_CODEX_PROVIDER: ProviderEntry = {
    id: CHATGPT_CODEX_PROVIDER_ID,
    name: 'ChatGPT 订阅',
    // ...
  };
  
  throw new CodesignError(
    'Codex 登录成功但无法读取 ChatGPT 账户 ID，请重试登录。',
    ERROR_CODES.PROVIDER_ERROR,
    { cause: null },
  );

• [Major] Cancel action has no error handling, so IPC failures are not surfaced in UI — this violates the “no silent fallbacks” constraint on the newly added cancel path, evidence apps/desktop/src/renderer/src/components/ChatgptLoginCard.tsx:169
  Suggested fix:

  const handleCancel = useCallback(async () => {
    if (!window.codesign) return;
    try {
      const cancelled = await window.codesign.codexOAuth.cancelLogin();
      if (!cancelled && mountedRef.current) setLoading(false);
    } catch (err) {
      if (mountedRef.current) setLoading(false);
      pushToast({
        variant: 'error',
        title: t('settings.providers.chatgptLogin.loginFailedTitle'),
        description: err instanceof Error ? err.message : t('settings.providers.chatgptLogin.unknownError'),
      });
    }
  }, [pushToast, t]);

Summary

• Review mode: initial
• 2 issues found on modified lines. docs/VISION.md and docs/PRINCIPLES.md are Not found in repo/docs in this checkout, so doc-level constraint cross-check relied on CLAUDE.md plus code-level validation.

Testing

• Not run (automation)
• Suggested: add a renderer unit test for cancel-path IPC rejection to assert toast + loading reset behavior.

open-codesign Bot