@agi-fans/dsh-tui 0.20.0 → 0.21.0

package/lib/commands/auth.js

@@ -4,17 +4,18 @@ import process from 'node:process';
 import { AuthorizationError, } from '@deepseek-ai/dsh-authorization';
 import { credentialKey, credentialKeyId, credentialKeyScope, credentialRef, isCredentialKeySegment, parseCredentialKey, } from '@deepseek-ai/dsh-credentials';
 import { createAuthorizationInteraction } from "../session/authorization-interaction.js";
+import { APP_VERSION } from "../session/package-metadata.js";
 import { registerCommands } from "./registration.js";
 export const name = 'omdsh-command-auth';
 export const inject = ['commands', 'credentials', 'settings', 'tui', 'llm'];
 export const DEEPSEEK_PROVIDER = 'deepseek-official';
 export const DEEPSEEK_API_KEY = credentialRef('DEEPSEEK_API_KEY');
-export const OMDSH_DEEPSEEK_API_KEY = credentialRef('OMDSH_DEEPSEEK_API_KEY');
 export const DEEPSEEK_SETTINGS = 'llm-deepseek';
 export const PI_AI_SETTINGS = 'llm-pi-ai';
 export const DEEPSEEK_API_KEYS_URL = 'https://platform.deepseek.com/api_keys';
 export const DEEPSEEK_MODELS_URL = 'https://api.deepseek.com/v1/models';
 export const CUSTOM_PROVIDER_VALUE = '__omdsh_custom__';
+export const DEEPSEEK_ACCOUNT_CHOICE = '__omdsh_deepseek_account__';
 export const FLOW_VALUE_PREFIX = '__omdsh_flow__:';
 const PI_AI_RECORD_SCOPE = 'llm-pi-ai';
 const FULLSCREEN_CHOICE_THRESHOLD = 8;
@@ -144,8 +145,13 @@ function authorizationFlows(ctx) {
 function isPiAiDeepSeekFlow(flow) {
     return credentialKeyScope(flow.key) === PI_AI_RECORD_SCOPE && credentialKeyId(flow.key) === 'deepseek';
 }
+function isAccountFlow(flow) {
+    return credentialKeyScope(flow.key) === 'deepseek-account-platform';
+}
 function loginAuthorizationFlows(ctx) {
     return authorizationFlows(ctx).flatMap(flow => {
+        if (isAccountFlow(flow))
+            return [];
         if (!isPiAiDeepSeekFlow(flow))
             return [flow];
         const profile = walkPath(sectionValue(ctx, PI_AI_SETTINGS), ['providers', 'deepseek']);
@@ -176,8 +182,9 @@ function parseFlowChoice(raw) {
         return undefined;
     }
 }
-function loginChoiceValues(entries, flows, includeCustom) {
+function loginChoiceValues(entries, flows, includeCustom, includeAccount = false) {
     return [
+        ...(includeAccount ? [DEEPSEEK_ACCOUNT_CHOICE] : []),
         ...entries.map(entry => entry.provider),
         ...flows.map(flow => flowChoiceValue(flow.key)),
         ...(includeCustom ? [CUSTOM_PROVIDER_VALUE] : []),
@@ -225,13 +232,15 @@ function catalogForRecord(ctx, key) {
     return loginableProviders(ctx).find(entry => entry.provider === id && entry.settingsNs === scope);
 }
 function isFlowRecordLogout(choice) {
-    return 'key' in choice && 'writable' in choice && !('provider' in choice);
+    return typeof choice !== 'string' && 'key' in choice && 'writable' in choice && !('provider' in choice);
 }
 async function configuredFlowRecords(ctx) {
     const credentials = ctx.credentials;
     const rows = [];
     const claimed = new Set();
     for (const flow of authorizationFlows(ctx)) {
+        if (isAccountFlow(flow))
+            continue;
         const info = await credentials.describeRecord(flow.key);
         if (!info.configured)
             continue;
@@ -258,6 +267,9 @@ async function configuredFlowRecords(ctx) {
 async function logoutableChoices(ctx) {
     const providers = logoutableProviders(ctx);
     const records = await configuredFlowRecords(ctx);
+    const account = accountClient(ctx);
+    const accountState = account === undefined ? undefined : await account.getState().catch(() => undefined);
+    const accountChoice = accountState?.status === 'credential-stored' ? [DEEPSEEK_ACCOUNT_CHOICE] : [];
     const actionable = [];
     let inactiveDeepSeek;
     for (const entry of providers) {
@@ -266,19 +278,18 @@ async function logoutableChoices(ctx) {
             continue;
         }
         const activeRef = profileApiKeyEnv(ctx, entry) ?? String(DEEPSEEK_API_KEY);
-        const managed = activeRef === String(OMDSH_DEEPSEEK_API_KEY);
-        const current = await ctx.credentials.describe(managed ? OMDSH_DEEPSEEK_API_KEY : DEEPSEEK_API_KEY);
-        if (managed || (activeRef === String(DEEPSEEK_API_KEY) && current.source === 'file')) {
+        const current = await ctx.credentials.describe(credentialRef(activeRef));
+        if (current.configured && current.source === 'file')
             actionable.push(entry);
-        }
-        else {
+        else
             inactiveDeepSeek = entry;
-        }
     }
-    const choices = [...actionable, ...records];
+    const choices = [...accountChoice, ...actionable, ...records];
     // Preserve the direct explanatory response when the environment-owned or
     // already-logged-out official route is the only thing the command can see.
-    return choices.length === 0 && inactiveDeepSeek !== undefined ? [inactiveDeepSeek] : choices;
+    if (choices.length === 0 && inactiveDeepSeek !== undefined)
+        return [inactiveDeepSeek];
+    return choices;
 }
 function selected(raw, values) {
     const index = /^\d+$/u.test(raw) ? Number(raw) - 1 : -1;
@@ -316,7 +327,10 @@ async function pickLoginChoice(ctx, invocation) {
         return configured !== 0 ? configured : left.flow.label.localeCompare(right.flow.label);
     });
     const orderedFlows = flowRows.map(row => row.flow);
-    const values = loginChoiceValues(entries, orderedFlows, true);
+    const account = ctx.get('deepseekAccount');
+    const accountState = account?.getState === undefined ? undefined : await account.getState().catch(() => undefined);
+    const includeAccount = account?.getState !== undefined;
+    const values = loginChoiceValues(entries, orderedFlows, true, includeAccount);
     const fullscreen = values.length > FULLSCREEN_CHOICE_THRESHOLD;
     const raw = await ctx.tui.prompt({
         ...(fullscreen ? { presentation: 'fullscreen-list' } : {}),
@@ -325,6 +339,16 @@ async function pickLoginChoice(ctx, invocation) {
         title: 'Provider',
         question: 'Choose a provider to sign in or update',
         options: [
+            ...(includeAccount ? [{
+                    label: 'DeepSeek account',
+                    value: DEEPSEEK_ACCOUNT_CHOICE,
+                    description: accountState?.status === 'credential-stored'
+                        ? 'signed in · shared with DSH; choose deepseek-account in /model'
+                        : 'signed out · opens the DeepSeek browser sign-in',
+                    ...(accountState?.status === 'credential-stored'
+                        ? { badge: { label: 'signed in', tone: 'success' } }
+                        : {}),
+                }] : []),
             ...entryRows.map(({ entry, badge }) => ({
                 label: providerListId(entry),
                 value: entry.provider,
@@ -350,6 +374,7 @@ async function pickLoginChoice(ctx, invocation) {
             },
         ],
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (raw === null)
@@ -360,6 +385,8 @@ async function pickLoginChoice(ctx, invocation) {
     const chosen = selected(raw, values);
     if (chosen === undefined)
         return undefined;
+    if (chosen === DEEPSEEK_ACCOUNT_CHOICE)
+        return DEEPSEEK_ACCOUNT_CHOICE;
     const flowKey = parseFlowChoice(chosen);
     if (flowKey !== undefined)
         return orderedFlows.find(flow => flow.key === flowKey);
@@ -380,6 +407,7 @@ async function pickAuthorizationMethod(ctx, invocation, flow) {
             value: method.id,
         })),
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (raw === null)
@@ -401,7 +429,10 @@ async function loginAuthorization(ctx, invocation, flow) {
         const outcome = await authorization.begin({
             key: flow.key,
             method,
-            interaction: createAuthorizationInteraction(ctx.tui, `Login to ${flow.label}`),
+            interaction: createAuthorizationInteraction({
+                notice: message => { ctx.tui.notice(message); },
+                prompt: request => ctx.tui.prompt({ ...request, notify: false }),
+            }, `Login to ${flow.label}`),
             signal: invocation.signal,
         });
         if (outcome.status === 'cancelled')
@@ -423,45 +454,40 @@ async function loginAuthorization(ctx, invocation, flow) {
 async function resetDeepSeekCredentialRoute(ctx) {
     await ctx.settings.mutate(DEEPSEEK_SETTINGS, [{ op: 'unset', path: ['apiKeyEnv'] }]);
 }
-async function logoutSuccess(ctx, managed) {
-    const fallback = await ctx.credentials.describe(DEEPSEEK_API_KEY);
-    if (fallback.configured) {
-        return {
-            kind: 'success',
-            text: `${managed ? 'Logged out from the omdsh-managed DeepSeek credential.' : 'Logged out from DeepSeek.'} Falling back to DEEPSEEK_API_KEY from ${credentialSource(fallback)}.`,
-        };
-    }
-    return { kind: 'success', text: 'Logged out from DeepSeek.' };
-}
-/** Best-effort browser launch; the prompt always retains the full URL as a fallback. */
-export function openDeepSeekDashboard() {
+/** Best-effort browser launch; callers always retain the full URL as a fallback. */
+function openExternal(url) {
     const command = process.platform === 'darwin'
-        ? { file: 'open', args: [DEEPSEEK_API_KEYS_URL] }
+        ? { file: 'open', args: [url] }
         : process.platform === 'win32'
-            ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'start', '', DEEPSEEK_API_KEYS_URL] }
-            : { file: 'xdg-open', args: [DEEPSEEK_API_KEYS_URL] };
+            ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'start', '', url] }
+            : { file: 'xdg-open', args: [url] };
     try {
         const child = spawn(command.file, command.args, { detached: true, stdio: 'ignore' });
         child.once('error', () => undefined);
         child.unref();
     }
     catch {
-        // Headless and remote terminals still receive the visible dashboard URL.
+        // Headless and remote terminals still receive the visible URL.
     }
 }
+/** Best-effort browser launch for the DeepSeek key dashboard. */
+export function openDeepSeekDashboard() {
+    openExternal(DEEPSEEK_API_KEYS_URL);
+}
 async function loginDeepSeek(ctx, invocation, config) {
-    const current = await ctx.credentials.describe(OMDSH_DEEPSEEK_API_KEY);
+    const current = await ctx.credentials.describe(DEEPSEEK_API_KEY);
     if (current.configured && !current.writable) {
-        return { kind: 'error', text: unmanagedCredentialMessage(OMDSH_DEEPSEEK_API_KEY, current, 'replace') };
+        return { kind: 'error', text: unmanagedCredentialMessage(DEEPSEEK_API_KEY, current, 'replace') };
     }
     if (config.openDashboard !== false)
         openDeepSeekDashboard();
     const raw = await ctx.tui.prompt({
         title: 'Login to DeepSeek',
         question: current.configured ? 'Paste a new DeepSeek API key' : 'Paste your DeepSeek API key',
-        detail: `Create or copy a key at ${DEEPSEEK_API_KEYS_URL}. It will be validated, stored locally, and preferred over DEEPSEEK_API_KEY.`,
+        detail: `Create or copy a key at ${DEEPSEEK_API_KEYS_URL}. It will be validated and stored locally as ${DEEPSEEK_API_KEY}.`,
         allowCustom: true,
         secret: true,
+        notify: false,
         submitLabel: 'validate',
         signal: invocation.signal,
     });
@@ -478,23 +504,27 @@ async function loginDeepSeek(ctx, invocation, config) {
         return { kind: 'error', text: error instanceof Error ? error.message : 'DeepSeek login failed.' };
     }
     try {
-        await ctx.credentials.set(OMDSH_DEEPSEEK_API_KEY, apiKey);
+        await ctx.credentials.set(DEEPSEEK_API_KEY, apiKey);
     }
     catch {
         return { kind: 'error', text: 'The API key is valid, but it could not be saved to the Harness credential store.' };
     }
-    try {
-        await ctx.settings.update(DEEPSEEK_SETTINGS, { apiKeyEnv: String(OMDSH_DEEPSEEK_API_KEY) });
-    }
-    catch {
-        return {
-            kind: 'error',
-            text: 'The API key is valid and saved, but omdsh could not activate it for the DeepSeek provider. Run /login again after checking your settings file.',
-        };
+    // A profile may still pin the old product-owned reference. Reset it so the
+    // upstream default resolves the key that was just stored.
+    if (profileApiKeyEnv(ctx, fallbackDeepSeekEntry()) !== String(DEEPSEEK_API_KEY)) {
+        try {
+            await resetDeepSeekCredentialRoute(ctx);
+        }
+        catch {
+            return {
+                kind: 'error',
+                text: 'The API key is valid and saved, but the DeepSeek credential reference could not be reset. Run /login again after checking your settings file.',
+            };
+        }
     }
     return {
         kind: 'success',
-        text: 'Logged in to DeepSeek. Your omdsh credential takes priority on the next model request.',
+        text: 'Logged in to DeepSeek. The stored key is used by the deepseek-official route on the next model request.',
     };
 }
 async function loginCatalog(ctx, invocation, entry) {
@@ -510,6 +540,7 @@ async function loginCatalog(ctx, invocation, entry) {
         detail: `The key is stored locally and activates the ${entry.provider} route for the next model request. Use /model to select it.`,
         allowCustom: true,
         secret: true,
+        notify: false,
         submitLabel: 'save',
         signal: invocation.signal,
     });
@@ -563,6 +594,7 @@ async function collectCustomModels(ctx, invocation, draft) {
         ],
         initialValue: 'enter',
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (source === null)
@@ -587,6 +619,7 @@ async function collectCustomModels(ctx, invocation, draft) {
                     })),
                     multiSelect: true,
                     allowCustom: false,
+                    notify: false,
                     filterable: discovered.length > FULLSCREEN_CHOICE_THRESHOLD,
                     ...(discovered.length > FULLSCREEN_CHOICE_THRESHOLD ? { presentation: 'fullscreen-list' } : {}),
                     signal: invocation.signal,
@@ -605,6 +638,7 @@ async function collectCustomModels(ctx, invocation, draft) {
                 question: 'Enter model ids',
                 detail: `Could not fetch models (${detail}). Type one or more ids, separated by commas.`,
                 allowCustom: true,
+                notify: false,
                 signal: invocation.signal,
             });
             if (fallback === null)
@@ -617,6 +651,7 @@ async function collectCustomModels(ctx, invocation, draft) {
         question: 'Enter model ids',
         detail: 'Separate multiple ids with commas. Example: llama3.1, qwen2.5-coder',
         allowCustom: true,
+        notify: false,
         signal: invocation.signal,
     });
     if (typed === null)
@@ -629,6 +664,7 @@ async function loginCustom(ctx, invocation) {
         question: 'Provider id',
         detail: 'Lowercase letters, digits, and hyphens. This id is permanent.',
         allowCustom: true,
+        notify: false,
         signal: invocation.signal,
     });
     if (idRaw === null)
@@ -648,6 +684,7 @@ async function loginCustom(ctx, invocation) {
         question: 'Base URL',
         detail: 'Absolute http(s) prefix, for example http://127.0.0.1:11434/v1',
         allowCustom: true,
+        notify: false,
         signal: invocation.signal,
     });
     if (urlRaw === null)
@@ -671,6 +708,7 @@ async function loginCustom(ctx, invocation) {
         })),
         initialValue: 'openai-completions',
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (api === null)
@@ -684,6 +722,7 @@ async function loginCustom(ctx, invocation) {
         detail: 'Leave empty if the endpoint does not need a key.',
         allowCustom: true,
         secret: true,
+        notify: false,
         submitLabel: 'continue',
         signal: invocation.signal,
     });
@@ -752,60 +791,88 @@ async function loginCustom(ctx, invocation) {
 }
 async function logoutDeepSeek(ctx, invocation) {
     const activeRef = profileApiKeyEnv(ctx, fallbackDeepSeekEntry()) ?? String(DEEPSEEK_API_KEY);
-    const usesOmdshCredential = activeRef === String(OMDSH_DEEPSEEK_API_KEY);
-    const activeCredential = usesOmdshCredential ? OMDSH_DEEPSEEK_API_KEY : DEEPSEEK_API_KEY;
-    const current = await ctx.credentials.describe(activeCredential);
-    const legacyManagedDefault = activeRef === String(DEEPSEEK_API_KEY) && current.source === 'file';
-    if (!usesOmdshCredential && !legacyManagedDefault) {
-        if (!current.configured)
-            return { kind: 'success', text: 'DeepSeek is already logged out.' };
-        return {
-            kind: 'success',
-            text: `No omdsh-managed DeepSeek login is active. DeepSeek is configured by ${credentialSource(current)}.`,
-        };
-    }
-    if (usesOmdshCredential && !current.configured) {
-        try {
-            await resetDeepSeekCredentialRoute(ctx);
-        }
-        catch {
-            return { kind: 'error', text: 'Could not reset the DeepSeek credential setting.' };
+    const current = await ctx.credentials.describe(credentialRef(activeRef));
+    if (!current.configured) {
+        if (activeRef !== String(DEEPSEEK_API_KEY)) {
+            try {
+                await resetDeepSeekCredentialRoute(ctx);
+            }
+            catch {
+                return { kind: 'error', text: 'Could not reset the DeepSeek credential setting.' };
+            }
         }
-        return logoutSuccess(ctx, true);
+        return { kind: 'success', text: 'DeepSeek is already logged out.' };
+    }
+    if (current.source !== 'file') {
+        return { kind: 'success', text: `DeepSeek is configured by ${credentialSource(current)}; the credential store cannot remove it.` };
     }
-    const removesStoredKey = current.source === 'file';
     const answer = await ctx.tui.prompt({
         title: 'Logout from DeepSeek',
-        question: removesStoredKey ? 'Remove the stored DeepSeek API key?' : 'Stop using the omdsh DeepSeek credential?',
-        detail: 'The next model request will fall back to DEEPSEEK_API_KEY when one is available.',
+        question: 'Remove the stored DeepSeek API key?',
+        detail: 'The next model request will use DEEPSEEK_API_KEY from the launch environment when one is available.',
         options: [
             { label: 'Cancel', value: 'cancel', description: 'Keep the current credential.' },
             {
                 label: 'Log out',
                 value: 'logout',
-                description: removesStoredKey
-                    ? 'Remove the key from the local Harness credential store.'
-                    : 'Return the provider to its default credential source.',
+                description: 'Remove the key from the local Harness credential store.',
                 badge: { label: 'removes credential', tone: 'warning' },
             },
         ],
         initialValue: 'cancel',
         allowCustom: false,
+        notify: false,
         submitLabel: 'apply',
         signal: invocation.signal,
     });
     if (answer !== 'logout')
         return { kind: 'success' };
     try {
-        if (usesOmdshCredential)
+        await ctx.credentials.unset(credentialRef(activeRef));
+        if (activeRef !== String(DEEPSEEK_API_KEY))
             await resetDeepSeekCredentialRoute(ctx);
-        if (removesStoredKey)
-            await ctx.credentials.unset(activeCredential);
     }
     catch {
         return { kind: 'error', text: 'Could not remove the DeepSeek API key from the Harness credential store.' };
     }
-    return logoutSuccess(ctx, usesOmdshCredential);
+    return { kind: 'success', text: 'Logged out from DeepSeek. The next model request falls back to the environment when available.' };
+}
+async function logoutDeepSeekAccount(ctx, invocation) {
+    const account = accountClient(ctx);
+    if (account === undefined)
+        return { kind: 'error', text: 'DeepSeek account integration is not mounted in this build.' };
+    let state;
+    try {
+        state = await account.getState();
+    }
+    catch {
+        return { kind: 'error', text: 'Could not read the shared DeepSeek account state.' };
+    }
+    if (state.status !== 'credential-stored') {
+        return { kind: 'success', text: 'No DeepSeek account grant is stored.' };
+    }
+    const answer = await ctx.tui.prompt({
+        title: 'Logout from DeepSeek account',
+        question: 'Sign out of the shared DeepSeek account?',
+        detail: 'Removes the local grant and revokes it in the background. The browser session is not signed out.',
+        options: [
+            { label: 'Cancel', value: 'cancel', description: 'Keep the account grant.' },
+            { label: 'Sign out', value: 'logout', description: 'Remove the local grant and revoke it in the background.' },
+        ],
+        initialValue: 'cancel',
+        allowCustom: false,
+        notify: false,
+        signal: invocation.signal,
+    });
+    if (answer !== 'logout')
+        return { kind: 'success' };
+    try {
+        await account.signOut(accountClientMetadata());
+    }
+    catch {
+        return { kind: 'error', text: 'Could not sign out of the DeepSeek account. Try again from DSH Web/Desktop.' };
+    }
+    return { kind: 'success', text: 'Signed out of the DeepSeek account. The local grant was removed; remote revocation continues in the background.' };
 }
 async function pickLogoutChoice(ctx, invocation) {
     const choices = await logoutableChoices(ctx);
@@ -813,7 +880,9 @@ async function pickLogoutChoice(ctx, invocation) {
         return undefined;
     if (choices.length === 1)
         return choices[0];
-    const values = choices.map(choice => isFlowRecordLogout(choice) ? flowChoiceValue(choice.key) : choice.provider);
+    const values = choices.map(choice => choice === DEEPSEEK_ACCOUNT_CHOICE
+        ? DEEPSEEK_ACCOUNT_CHOICE
+        : isFlowRecordLogout(choice) ? flowChoiceValue(choice.key) : choice.provider);
     const fullscreen = values.length > FULLSCREEN_CHOICE_THRESHOLD;
     const raw = await ctx.tui.prompt({
         ...(fullscreen ? { presentation: 'fullscreen-list' } : {}),
@@ -821,18 +890,25 @@ async function pickLogoutChoice(ctx, invocation) {
         filterable: fullscreen,
         title: 'Provider',
         question: 'Choose a provider to log out from',
-        options: choices.map(choice => isFlowRecordLogout(choice)
+        options: choices.map(choice => choice === DEEPSEEK_ACCOUNT_CHOICE
             ? {
-                label: choice.label,
-                value: flowChoiceValue(choice.key),
-                description: choice.writable ? 'signed in' : 'not removable here',
+                label: 'DeepSeek account',
+                value: DEEPSEEK_ACCOUNT_CHOICE,
+                description: 'shared with DSH · signed in',
             }
-            : {
-                label: providerListId(choice),
-                value: choice.provider,
-                description: 'signed in',
-            }),
+            : isFlowRecordLogout(choice)
+                ? {
+                    label: choice.label,
+                    value: flowChoiceValue(choice.key),
+                    description: choice.writable ? 'signed in' : 'not removable here',
+                }
+                : {
+                    label: providerListId(choice),
+                    value: choice.provider,
+                    description: 'signed in',
+                }),
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (raw === null)
@@ -840,10 +916,12 @@ async function pickLogoutChoice(ctx, invocation) {
     const chosen = selected(raw, values);
     if (chosen === undefined)
         return undefined;
+    if (chosen === DEEPSEEK_ACCOUNT_CHOICE)
+        return DEEPSEEK_ACCOUNT_CHOICE;
     const flowKey = parseFlowChoice(chosen);
     if (flowKey !== undefined)
         return choices.find(choice => isFlowRecordLogout(choice) && choice.key === flowKey);
-    return choices.find(choice => !isFlowRecordLogout(choice) && choice.provider === chosen);
+    return choices.find(choice => typeof choice !== 'string' && !isFlowRecordLogout(choice) && choice.provider === chosen);
 }
 async function logoutRecord(ctx, invocation, record) {
     if (!record.writable) {
@@ -867,6 +945,7 @@ async function logoutRecord(ctx, invocation, record) {
         ],
         initialValue: 'cancel',
         allowCustom: false,
+        notify: false,
         submitLabel: 'apply',
         signal: invocation.signal,
     });
@@ -911,6 +990,7 @@ async function logoutCatalog(ctx, invocation, entry) {
         ],
         initialValue: 'cancel',
         allowCustom: false,
+        notify: false,
         submitLabel: 'apply',
         signal: invocation.signal,
     });
@@ -928,6 +1008,156 @@ async function logoutCatalog(ctx, invocation, entry) {
     }
     return { kind: 'success', text: `Logged out from ${label}.` };
 }
+function accountClient(ctx) {
+    return ctx.get('deepseekAccount');
+}
+function accountClientMetadata() {
+    return {
+        version: APP_VERSION,
+        locale: Intl.DateTimeFormat().resolvedOptions().locale,
+        timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60,
+    };
+}
+function accountCallbackOrigin(ctx) {
+    const server = ctx.get('webServer');
+    if (server === undefined || typeof server.port !== 'number' || server.port === 0)
+        return undefined;
+    return `${server.protocol}//${server.host}:${server.port}`;
+}
+function accountFailure(attempt) {
+    if (attempt?.phase === 'expired')
+        return 'The DeepSeek sign-in expired. Run /login to try again.';
+    if (attempt?.phase === 'failed')
+        return `DeepSeek sign-in failed${attempt.errorCode === undefined ? '' : ` (${attempt.errorCode})`}. Run /login to try again.`;
+    if (attempt?.phase === 'cancelled')
+        return 'DeepSeek sign-in was cancelled.';
+    return undefined;
+}
+async function waitForAccount(invocation, account, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (invocation.signal.aborted) {
+            const state = await account.getState().catch(() => undefined);
+            const id = state?.attempt?.id;
+            if (id !== undefined)
+                await account.cancelSignIn(id).catch(() => undefined);
+            return { kind: 'success' };
+        }
+        const state = await account.getState().catch(() => undefined);
+        if (state?.status === 'credential-stored' && state.attempt?.phase === 'succeeded') {
+            return { kind: 'success', text: 'Signed in to the DeepSeek account. Use /model to select the deepseek-account route; web search and fetch use the account token there.' };
+        }
+        const failure = accountFailure(state?.attempt);
+        if (failure !== undefined)
+            return { kind: 'error', text: failure };
+        await new Promise(resolve => setTimeout(resolve, 400));
+    }
+    const state = await account.getState().catch(() => undefined);
+    const id = state?.attempt?.id;
+    if (id !== undefined)
+        await account.cancelSignIn(id).catch(() => undefined);
+    return { kind: 'error', text: 'DeepSeek sign-in timed out before the browser completed. Run /login to try again.' };
+}
+async function loginDeepSeekAccount(ctx, invocation, config) {
+    const account = accountClient(ctx);
+    if (account === undefined)
+        return { kind: 'error', text: 'DeepSeek account integration is not mounted in this build.' };
+    let state;
+    try {
+        state = await account.getState();
+    }
+    catch {
+        return { kind: 'error', text: 'Could not read the shared DeepSeek account state.' };
+    }
+    if (state.status === 'credential-stored') {
+        const choice = await ctx.tui.prompt({
+            title: 'DeepSeek account',
+            question: 'The account is signed in and shared with DSH.',
+            detail: 'Use /model to select the deepseek-account route. Signing out removes the local grant; the DSH browser session is revoked in the background.',
+            options: [
+                { label: 'Use account route', value: 'use', description: 'Close this prompt; select the route in /model.' },
+                { label: 'Sign out', value: 'out', description: 'Remove the local grant and revoke it in the background.' },
+                { label: 'Cancel', value: 'cancel' },
+            ],
+            initialValue: 'use',
+            allowCustom: false,
+            notify: false,
+            signal: invocation.signal,
+        });
+        if (choice === null || choice === 'cancel' || choice === 'use') {
+            return { kind: 'success', text: 'Use /model to select the deepseek-account route.' };
+        }
+        try {
+            await account.signOut(accountClientMetadata());
+        }
+        catch {
+            return { kind: 'error', text: 'Could not sign out of the DeepSeek account. Try again from DSH Web/Desktop.' };
+        }
+        return { kind: 'success', text: 'Signed out of the DeepSeek account. The next account request requires sign-in again.' };
+    }
+    const server = ctx.get('webServer');
+    if (server === undefined || ctx.tui.interactive === false) {
+        return {
+            kind: 'error',
+            text: 'The loopback sign-in host is unavailable. Start omdsh with its normal terminal host, or sign in through DSH Web/Desktop and rerun /login.',
+        };
+    }
+    const origin = accountCallbackOrigin(ctx);
+    if (origin === undefined)
+        return { kind: 'error', text: 'The loopback sign-in host did not expose a port.' };
+    let initial;
+    try {
+        initial = await account.startSignIn(accountClientMetadata(), origin, 'web');
+    }
+    catch (error) {
+        return { kind: 'error', text: error instanceof Error ? error.message : 'Could not start DeepSeek sign-in.' };
+    }
+    const attempt = initial.attempt;
+    const failure = accountFailure(attempt);
+    if (failure !== undefined)
+        return { kind: 'error', text: failure };
+    let url = attempt?.authorizeUrl;
+    for (let i = 0; i < 40 && url === undefined; i += 1) {
+        if (invocation.signal.aborted)
+            break;
+        await new Promise(resolve => setTimeout(resolve, 100));
+        const next = await account.getState().catch(() => undefined);
+        const nextFailure = accountFailure(next?.attempt);
+        if (nextFailure !== undefined)
+            return { kind: 'error', text: nextFailure };
+        url = next?.attempt?.authorizeUrl;
+    }
+    if (url === undefined) {
+        const id = attempt?.id ?? (await account.getState().catch(() => undefined))?.attempt?.id;
+        if (id !== undefined)
+            await account.cancelSignIn(id).catch(() => undefined);
+        return { kind: 'error', text: 'DeepSeek did not return a browser URL for this sign-in attempt.' };
+    }
+    if (config.openBrowser !== false)
+        openExternal(url);
+    const answer = await ctx.tui.prompt({
+        title: 'DeepSeek account',
+        question: 'Complete sign-in in your browser, then return here.',
+        detail: `${url}
+
+This terminal is listening on ${origin}/oauth/callback until the attempt ends.`,
+        options: [
+            { label: 'I completed sign-in', value: 'done' },
+            { label: 'Cancel', value: 'cancel', description: 'Withdraw this sign-in attempt.' },
+        ],
+        initialValue: 'done',
+        allowCustom: false,
+        notify: false,
+        signal: invocation.signal,
+    });
+    if (answer !== 'done') {
+        const id = attempt?.id ?? (await account.getState().catch(() => undefined))?.attempt?.id;
+        if (id !== undefined)
+            await account.cancelSignIn(id).catch(() => undefined);
+        return { kind: 'success', text: 'DeepSeek sign-in cancelled.' };
+    }
+    return waitForAccount(invocation, account, 120_000);
+}
 async function login(ctx, invocation, config) {
     if (invocation.rawInput.trim() !== '') {
         return { kind: 'error', text: 'Usage: /login (paste the key only into the protected prompt)' };
@@ -935,6 +1165,8 @@ async function login(ctx, invocation, config) {
     const choice = await pickLoginChoice(ctx, invocation);
     if (choice === undefined)
         return { kind: 'success' };
+    if (choice === DEEPSEEK_ACCOUNT_CHOICE)
+        return loginDeepSeekAccount(ctx, invocation, config);
     if (choice === CUSTOM_PROVIDER_VALUE)
         return loginCustom(ctx, invocation);
     if (isAuthorizationFlow(choice))
@@ -949,6 +1181,8 @@ async function logout(ctx, invocation) {
     const choice = await pickLogoutChoice(ctx, invocation);
     if (choice === undefined)
         return { kind: 'success' };
+    if (choice === DEEPSEEK_ACCOUNT_CHOICE)
+        return logoutDeepSeekAccount(ctx, invocation);
     if (isFlowRecordLogout(choice))
         return logoutRecord(ctx, invocation, choice);
     return isDeepSeek(choice)
@@ -958,7 +1192,7 @@ async function logout(ctx, invocation) {
 export function apply(ctx, config = {}) {
     registerCommands(ctx, [
         { name: 'login', description: 'Sign in to a provider', handler: invocation => login(ctx, invocation, config) },
-        { name: 'logout', description: 'Sign out of a stored provider', handler: invocation => logout(ctx, invocation) },
+        { name: 'logout', description: 'Sign out of a stored provider or account', handler: invocation => logout(ctx, invocation) },
     ], 'omdsh authentication commands');
 }
 //# sourceMappingURL=auth.js.map