@agi-fans/dsh-tui 0.20.0 → 0.22.0

package/lib/commands/auth.js

@@ -2,98 +2,26 @@
 import { spawn } from 'node:child_process';
 import process from 'node:process';
 import { AuthorizationError, } from '@deepseek-ai/dsh-authorization';
-import { credentialKey, credentialKeyId, credentialKeyScope, credentialRef, isCredentialKeySegment, parseCredentialKey, } from '@deepseek-ai/dsh-credentials';
+import { credentialRef, } from '@deepseek-ai/dsh-credentials';
 import { createAuthorizationInteraction } from "../session/authorization-interaction.js";
+import { APP_VERSION } from "../session/package-metadata.js";
 import { registerCommands } from "./registration.js";
+import { authorizationFlows, catalogForRecord, catalogProvidersWithoutFlows, fallbackDeepSeekEntry, flowChoiceValue, isAccountFlow, isDeepSeek, isPiAiDeepSeekFlow, loginAuthorizationFlows, logoutableProviders, parseFlowChoice, profileApiKeyEnv, providerListId, } from "./auth-providers.js";
+import { askPrompt } from "../prompt-intents.js";
+import { CUSTOM_PROTOCOLS, CUSTOM_PROVIDER_VALUE, DEEPSEEK_API_KEYS_URL, DEEPSEEK_MODELS_URL, managedProviderCredentialRef, normalizeApiKey, normalizeDeepSeekApiKey, parseBaseURL, parseModelIds, parseProviderId, validateDeepSeekApiKey, } from "./auth-input.js";
+export { CUSTOM_PROTOCOLS, CUSTOM_PROVIDER_VALUE, DEEPSEEK_API_KEYS_URL, DEEPSEEK_MODELS_URL, managedProviderCredentialRef, normalizeApiKey, normalizeDeepSeekApiKey, parseBaseURL, parseModelIds, parseProviderId, validateDeepSeekApiKey, };
 export const name = 'omdsh-command-auth';
 export const inject = ['commands', 'credentials', 'settings', 'tui', 'llm'];
 export const DEEPSEEK_PROVIDER = 'deepseek-official';
 export const DEEPSEEK_API_KEY = credentialRef('DEEPSEEK_API_KEY');
-export const OMDSH_DEEPSEEK_API_KEY = credentialRef('OMDSH_DEEPSEEK_API_KEY');
 export const DEEPSEEK_SETTINGS = 'llm-deepseek';
 export const PI_AI_SETTINGS = 'llm-pi-ai';
-export const DEEPSEEK_API_KEYS_URL = 'https://platform.deepseek.com/api_keys';
-export const DEEPSEEK_MODELS_URL = 'https://api.deepseek.com/v1/models';
-export const CUSTOM_PROVIDER_VALUE = '__omdsh_custom__';
+/** Sentinel the provider picker returns for "sign in to the DeepSeek account". */
+export const DEEPSEEK_ACCOUNT_CHOICE = '__omdsh_deepseek_account__';
+/** Prefix a picker value carries when it names an authorization flow. */
 export const FLOW_VALUE_PREFIX = '__omdsh_flow__:';
-const PI_AI_RECORD_SCOPE = 'llm-pi-ai';
-const FULLSCREEN_CHOICE_THRESHOLD = 8;
+/** Default when the credential store has nothing to say about a provider. */
 const UNCONFIGURED = { configured: false, writable: true };
-const PROVIDER_ID = /^[a-z][a-z0-9-]*$/u;
-const CUSTOM_PROTOCOLS = ['openai-completions', 'openai-responses', 'anthropic-messages'];
-/** Match DeepSeek's own login normalization without accepting an empty Bearer value. */
-export function normalizeDeepSeekApiKey(raw) {
-    return normalizeApiKey(raw, 'DeepSeek');
-}
-/** Trim a pasted key and reject an empty Bearer value. */
-export function normalizeApiKey(raw, providerLabel) {
-    const normalized = raw.trim().replace(/^bearer\b\s*/iu, '');
-    if (normalized === '')
-        throw new Error(`Paste a non-empty ${providerLabel} API key.`);
-    return normalized;
-}
-/** omdsh-managed credential reference for one catalog provider route. */
-export function managedProviderCredentialRef(provider) {
-    return credentialRef(`OMDSH_${provider.toUpperCase().replace(/[^A-Z0-9]+/gu, '_')}_API_KEY`);
-}
-/** Lowercase kebab-case route id used as the permanent provider key. */
-export function parseProviderId(raw) {
-    const id = raw.trim().toLowerCase();
-    if (!PROVIDER_ID.test(id)) {
-        throw new Error('Provider id must start with a letter and use only lowercase letters, digits, and hyphens.');
-    }
-    if (id === 'custom' || id === CUSTOM_PROVIDER_VALUE) {
-        throw new Error('Choose a different provider id.');
-    }
-    return id;
-}
-/** Absolute http(s) prefix the adapter will call. */
-export function parseBaseURL(raw) {
-    const value = raw.trim().replace(/\/+$/u, '');
-    let parsed;
-    try {
-        parsed = new URL(value);
-    }
-    catch {
-        throw new Error('Base URL must be an absolute http or https URL.');
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-        throw new Error('Base URL must be an http or https URL.');
-    }
-    return value;
-}
-/** One or more model ids from a comma- or whitespace-separated list. */
-export function parseModelIds(raw) {
-    const ids = [...new Set(raw.split(/[,\s]+/u).map(item => item.trim()).filter(item => item !== ''))];
-    if (ids.length === 0)
-        throw new Error('Enter at least one model id.');
-    return ids;
-}
-/** Validate a candidate without ever reading or returning a response body. */
-export async function validateDeepSeekApiKey(apiKey, signal, fetchImpl = globalThis.fetch) {
-    let response;
-    try {
-        response = await fetchImpl(DEEPSEEK_MODELS_URL, {
-            method: 'GET',
-            headers: {
-                accept: 'application/json',
-                authorization: `Bearer ${apiKey}`,
-            },
-            signal,
-        });
-    }
-    catch {
-        if (signal.aborted)
-            throw new Error('DeepSeek login was cancelled.');
-        throw new Error('Could not reach DeepSeek to validate the API key. Check your network and try again.');
-    }
-    if (response.ok)
-        return;
-    if (response.status === 401 || response.status === 403) {
-        throw new Error('DeepSeek rejected this API key. Copy a valid key from the DeepSeek dashboard and try again.');
-    }
-    throw new Error(`DeepSeek could not validate the API key (HTTP ${response.status}). Try again later.`);
-}
 function credentialSource(info) {
     if (info.source === 'env')
         return 'the current process environment';
@@ -115,123 +43,24 @@ function unmanagedCredentialMessage(ref, info, action) {
                 : 'Update that source directly and restart omdsh.';
     return `${String(ref)} is supplied by ${credentialSource(info)} and /${action === 'replace' ? 'login' : 'logout'} cannot ${action} it. ${instruction}`;
 }
-function isDeepSeek(entry) {
-    return entry.provider === DEEPSEEK_PROVIDER;
-}
-function isPiAiLoginable(entry) {
-    return entry.settingsNs === 'llm-pi-ai' && entry.provider !== 'deepseek';
-}
-/** Picker labels are route ids; the official adapter keeps the DeepSeek product name. */
-export function providerListId(entry) {
-    return isDeepSeek(entry) ? 'DeepSeek' : entry.provider;
-}
-function fallbackDeepSeekEntry() {
-    return {
-        provider: DEEPSEEK_PROVIDER,
-        displayName: 'DeepSeek',
-        settingsNs: 'llm-deepseek',
-        settingsPath: [],
-    };
-}
-function loginableProviders(ctx) {
-    const listed = ctx.llm.listConfigurableProviders();
-    const loginable = listed.filter(entry => isDeepSeek(entry) || isPiAiLoginable(entry));
-    return loginable.length > 0 ? loginable : [fallbackDeepSeekEntry()];
-}
-function authorizationFlows(ctx) {
-    return ctx.get('authorization')?.list() ?? [];
-}
-function isPiAiDeepSeekFlow(flow) {
-    return credentialKeyScope(flow.key) === PI_AI_RECORD_SCOPE && credentialKeyId(flow.key) === 'deepseek';
-}
-function loginAuthorizationFlows(ctx) {
-    return authorizationFlows(ctx).flatMap(flow => {
-        if (!isPiAiDeepSeekFlow(flow))
-            return [flow];
-        const profile = walkPath(sectionValue(ctx, PI_AI_SETTINGS), ['providers', 'deepseek']);
-        if (typeof profile !== 'object' || profile === null || Array.isArray(profile))
-            return [];
-        return [{ ...flow, label: 'DeepSeek (pi-ai compatibility)' }];
-    });
-}
-function catalogAuthorizationFlow(ctx, provider) {
-    const authorization = ctx.get('authorization');
-    if (authorization === undefined || !isCredentialKeySegment(provider))
-        return undefined;
-    return authorization.describe(credentialKey(PI_AI_RECORD_SCOPE, provider));
-}
-function catalogProvidersWithoutFlows(ctx) {
-    return loginableProviders(ctx).filter(entry => isDeepSeek(entry) || catalogAuthorizationFlow(ctx, entry.provider) === undefined);
-}
-function flowChoiceValue(key) {
-    return FLOW_VALUE_PREFIX + key;
-}
-function parseFlowChoice(raw) {
-    if (!raw.startsWith(FLOW_VALUE_PREFIX))
-        return undefined;
-    try {
-        return parseCredentialKey(raw.slice(FLOW_VALUE_PREFIX.length));
-    }
-    catch {
-        return undefined;
-    }
-}
-function loginChoiceValues(entries, flows, includeCustom) {
+function loginChoiceValues(entries, flows, includeCustom, includeAccount = false) {
     return [
+        ...(includeAccount ? [DEEPSEEK_ACCOUNT_CHOICE] : []),
         ...entries.map(entry => entry.provider),
         ...flows.map(flow => flowChoiceValue(flow.key)),
         ...(includeCustom ? [CUSTOM_PROVIDER_VALUE] : []),
     ];
 }
-function sectionValue(ctx, namespace) {
-    // A provider's configured fields are the live volatile config of its own
-    // profile entry, so the roster reads the same values a form would show.
-    return ctx.settings.describe().find(row => String(row.ns) === namespace)?.value;
-}
-function walkPath(root, path) {
-    let cursor = root;
-    for (const key of path) {
-        if (typeof cursor !== 'object' || cursor === null || Array.isArray(cursor))
-            return undefined;
-        cursor = cursor[key];
-    }
-    return cursor;
-}
-function profileApiKeyEnv(ctx, entry) {
-    const profile = walkPath(sectionValue(ctx, entry.settingsNs), entry.settingsPath);
-    if (isDeepSeek(entry)) {
-        if (typeof profile !== 'object' || profile === null || Array.isArray(profile))
-            return String(DEEPSEEK_API_KEY);
-        const apiKeyEnv = profile['apiKeyEnv'];
-        return typeof apiKeyEnv === 'string' && apiKeyEnv.trim() !== '' ? apiKeyEnv : String(DEEPSEEK_API_KEY);
-    }
-    if (typeof profile !== 'object' || profile === null || Array.isArray(profile))
-        return undefined;
-    const apiKeyEnv = profile['apiKeyEnv'];
-    return typeof apiKeyEnv === 'string' && apiKeyEnv.trim() !== '' ? apiKeyEnv : undefined;
-}
-function hasStoredProfile(ctx, entry) {
-    if (isDeepSeek(entry))
-        return true;
-    const profile = walkPath(sectionValue(ctx, entry.settingsNs), entry.settingsPath);
-    return typeof profile === 'object' && profile !== null && !Array.isArray(profile);
-}
-function logoutableProviders(ctx) {
-    return loginableProviders(ctx).filter(entry => isDeepSeek(entry) || hasStoredProfile(ctx, entry));
-}
-function catalogForRecord(ctx, key) {
-    const id = credentialKeyId(key);
-    const scope = credentialKeyScope(key);
-    return loginableProviders(ctx).find(entry => entry.provider === id && entry.settingsNs === scope);
-}
-function isFlowRecordLogout(choice) {
-    return 'key' in choice && 'writable' in choice && !('provider' in choice);
+export function isFlowRecordLogout(choice) {
+    return typeof choice !== 'string' && 'key' in choice && 'writable' in choice && !('provider' in choice);
 }
 async function configuredFlowRecords(ctx) {
     const credentials = ctx.credentials;
     const rows = [];
     const claimed = new Set();
     for (const flow of authorizationFlows(ctx)) {
+        if (isAccountFlow(flow))
+            continue;
         const info = await credentials.describeRecord(flow.key);
         if (!info.configured)
             continue;
@@ -258,6 +87,9 @@ async function configuredFlowRecords(ctx) {
 async function logoutableChoices(ctx) {
     const providers = logoutableProviders(ctx);
     const records = await configuredFlowRecords(ctx);
+    const account = accountClient(ctx);
+    const accountState = account === undefined ? undefined : await account.getState().catch(() => undefined);
+    const accountChoice = accountState?.status === 'credential-stored' ? [DEEPSEEK_ACCOUNT_CHOICE] : [];
     const actionable = [];
     let inactiveDeepSeek;
     for (const entry of providers) {
@@ -266,19 +98,18 @@ async function logoutableChoices(ctx) {
             continue;
         }
         const activeRef = profileApiKeyEnv(ctx, entry) ?? String(DEEPSEEK_API_KEY);
-        const managed = activeRef === String(OMDSH_DEEPSEEK_API_KEY);
-        const current = await ctx.credentials.describe(managed ? OMDSH_DEEPSEEK_API_KEY : DEEPSEEK_API_KEY);
-        if (managed || (activeRef === String(DEEPSEEK_API_KEY) && current.source === 'file')) {
+        const current = await ctx.credentials.describe(credentialRef(activeRef));
+        if (current.configured && current.source === 'file')
             actionable.push(entry);
-        }
-        else {
+        else
             inactiveDeepSeek = entry;
-        }
     }
-    const choices = [...actionable, ...records];
+    const choices = [...accountChoice, ...actionable, ...records];
     // Preserve the direct explanatory response when the environment-owned or
     // already-logged-out official route is the only thing the command can see.
-    return choices.length === 0 && inactiveDeepSeek !== undefined ? [inactiveDeepSeek] : choices;
+    if (choices.length === 0 && inactiveDeepSeek !== undefined)
+        return [inactiveDeepSeek];
+    return choices;
 }
 function selected(raw, values) {
     const index = /^\d+$/u.test(raw) ? Number(raw) - 1 : -1;
@@ -316,15 +147,26 @@ async function pickLoginChoice(ctx, invocation) {
         return configured !== 0 ? configured : left.flow.label.localeCompare(right.flow.label);
     });
     const orderedFlows = flowRows.map(row => row.flow);
-    const values = loginChoiceValues(entries, orderedFlows, true);
-    const fullscreen = values.length > FULLSCREEN_CHOICE_THRESHOLD;
+    const account = ctx.get('deepseekAccount');
+    const accountState = account?.getState === undefined ? undefined : await account.getState().catch(() => undefined);
+    const includeAccount = account?.getState !== undefined;
+    const values = loginChoiceValues(entries, orderedFlows, true, includeAccount);
     const raw = await ctx.tui.prompt({
-        ...(fullscreen ? { presentation: 'fullscreen-list' } : {}),
-        optionLayout: 'compact',
-        filterable: fullscreen,
+        presentation: 'card',
+        filterable: true,
         title: 'Provider',
         question: 'Choose a provider to sign in or update',
         options: [
+            ...(includeAccount ? [{
+                    label: 'DeepSeek account',
+                    value: DEEPSEEK_ACCOUNT_CHOICE,
+                    description: accountState?.status === 'credential-stored'
+                        ? 'signed in · shared with DSH; choose deepseek-account in /model'
+                        : 'signed out · opens the DeepSeek browser sign-in',
+                    ...(accountState?.status === 'credential-stored'
+                        ? { badge: { label: 'signed in', tone: 'success' } }
+                        : {}),
+                }] : []),
             ...entryRows.map(({ entry, badge }) => ({
                 label: providerListId(entry),
                 value: entry.provider,
@@ -350,6 +192,7 @@ async function pickLoginChoice(ctx, invocation) {
             },
         ],
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (raw === null)
@@ -360,6 +203,8 @@ async function pickLoginChoice(ctx, invocation) {
     const chosen = selected(raw, values);
     if (chosen === undefined)
         return undefined;
+    if (chosen === DEEPSEEK_ACCOUNT_CHOICE)
+        return DEEPSEEK_ACCOUNT_CHOICE;
     const flowKey = parseFlowChoice(chosen);
     if (flowKey !== undefined)
         return orderedFlows.find(flow => flow.key === flowKey);
@@ -380,6 +225,7 @@ async function pickAuthorizationMethod(ctx, invocation, flow) {
             value: method.id,
         })),
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (raw === null)
@@ -401,7 +247,10 @@ async function loginAuthorization(ctx, invocation, flow) {
         const outcome = await authorization.begin({
             key: flow.key,
             method,
-            interaction: createAuthorizationInteraction(ctx.tui, `Login to ${flow.label}`),
+            interaction: createAuthorizationInteraction({
+                notice: message => { ctx.tui.notice(message); },
+                prompt: request => ctx.tui.prompt({ ...request, notify: false }),
+            }, `Login to ${flow.label}`),
             signal: invocation.signal,
         });
         if (outcome.status === 'cancelled')
@@ -423,48 +272,41 @@ async function loginAuthorization(ctx, invocation, flow) {
 async function resetDeepSeekCredentialRoute(ctx) {
     await ctx.settings.mutate(DEEPSEEK_SETTINGS, [{ op: 'unset', path: ['apiKeyEnv'] }]);
 }
-async function logoutSuccess(ctx, managed) {
-    const fallback = await ctx.credentials.describe(DEEPSEEK_API_KEY);
-    if (fallback.configured) {
-        return {
-            kind: 'success',
-            text: `${managed ? 'Logged out from the omdsh-managed DeepSeek credential.' : 'Logged out from DeepSeek.'} Falling back to DEEPSEEK_API_KEY from ${credentialSource(fallback)}.`,
-        };
-    }
-    return { kind: 'success', text: 'Logged out from DeepSeek.' };
-}
-/** Best-effort browser launch; the prompt always retains the full URL as a fallback. */
-export function openDeepSeekDashboard() {
+/** Best-effort browser launch; callers always retain the full URL as a fallback. */
+function openExternal(url) {
     const command = process.platform === 'darwin'
-        ? { file: 'open', args: [DEEPSEEK_API_KEYS_URL] }
+        ? { file: 'open', args: [url] }
         : process.platform === 'win32'
-            ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'start', '', DEEPSEEK_API_KEYS_URL] }
-            : { file: 'xdg-open', args: [DEEPSEEK_API_KEYS_URL] };
+            ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'start', '', url] }
+            : { file: 'xdg-open', args: [url] };
     try {
         const child = spawn(command.file, command.args, { detached: true, stdio: 'ignore' });
         child.once('error', () => undefined);
         child.unref();
     }
     catch {
-        // Headless and remote terminals still receive the visible dashboard URL.
+        // Headless and remote terminals still receive the visible URL.
     }
 }
+/** Best-effort browser launch for the DeepSeek key dashboard. */
+export function openDeepSeekDashboard() {
+    openExternal(DEEPSEEK_API_KEYS_URL);
+}
 async function loginDeepSeek(ctx, invocation, config) {
-    const current = await ctx.credentials.describe(OMDSH_DEEPSEEK_API_KEY);
+    const current = await ctx.credentials.describe(DEEPSEEK_API_KEY);
     if (current.configured && !current.writable) {
-        return { kind: 'error', text: unmanagedCredentialMessage(OMDSH_DEEPSEEK_API_KEY, current, 'replace') };
+        return { kind: 'error', text: unmanagedCredentialMessage(DEEPSEEK_API_KEY, current, 'replace') };
     }
     if (config.openDashboard !== false)
         openDeepSeekDashboard();
-    const raw = await ctx.tui.prompt({
+    const raw = await ctx.tui.prompt(askPrompt({
         title: 'Login to DeepSeek',
         question: current.configured ? 'Paste a new DeepSeek API key' : 'Paste your DeepSeek API key',
-        detail: `Create or copy a key at ${DEEPSEEK_API_KEYS_URL}. It will be validated, stored locally, and preferred over DEEPSEEK_API_KEY.`,
-        allowCustom: true,
+        detail: `Create or copy a key at ${DEEPSEEK_API_KEYS_URL}. It will be validated and stored locally as ${DEEPSEEK_API_KEY}.`,
         secret: true,
         submitLabel: 'validate',
         signal: invocation.signal,
-    });
+    }));
     if (raw === null)
         return { kind: 'success' };
     let apiKey;
@@ -478,23 +320,27 @@ async function loginDeepSeek(ctx, invocation, config) {
         return { kind: 'error', text: error instanceof Error ? error.message : 'DeepSeek login failed.' };
     }
     try {
-        await ctx.credentials.set(OMDSH_DEEPSEEK_API_KEY, apiKey);
+        await ctx.credentials.set(DEEPSEEK_API_KEY, apiKey);
     }
     catch {
         return { kind: 'error', text: 'The API key is valid, but it could not be saved to the Harness credential store.' };
     }
-    try {
-        await ctx.settings.update(DEEPSEEK_SETTINGS, { apiKeyEnv: String(OMDSH_DEEPSEEK_API_KEY) });
-    }
-    catch {
-        return {
-            kind: 'error',
-            text: 'The API key is valid and saved, but omdsh could not activate it for the DeepSeek provider. Run /login again after checking your settings file.',
-        };
+    // A profile may still pin the old product-owned reference. Reset it so the
+    // upstream default resolves the key that was just stored.
+    if (profileApiKeyEnv(ctx, fallbackDeepSeekEntry()) !== String(DEEPSEEK_API_KEY)) {
+        try {
+            await resetDeepSeekCredentialRoute(ctx);
+        }
+        catch {
+            return {
+                kind: 'error',
+                text: 'The API key is valid and saved, but the DeepSeek credential reference could not be reset. Run /login again after checking your settings file.',
+            };
+        }
     }
     return {
         kind: 'success',
-        text: 'Logged in to DeepSeek. Your omdsh credential takes priority on the next model request.',
+        text: 'Logged in to DeepSeek. The stored key is used by the deepseek-official route on the next model request.',
     };
 }
 async function loginCatalog(ctx, invocation, entry) {
@@ -504,15 +350,14 @@ async function loginCatalog(ctx, invocation, entry) {
         return { kind: 'error', text: unmanagedCredentialMessage(ref, current, 'replace') };
     }
     const label = entry.displayName;
-    const raw = await ctx.tui.prompt({
+    const raw = await ctx.tui.prompt(askPrompt({
         title: `Login to ${label}`,
         question: current.configured ? `Paste a new ${label} API key` : `Paste your ${label} API key`,
         detail: `The key is stored locally and activates the ${entry.provider} route for the next model request. Use /model to select it.`,
-        allowCustom: true,
         secret: true,
         submitLabel: 'save',
         signal: invocation.signal,
-    });
+    }));
     if (raw === null)
         return { kind: 'success' };
     let apiKey;
@@ -563,6 +408,7 @@ async function collectCustomModels(ctx, invocation, draft) {
         ],
         initialValue: 'enter',
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (source === null)
@@ -587,8 +433,9 @@ async function collectCustomModels(ctx, invocation, draft) {
                     })),
                     multiSelect: true,
                     allowCustom: false,
-                    filterable: discovered.length > FULLSCREEN_CHOICE_THRESHOLD,
-                    ...(discovered.length > FULLSCREEN_CHOICE_THRESHOLD ? { presentation: 'fullscreen-list' } : {}),
+                    notify: false,
+                    filterable: true,
+                    presentation: 'card',
                     signal: invocation.signal,
                 });
                 if (picked === null)
@@ -600,37 +447,34 @@ async function collectCustomModels(ctx, invocation, draft) {
             if (invocation.signal.aborted)
                 return undefined;
             const detail = error instanceof Error ? error.message : 'the endpoint did not list models';
-            const fallback = await ctx.tui.prompt({
+            const fallback = await ctx.tui.prompt(askPrompt({
                 title: 'Custom models',
                 question: 'Enter model ids',
                 detail: `Could not fetch models (${detail}). Type one or more ids, separated by commas.`,
-                allowCustom: true,
                 signal: invocation.signal,
-            });
+            }));
             if (fallback === null)
                 return undefined;
             return parseModelIds(fallback);
         }
     }
-    const typed = await ctx.tui.prompt({
+    const typed = await ctx.tui.prompt(askPrompt({
         title: 'Custom models',
         question: 'Enter model ids',
         detail: 'Separate multiple ids with commas. Example: llama3.1, qwen2.5-coder',
-        allowCustom: true,
         signal: invocation.signal,
-    });
+    }));
     if (typed === null)
         return undefined;
     return parseModelIds(typed);
 }
 async function loginCustom(ctx, invocation) {
-    const idRaw = await ctx.tui.prompt({
+    const idRaw = await ctx.tui.prompt(askPrompt({
         title: 'Custom provider',
         question: 'Provider id',
         detail: 'Lowercase letters, digits, and hyphens. This id is permanent.',
-        allowCustom: true,
         signal: invocation.signal,
-    });
+    }));
     if (idRaw === null)
         return { kind: 'success' };
     let id;
@@ -643,13 +487,12 @@ async function loginCustom(ctx, invocation) {
     if (reservedProviderIds(ctx).has(id)) {
         return { kind: 'error', text: `${id} is a catalog provider. Use /login and choose it from the list.` };
     }
-    const urlRaw = await ctx.tui.prompt({
+    const urlRaw = await ctx.tui.prompt(askPrompt({
         title: 'Custom provider',
         question: 'Base URL',
         detail: 'Absolute http(s) prefix, for example http://127.0.0.1:11434/v1',
-        allowCustom: true,
         signal: invocation.signal,
-    });
+    }));
     if (urlRaw === null)
         return { kind: 'success' };
     let baseURL;
@@ -671,6 +514,7 @@ async function loginCustom(ctx, invocation) {
         })),
         initialValue: 'openai-completions',
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (api === null)
@@ -678,15 +522,14 @@ async function loginCustom(ctx, invocation) {
     if (!CUSTOM_PROTOCOLS.includes(api)) {
         return { kind: 'error', text: `Unknown API protocol: ${api}` };
     }
-    const keyRaw = await ctx.tui.prompt({
+    const keyRaw = await ctx.tui.prompt(askPrompt({
         title: `Login to ${id}`,
         question: `Paste your ${id} API key`,
         detail: 'Leave empty if the endpoint does not need a key.',
-        allowCustom: true,
         secret: true,
         submitLabel: 'continue',
         signal: invocation.signal,
-    });
+    }));
     if (keyRaw === null)
         return { kind: 'success' };
     let apiKey;
@@ -752,60 +595,88 @@ async function loginCustom(ctx, invocation) {
 }
 async function logoutDeepSeek(ctx, invocation) {
     const activeRef = profileApiKeyEnv(ctx, fallbackDeepSeekEntry()) ?? String(DEEPSEEK_API_KEY);
-    const usesOmdshCredential = activeRef === String(OMDSH_DEEPSEEK_API_KEY);
-    const activeCredential = usesOmdshCredential ? OMDSH_DEEPSEEK_API_KEY : DEEPSEEK_API_KEY;
-    const current = await ctx.credentials.describe(activeCredential);
-    const legacyManagedDefault = activeRef === String(DEEPSEEK_API_KEY) && current.source === 'file';
-    if (!usesOmdshCredential && !legacyManagedDefault) {
-        if (!current.configured)
-            return { kind: 'success', text: 'DeepSeek is already logged out.' };
-        return {
-            kind: 'success',
-            text: `No omdsh-managed DeepSeek login is active. DeepSeek is configured by ${credentialSource(current)}.`,
-        };
-    }
-    if (usesOmdshCredential && !current.configured) {
-        try {
-            await resetDeepSeekCredentialRoute(ctx);
-        }
-        catch {
-            return { kind: 'error', text: 'Could not reset the DeepSeek credential setting.' };
+    const current = await ctx.credentials.describe(credentialRef(activeRef));
+    if (!current.configured) {
+        if (activeRef !== String(DEEPSEEK_API_KEY)) {
+            try {
+                await resetDeepSeekCredentialRoute(ctx);
+            }
+            catch {
+                return { kind: 'error', text: 'Could not reset the DeepSeek credential setting.' };
+            }
         }
-        return logoutSuccess(ctx, true);
+        return { kind: 'success', text: 'DeepSeek is already logged out.' };
+    }
+    if (current.source !== 'file') {
+        return { kind: 'success', text: `DeepSeek is configured by ${credentialSource(current)}; the credential store cannot remove it.` };
     }
-    const removesStoredKey = current.source === 'file';
     const answer = await ctx.tui.prompt({
         title: 'Logout from DeepSeek',
-        question: removesStoredKey ? 'Remove the stored DeepSeek API key?' : 'Stop using the omdsh DeepSeek credential?',
-        detail: 'The next model request will fall back to DEEPSEEK_API_KEY when one is available.',
+        question: 'Remove the stored DeepSeek API key?',
+        detail: 'The next model request will use DEEPSEEK_API_KEY from the launch environment when one is available.',
         options: [
             { label: 'Cancel', value: 'cancel', description: 'Keep the current credential.' },
             {
                 label: 'Log out',
                 value: 'logout',
-                description: removesStoredKey
-                    ? 'Remove the key from the local Harness credential store.'
-                    : 'Return the provider to its default credential source.',
+                description: 'Remove the key from the local Harness credential store.',
                 badge: { label: 'removes credential', tone: 'warning' },
             },
         ],
         initialValue: 'cancel',
         allowCustom: false,
+        notify: false,
         submitLabel: 'apply',
         signal: invocation.signal,
     });
     if (answer !== 'logout')
         return { kind: 'success' };
     try {
-        if (usesOmdshCredential)
+        await ctx.credentials.unset(credentialRef(activeRef));
+        if (activeRef !== String(DEEPSEEK_API_KEY))
             await resetDeepSeekCredentialRoute(ctx);
-        if (removesStoredKey)
-            await ctx.credentials.unset(activeCredential);
     }
     catch {
         return { kind: 'error', text: 'Could not remove the DeepSeek API key from the Harness credential store.' };
     }
-    return logoutSuccess(ctx, usesOmdshCredential);
+    return { kind: 'success', text: 'Logged out from DeepSeek. The next model request falls back to the environment when available.' };
+}
+async function logoutDeepSeekAccount(ctx, invocation) {
+    const account = accountClient(ctx);
+    if (account === undefined)
+        return { kind: 'error', text: 'DeepSeek account integration is not mounted in this build.' };
+    let state;
+    try {
+        state = await account.getState();
+    }
+    catch {
+        return { kind: 'error', text: 'Could not read the shared DeepSeek account state.' };
+    }
+    if (state.status !== 'credential-stored') {
+        return { kind: 'success', text: 'No DeepSeek account grant is stored.' };
+    }
+    const answer = await ctx.tui.prompt({
+        title: 'Logout from DeepSeek account',
+        question: 'Sign out of the shared DeepSeek account?',
+        detail: 'Removes the local grant and revokes it in the background. The browser session is not signed out.',
+        options: [
+            { label: 'Cancel', value: 'cancel', description: 'Keep the account grant.' },
+            { label: 'Sign out', value: 'logout', description: 'Remove the local grant and revoke it in the background.' },
+        ],
+        initialValue: 'cancel',
+        allowCustom: false,
+        notify: false,
+        signal: invocation.signal,
+    });
+    if (answer !== 'logout')
+        return { kind: 'success' };
+    try {
+        await account.signOut(accountClientMetadata());
+    }
+    catch {
+        return { kind: 'error', text: 'Could not sign out of the DeepSeek account. Try again from DSH Web/Desktop.' };
+    }
+    return { kind: 'success', text: 'Signed out of the DeepSeek account. The local grant was removed; remote revocation continues in the background.' };
 }
 async function pickLogoutChoice(ctx, invocation) {
     const choices = await logoutableChoices(ctx);
@@ -813,26 +684,33 @@ async function pickLogoutChoice(ctx, invocation) {
         return undefined;
     if (choices.length === 1)
         return choices[0];
-    const values = choices.map(choice => isFlowRecordLogout(choice) ? flowChoiceValue(choice.key) : choice.provider);
-    const fullscreen = values.length > FULLSCREEN_CHOICE_THRESHOLD;
+    const values = choices.map(choice => choice === DEEPSEEK_ACCOUNT_CHOICE
+        ? DEEPSEEK_ACCOUNT_CHOICE
+        : isFlowRecordLogout(choice) ? flowChoiceValue(choice.key) : choice.provider);
     const raw = await ctx.tui.prompt({
-        ...(fullscreen ? { presentation: 'fullscreen-list' } : {}),
-        optionLayout: 'compact',
-        filterable: fullscreen,
+        presentation: 'card',
+        filterable: true,
         title: 'Provider',
         question: 'Choose a provider to log out from',
-        options: choices.map(choice => isFlowRecordLogout(choice)
+        options: choices.map(choice => choice === DEEPSEEK_ACCOUNT_CHOICE
             ? {
-                label: choice.label,
-                value: flowChoiceValue(choice.key),
-                description: choice.writable ? 'signed in' : 'not removable here',
+                label: 'DeepSeek account',
+                value: DEEPSEEK_ACCOUNT_CHOICE,
+                description: 'shared with DSH · signed in',
             }
-            : {
-                label: providerListId(choice),
-                value: choice.provider,
-                description: 'signed in',
-            }),
+            : isFlowRecordLogout(choice)
+                ? {
+                    label: choice.label,
+                    value: flowChoiceValue(choice.key),
+                    description: choice.writable ? 'signed in' : 'not removable here',
+                }
+                : {
+                    label: providerListId(choice),
+                    value: choice.provider,
+                    description: 'signed in',
+                }),
         allowCustom: false,
+        notify: false,
         signal: invocation.signal,
     });
     if (raw === null)
@@ -840,10 +718,12 @@ async function pickLogoutChoice(ctx, invocation) {
     const chosen = selected(raw, values);
     if (chosen === undefined)
         return undefined;
+    if (chosen === DEEPSEEK_ACCOUNT_CHOICE)
+        return DEEPSEEK_ACCOUNT_CHOICE;
     const flowKey = parseFlowChoice(chosen);
     if (flowKey !== undefined)
         return choices.find(choice => isFlowRecordLogout(choice) && choice.key === flowKey);
-    return choices.find(choice => !isFlowRecordLogout(choice) && choice.provider === chosen);
+    return choices.find(choice => typeof choice !== 'string' && !isFlowRecordLogout(choice) && choice.provider === chosen);
 }
 async function logoutRecord(ctx, invocation, record) {
     if (!record.writable) {
@@ -867,6 +747,7 @@ async function logoutRecord(ctx, invocation, record) {
         ],
         initialValue: 'cancel',
         allowCustom: false,
+        notify: false,
         submitLabel: 'apply',
         signal: invocation.signal,
     });
@@ -911,6 +792,7 @@ async function logoutCatalog(ctx, invocation, entry) {
         ],
         initialValue: 'cancel',
         allowCustom: false,
+        notify: false,
         submitLabel: 'apply',
         signal: invocation.signal,
     });
@@ -928,6 +810,156 @@ async function logoutCatalog(ctx, invocation, entry) {
     }
     return { kind: 'success', text: `Logged out from ${label}.` };
 }
+function accountClient(ctx) {
+    return ctx.get('deepseekAccount');
+}
+function accountClientMetadata() {
+    return {
+        version: APP_VERSION,
+        locale: Intl.DateTimeFormat().resolvedOptions().locale,
+        timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60,
+    };
+}
+function accountCallbackOrigin(ctx) {
+    const server = ctx.get('webServer');
+    if (server === undefined || typeof server.port !== 'number' || server.port === 0)
+        return undefined;
+    return `${server.protocol}//${server.host}:${server.port}`;
+}
+function accountFailure(attempt) {
+    if (attempt?.phase === 'expired')
+        return 'The DeepSeek sign-in expired. Run /login to try again.';
+    if (attempt?.phase === 'failed')
+        return `DeepSeek sign-in failed${attempt.errorCode === undefined ? '' : ` (${attempt.errorCode})`}. Run /login to try again.`;
+    if (attempt?.phase === 'cancelled')
+        return 'DeepSeek sign-in was cancelled.';
+    return undefined;
+}
+async function waitForAccount(invocation, account, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (invocation.signal.aborted) {
+            const state = await account.getState().catch(() => undefined);
+            const id = state?.attempt?.id;
+            if (id !== undefined)
+                await account.cancelSignIn(id).catch(() => undefined);
+            return { kind: 'success' };
+        }
+        const state = await account.getState().catch(() => undefined);
+        if (state?.status === 'credential-stored' && state.attempt?.phase === 'succeeded') {
+            return { kind: 'success', text: 'Signed in to the DeepSeek account. Use /model to select the deepseek-account route; web search and fetch use the account token there.' };
+        }
+        const failure = accountFailure(state?.attempt);
+        if (failure !== undefined)
+            return { kind: 'error', text: failure };
+        await new Promise(resolve => setTimeout(resolve, 400));
+    }
+    const state = await account.getState().catch(() => undefined);
+    const id = state?.attempt?.id;
+    if (id !== undefined)
+        await account.cancelSignIn(id).catch(() => undefined);
+    return { kind: 'error', text: 'DeepSeek sign-in timed out before the browser completed. Run /login to try again.' };
+}
+async function loginDeepSeekAccount(ctx, invocation, config) {
+    const account = accountClient(ctx);
+    if (account === undefined)
+        return { kind: 'error', text: 'DeepSeek account integration is not mounted in this build.' };
+    let state;
+    try {
+        state = await account.getState();
+    }
+    catch {
+        return { kind: 'error', text: 'Could not read the shared DeepSeek account state.' };
+    }
+    if (state.status === 'credential-stored') {
+        const choice = await ctx.tui.prompt({
+            title: 'DeepSeek account',
+            question: 'The account is signed in and shared with DSH.',
+            detail: 'Use /model to select the deepseek-account route. Signing out removes the local grant; the DSH browser session is revoked in the background.',
+            options: [
+                { label: 'Use account route', value: 'use', description: 'Close this prompt; select the route in /model.' },
+                { label: 'Sign out', value: 'out', description: 'Remove the local grant and revoke it in the background.' },
+                { label: 'Cancel', value: 'cancel' },
+            ],
+            initialValue: 'use',
+            allowCustom: false,
+            notify: false,
+            signal: invocation.signal,
+        });
+        if (choice === null || choice === 'cancel' || choice === 'use') {
+            return { kind: 'success', text: 'Use /model to select the deepseek-account route.' };
+        }
+        try {
+            await account.signOut(accountClientMetadata());
+        }
+        catch {
+            return { kind: 'error', text: 'Could not sign out of the DeepSeek account. Try again from DSH Web/Desktop.' };
+        }
+        return { kind: 'success', text: 'Signed out of the DeepSeek account. The next account request requires sign-in again.' };
+    }
+    const server = ctx.get('webServer');
+    if (server === undefined || ctx.tui.interactive === false) {
+        return {
+            kind: 'error',
+            text: 'The loopback sign-in host is unavailable. Start omdsh with its normal terminal host, or sign in through DSH Web/Desktop and rerun /login.',
+        };
+    }
+    const origin = accountCallbackOrigin(ctx);
+    if (origin === undefined)
+        return { kind: 'error', text: 'The loopback sign-in host did not expose a port.' };
+    let initial;
+    try {
+        initial = await account.startSignIn(accountClientMetadata(), origin, 'web');
+    }
+    catch (error) {
+        return { kind: 'error', text: error instanceof Error ? error.message : 'Could not start DeepSeek sign-in.' };
+    }
+    const attempt = initial.attempt;
+    const failure = accountFailure(attempt);
+    if (failure !== undefined)
+        return { kind: 'error', text: failure };
+    let url = attempt?.authorizeUrl;
+    for (let i = 0; i < 40 && url === undefined; i += 1) {
+        if (invocation.signal.aborted)
+            break;
+        await new Promise(resolve => setTimeout(resolve, 100));
+        const next = await account.getState().catch(() => undefined);
+        const nextFailure = accountFailure(next?.attempt);
+        if (nextFailure !== undefined)
+            return { kind: 'error', text: nextFailure };
+        url = next?.attempt?.authorizeUrl;
+    }
+    if (url === undefined) {
+        const id = attempt?.id ?? (await account.getState().catch(() => undefined))?.attempt?.id;
+        if (id !== undefined)
+            await account.cancelSignIn(id).catch(() => undefined);
+        return { kind: 'error', text: 'DeepSeek did not return a browser URL for this sign-in attempt.' };
+    }
+    if (config.openBrowser !== false)
+        openExternal(url);
+    const answer = await ctx.tui.prompt({
+        title: 'DeepSeek account',
+        question: 'Complete sign-in in your browser, then return here.',
+        detail: `${url}
+
+This terminal is listening on ${origin}/oauth/callback until the attempt ends.`,
+        options: [
+            { label: 'I completed sign-in', value: 'done' },
+            { label: 'Cancel', value: 'cancel', description: 'Withdraw this sign-in attempt.' },
+        ],
+        initialValue: 'done',
+        allowCustom: false,
+        notify: false,
+        signal: invocation.signal,
+    });
+    if (answer !== 'done') {
+        const id = attempt?.id ?? (await account.getState().catch(() => undefined))?.attempt?.id;
+        if (id !== undefined)
+            await account.cancelSignIn(id).catch(() => undefined);
+        return { kind: 'success', text: 'DeepSeek sign-in cancelled.' };
+    }
+    return waitForAccount(invocation, account, 120_000);
+}
 async function login(ctx, invocation, config) {
     if (invocation.rawInput.trim() !== '') {
         return { kind: 'error', text: 'Usage: /login (paste the key only into the protected prompt)' };
@@ -935,6 +967,8 @@ async function login(ctx, invocation, config) {
     const choice = await pickLoginChoice(ctx, invocation);
     if (choice === undefined)
         return { kind: 'success' };
+    if (choice === DEEPSEEK_ACCOUNT_CHOICE)
+        return loginDeepSeekAccount(ctx, invocation, config);
     if (choice === CUSTOM_PROVIDER_VALUE)
         return loginCustom(ctx, invocation);
     if (isAuthorizationFlow(choice))
@@ -949,6 +983,8 @@ async function logout(ctx, invocation) {
     const choice = await pickLogoutChoice(ctx, invocation);
     if (choice === undefined)
         return { kind: 'success' };
+    if (choice === DEEPSEEK_ACCOUNT_CHOICE)
+        return logoutDeepSeekAccount(ctx, invocation);
     if (isFlowRecordLogout(choice))
         return logoutRecord(ctx, invocation, choice);
     return isDeepSeek(choice)
@@ -957,8 +993,19 @@ async function logout(ctx, invocation) {
 }
 export function apply(ctx, config = {}) {
     registerCommands(ctx, [
-        { name: 'login', description: 'Sign in to a provider', handler: invocation => login(ctx, invocation, config) },
-        { name: 'logout', description: 'Sign out of a stored provider', handler: invocation => logout(ctx, invocation) },
+        {
+            name: 'login',
+            description: 'Sign in to a provider',
+            handler: invocation => login(ctx, invocation, config),
+        },
+        {
+            // Its own command: signing in and signing out are two intentions, and
+            // folding the second into `/login logout` made the reader look for a verb
+            // about leaving inside the one about entering.
+            name: 'logout',
+            description: 'Sign out of a stored provider or account',
+            handler: invocation => logout(ctx, invocation),
+        },
     ], 'omdsh authentication commands');
 }
 //# sourceMappingURL=auth.js.map