@agi-fans/dsh-tui 0.22.0 → 0.23.0

package/lib/commands/auth.js

@@ -1,10 +1,12 @@
 /** Interactive credential commands backed by the Harness credential and settings seams. */
-import { spawn } from 'node:child_process';
-import process from 'node:process';
 import { AuthorizationError, } from '@deepseek-ai/dsh-authorization';
 import { credentialRef, } from '@deepseek-ai/dsh-credentials';
+import { resolveUiLanguage, uiText } from "../locale/index.js";
+import { createPromptBrowser } from "../runtime/prompt-browser.js";
 import { createAuthorizationInteraction } from "../session/authorization-interaction.js";
-import { APP_VERSION } from "../session/package-metadata.js";
+import { logoutDeepSeekAccount } from "./auth-account.js";
+import { openExternal } from "./open-external.js";
+import { openAccountSettings, bindAccountNotices } from "../runtime/account-settings.js";
 import { registerCommands } from "./registration.js";
 import { authorizationFlows, catalogForRecord, catalogProvidersWithoutFlows, fallbackDeepSeekEntry, flowChoiceValue, isAccountFlow, isDeepSeek, isPiAiDeepSeekFlow, loginAuthorizationFlows, logoutableProviders, parseFlowChoice, profileApiKeyEnv, providerListId, } from "./auth-providers.js";
 import { askPrompt } from "../prompt-intents.js";
@@ -87,7 +89,7 @@ async function configuredFlowRecords(ctx) {
 async function logoutableChoices(ctx) {
     const providers = logoutableProviders(ctx);
     const records = await configuredFlowRecords(ctx);
-    const account = accountClient(ctx);
+    const account = ctx.get('deepseekAccount');
     const accountState = account === undefined ? undefined : await account.getState().catch(() => undefined);
     const accountChoice = accountState?.status === 'credential-stored' ? [DEEPSEEK_ACCOUNT_CHOICE] : [];
     const actionable = [];
@@ -128,11 +130,9 @@ function credentialOwnershipBadge(info) {
         return { label: 'environment', tone: 'muted' };
     return { label: 'configured externally', tone: 'muted' };
 }
-async function pickLoginChoice(ctx, invocation) {
+async function pickLoginChoice(ctx, invocation, prompt) {
     const entries = catalogProvidersWithoutFlows(ctx);
     const flows = loginAuthorizationFlows(ctx);
-    if (entries.length === 0 && flows.length === 0)
-        return CUSTOM_PROVIDER_VALUE;
     const entryRows = await Promise.all(entries.map(async (entry) => {
         const ref = profileApiKeyEnv(ctx, entry);
         const info = ref === undefined ? UNCONFIGURED : await ctx.credentials.describe(credentialRef(ref));
@@ -151,7 +151,7 @@ async function pickLoginChoice(ctx, invocation) {
     const accountState = account?.getState === undefined ? undefined : await account.getState().catch(() => undefined);
     const includeAccount = account?.getState !== undefined;
     const values = loginChoiceValues(entries, orderedFlows, true, includeAccount);
-    const raw = await ctx.tui.prompt({
+    const raw = await prompt({ localize: true,
         presentation: 'card',
         filterable: true,
         title: 'Provider',
@@ -193,8 +193,7 @@ async function pickLoginChoice(ctx, invocation) {
         ],
         allowCustom: false,
         notify: false,
-        signal: invocation.signal,
-    });
+        signal: invocation.signal, });
     if (raw === null)
         return undefined;
     if (raw.trim().toLowerCase() === 'custom' || selected(raw, values) === CUSTOM_PROVIDER_VALUE) {
@@ -217,7 +216,7 @@ async function pickAuthorizationMethod(ctx, invocation, flow) {
     if (flow.methods.length === 1)
         return flow.methods[0]?.id;
     const values = flow.methods.map(method => method.id);
-    const raw = await ctx.tui.prompt({
+    const raw = await ctx.tui.prompt({ localize: true,
         title: `Login to ${flow.label}`,
         question: 'Choose a sign-in method',
         options: flow.methods.map(method => ({
@@ -272,59 +271,62 @@ async function loginAuthorization(ctx, invocation, flow) {
 async function resetDeepSeekCredentialRoute(ctx) {
     await ctx.settings.mutate(DEEPSEEK_SETTINGS, [{ op: 'unset', path: ['apiKeyEnv'] }]);
 }
-/** Best-effort browser launch; callers always retain the full URL as a fallback. */
-function openExternal(url) {
-    const command = process.platform === 'darwin'
-        ? { file: 'open', args: [url] }
-        : process.platform === 'win32'
-            ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'start', '', url] }
-            : { file: 'xdg-open', args: [url] };
-    try {
-        const child = spawn(command.file, command.args, { detached: true, stdio: 'ignore' });
-        child.once('error', () => undefined);
-        child.unref();
-    }
-    catch {
-        // Headless and remote terminals still receive the visible URL.
-    }
-}
 /** Best-effort browser launch for the DeepSeek key dashboard. */
 export function openDeepSeekDashboard() {
     openExternal(DEEPSEEK_API_KEYS_URL);
 }
-async function loginDeepSeek(ctx, invocation, config) {
+async function loginDeepSeek(ctx, invocation, config, prompt) {
     const current = await ctx.credentials.describe(DEEPSEEK_API_KEY);
     if (current.configured && !current.writable) {
         return { kind: 'error', text: unmanagedCredentialMessage(DEEPSEEK_API_KEY, current, 'replace') };
     }
     if (config.openDashboard !== false)
         openDeepSeekDashboard();
-    const raw = await ctx.tui.prompt(askPrompt({
-        title: 'Login to DeepSeek',
-        question: current.configured ? 'Paste a new DeepSeek API key' : 'Paste your DeepSeek API key',
-        detail: `Create or copy a key at ${DEEPSEEK_API_KEYS_URL}. It will be validated and stored locally as ${DEEPSEEK_API_KEY}.`,
-        secret: true,
-        submitLabel: 'validate',
-        signal: invocation.signal,
-    }));
-    if (raw === null)
-        return { kind: 'success' };
-    let apiKey;
-    try {
-        apiKey = normalizeDeepSeekApiKey(raw);
-        await validateDeepSeekApiKey(apiKey, invocation.signal);
-    }
-    catch (error) {
-        if (invocation.signal.aborted)
+    let stored = false;
+    while (!invocation.signal.aborted && !stored) {
+        const apiKey = await readLoginField(prompt, askPrompt({ localize: ['title', 'question', 'actions'],
+            title: 'Login to DeepSeek',
+            question: current.configured ? 'Paste a new DeepSeek API key' : 'Paste your DeepSeek API key',
+            detail: `Create or copy a key at ${DEEPSEEK_API_KEYS_URL}. It will be validated and stored locally as ${DEEPSEEK_API_KEY}.`,
+            secret: true, submitLabel: 'validate', signal: invocation.signal,
+        }), normalizeDeepSeekApiKey);
+        if (apiKey === null)
             return { kind: 'success' };
-        return { kind: 'error', text: error instanceof Error ? error.message : 'DeepSeek login failed.' };
-    }
-    try {
-        await ctx.credentials.set(DEEPSEEK_API_KEY, apiKey);
-    }
-    catch {
-        return { kind: 'error', text: 'The API key is valid, but it could not be saved to the Harness credential store.' };
+        let validated = false;
+        while (!invocation.signal.aborted) {
+            try {
+                if (!validated)
+                    await validateDeepSeekApiKey(apiKey, invocation.signal);
+                validated = true;
+                invocation.signal.throwIfAborted();
+                await ctx.credentials.set(DEEPSEEK_API_KEY, apiKey);
+                stored = true;
+                break;
+            }
+            catch (error) {
+                if (invocation.signal.aborted)
+                    return { kind: 'success' };
+                const diagnostic = validated
+                    ? 'The API key is valid, but it could not be saved to the Harness credential store.'
+                    : error instanceof Error ? error.message : 'DeepSeek login failed.';
+                const action = await prompt({ localize: ['title', 'question', 'options'],
+                    title: 'Login to DeepSeek', question: validated ? 'Could not save the key' : 'Could not validate the key',
+                    detail: diagnostic, allowCustom: false, notify: false, signal: invocation.signal,
+                    options: [
+                        { label: validated ? 'Retry saving' : 'Retry validation', value: 'retry' },
+                        { label: 'Enter another key', value: 'edit' },
+                        { label: 'Back', value: 'back' },
+                    ],
+                });
+                if (action === null || action === 'back')
+                    return { kind: 'success' };
+                if (action !== 'retry')
+                    break;
+            }
+        }
     }
+    if (invocation.signal.aborted)
+        return { kind: 'success' };
     // A profile may still pin the old product-owned reference. Reset it so the
     // upstream default resolves the key that was just stored.
     if (profileApiKeyEnv(ctx, fallbackDeepSeekEntry()) !== String(DEEPSEEK_API_KEY)) {
@@ -343,30 +345,23 @@ async function loginDeepSeek(ctx, invocation, config) {
         text: 'Logged in to DeepSeek. The stored key is used by the deepseek-official route on the next model request.',
     };
 }
-async function loginCatalog(ctx, invocation, entry) {
+async function loginCatalog(ctx, invocation, entry, prompt) {
     const ref = managedProviderCredentialRef(entry.provider);
     const current = await ctx.credentials.describe(ref);
     if (current.configured && !current.writable) {
         return { kind: 'error', text: unmanagedCredentialMessage(ref, current, 'replace') };
     }
     const label = entry.displayName;
-    const raw = await ctx.tui.prompt(askPrompt({
+    const apiKey = await readLoginField(prompt, askPrompt({ localize: ['title', 'question', 'actions'],
         title: `Login to ${label}`,
         question: current.configured ? `Paste a new ${label} API key` : `Paste your ${label} API key`,
         detail: `The key is stored locally and activates the ${entry.provider} route for the next model request. Use /model to select it.`,
         secret: true,
         submitLabel: 'save',
         signal: invocation.signal,
-    }));
-    if (raw === null)
+    }), value => normalizeApiKey(value, label));
+    if (apiKey === null)
         return { kind: 'success' };
-    let apiKey;
-    try {
-        apiKey = normalizeApiKey(raw, label);
-    }
-    catch (error) {
-        return { kind: 'error', text: error instanceof Error ? error.message : `${label} login failed.` };
-    }
     try {
         await ctx.credentials.set(ref, apiKey);
     }
@@ -398,168 +393,163 @@ function reservedProviderIds(ctx) {
             .map(entry => entry.provider),
     ]);
 }
-async function collectCustomModels(ctx, invocation, draft) {
-    const source = await ctx.tui.prompt({
-        title: 'Custom models',
-        question: 'How should omdsh learn the model ids?',
-        options: [
-            { label: 'Enter model ids', value: 'enter', description: 'Type one or more ids, separated by commas.' },
-            { label: 'Fetch from endpoint', value: 'fetch', description: 'Ask the base URL for GET /models.' },
-        ],
-        initialValue: 'enter',
-        allowCustom: false,
-        notify: false,
-        signal: invocation.signal,
-    });
-    if (source === null)
-        return undefined;
-    if (source === 'fetch') {
+/** Retry a field in place, keeping only non-secret text in its editor. */
+async function readLoginField(prompt, request, validate) {
+    let input = request.initialInput ?? '', diagnostic = '';
+    while (!request.signal?.aborted) {
+        const raw = await prompt({ ...request,
+            ...(request.secret ? {} : { initialInput: input }),
+            detail: [diagnostic, request.detail].filter(Boolean).join('\n\n'),
+        });
+        if (raw === null || request.signal?.aborted)
+            return null;
+        if (!request.secret)
+            input = raw;
         try {
-            const discovered = await ctx.llm.discoverModels('llm-pi-ai', {
-                baseURL: draft.baseURL,
-                api: draft.api,
-                ...(draft.apiKey === undefined ? {} : { apiKey: draft.apiKey }),
-            }, invocation.signal);
-            if (discovered.length === 1)
-                return [discovered[0]?.id ?? ''];
-            if (discovered.length > 1) {
-                const picked = await ctx.tui.prompt({
-                    title: 'Custom models',
-                    question: 'Choose models to enable',
-                    options: discovered.map(model => ({
-                        label: model.id,
-                        value: model.id,
-                        ...(model.name === undefined || model.name === model.id ? {} : { description: model.name }),
-                    })),
-                    multiSelect: true,
-                    allowCustom: false,
-                    notify: false,
-                    filterable: true,
-                    presentation: 'card',
-                    signal: invocation.signal,
+            return await validate(raw);
+        }
+        catch (error) {
+            diagnostic = error instanceof Error ? error.message : 'Invalid value.';
+        }
+    }
+    return null;
+}
+async function collectCustomModels(ctx, invocation, draft, prompt) {
+    let diagnostic = '', typed = '';
+    while (!invocation.signal.aborted) {
+        const source = await prompt({ localize: true,
+            title: 'Custom models', question: 'How should omdsh learn the model ids?', detail: diagnostic,
+            options: [
+                { label: 'Enter model ids', value: 'enter', description: 'Type one or more ids, separated by commas.' },
+                { label: 'Fetch from endpoint', value: 'fetch', description: 'Ask the base URL for GET /models.' },
+            ],
+            initialValue: 'enter', allowCustom: false, notify: false, signal: invocation.signal,
+        });
+        if (source === null || invocation.signal.aborted)
+            return undefined;
+        if (source === 'fetch') {
+            try {
+                const discovered = await ctx.llm.discoverModels('llm-pi-ai', draft, invocation.signal);
+                if (invocation.signal.aborted)
+                    return undefined;
+                if (discovered.length === 1)
+                    return [discovered[0].id];
+                if (discovered.length === 0) {
+                    diagnostic = 'No models were returned. Try again or enter model ids.';
+                    continue;
+                }
+                const picked = await prompt({ localize: ['title', 'question', 'actions'],
+                    title: 'Custom models', question: 'Choose models to enable',
+                    options: discovered.map(model => ({ label: model.id, value: model.id,
+                        ...(model.name === undefined || model.name === model.id ? {} : { description: model.name }) })),
+                    multiSelect: true, allowCustom: false, notify: false, filterable: true,
+                    presentation: 'card', signal: invocation.signal,
                 });
                 if (picked === null)
-                    return undefined;
+                    continue;
                 return parseModelIds(picked);
             }
+            catch (error) {
+                diagnostic = error instanceof Error ? error.message : 'Could not fetch models. Try again or enter model ids.';
+                continue;
+            }
         }
-        catch (error) {
-            if (invocation.signal.aborted)
-                return undefined;
-            const detail = error instanceof Error ? error.message : 'the endpoint did not list models';
-            const fallback = await ctx.tui.prompt(askPrompt({
-                title: 'Custom models',
-                question: 'Enter model ids',
-                detail: `Could not fetch models (${detail}). Type one or more ids, separated by commas.`,
-                signal: invocation.signal,
-            }));
-            if (fallback === null)
-                return undefined;
-            return parseModelIds(fallback);
-        }
+        const value = await readLoginField(prompt, askPrompt({ localize: ['title', 'question', 'actions'],
+            title: 'Custom models', question: 'Enter model ids',
+            detail: 'Separate multiple ids with commas. Example: llama3.1, qwen2.5-coder',
+            initialInput: typed, onCancelDraft: value => { typed = value; }, signal: invocation.signal,
+        }), value => parseModelIds(value).join(', '));
+        if (value !== null)
+            return parseModelIds(value);
     }
-    const typed = await ctx.tui.prompt(askPrompt({
-        title: 'Custom models',
-        question: 'Enter model ids',
-        detail: 'Separate multiple ids with commas. Example: llama3.1, qwen2.5-coder',
-        signal: invocation.signal,
-    }));
-    if (typed === null)
-        return undefined;
-    return parseModelIds(typed);
+    return undefined;
 }
-async function loginCustom(ctx, invocation) {
-    const idRaw = await ctx.tui.prompt(askPrompt({
-        title: 'Custom provider',
-        question: 'Provider id',
-        detail: 'Lowercase letters, digits, and hyphens. This id is permanent.',
-        signal: invocation.signal,
-    }));
-    if (idRaw === null)
-        return { kind: 'success' };
-    let id;
-    try {
-        id = parseProviderId(idRaw);
-    }
-    catch (error) {
-        return { kind: 'error', text: error instanceof Error ? error.message : 'Invalid provider id.' };
-    }
-    if (reservedProviderIds(ctx).has(id)) {
-        return { kind: 'error', text: `${id} is a catalog provider. Use /login and choose it from the list.` };
-    }
-    const urlRaw = await ctx.tui.prompt(askPrompt({
-        title: 'Custom provider',
-        question: 'Base URL',
-        detail: 'Absolute http(s) prefix, for example http://127.0.0.1:11434/v1',
-        signal: invocation.signal,
-    }));
-    if (urlRaw === null)
-        return { kind: 'success' };
-    let baseURL;
-    try {
-        baseURL = parseBaseURL(urlRaw);
-    }
-    catch (error) {
-        return { kind: 'error', text: error instanceof Error ? error.message : 'Invalid base URL.' };
-    }
-    const api = await ctx.tui.prompt({
-        title: 'Custom provider',
-        question: 'API protocol',
-        options: CUSTOM_PROTOCOLS.map(protocol => ({
-            label: protocol,
-            value: protocol,
-            description: protocol === 'openai-completions'
-                ? 'Chat Completions — Ollama, vLLM, LM Studio, and most gateways'
-                : protocol === 'openai-responses' ? 'OpenAI Responses API' : 'Anthropic Messages API',
-        })),
-        initialValue: 'openai-completions',
-        allowCustom: false,
-        notify: false,
-        signal: invocation.signal,
-    });
-    if (api === null)
-        return { kind: 'success' };
-    if (!CUSTOM_PROTOCOLS.includes(api)) {
-        return { kind: 'error', text: `Unknown API protocol: ${api}` };
-    }
-    const keyRaw = await ctx.tui.prompt(askPrompt({
-        title: `Login to ${id}`,
-        question: `Paste your ${id} API key`,
-        detail: 'Leave empty if the endpoint does not need a key.',
-        secret: true,
-        submitLabel: 'continue',
-        signal: invocation.signal,
-    }));
-    if (keyRaw === null)
-        return { kind: 'success' };
+async function loginCustom(ctx, invocation, prompt) {
+    let step = 0, id = '', baseURL = '', api = 'openai-completions';
     let apiKey;
-    if (keyRaw.trim() !== '') {
-        try {
-            apiKey = normalizeApiKey(keyRaw, id);
-        }
-        catch (error) {
-            return { kind: 'error', text: error instanceof Error ? error.message : `${id} login failed.` };
-        }
-    }
     let modelIds;
-    try {
-        const collected = await collectCustomModels(ctx, invocation, {
-            baseURL,
-            api,
-            ...(apiKey === undefined ? {} : { apiKey }),
-        });
-        if (collected === undefined)
-            return { kind: 'success' };
-        modelIds = collected.filter(item => item !== '');
-        if (modelIds.length === 0)
-            throw new Error('Enter at least one model id.');
-    }
-    catch (error) {
-        return { kind: 'error', text: error instanceof Error ? error.message : 'Invalid model list.' };
+    while (!invocation.signal.aborted && modelIds === undefined) {
+        switch (step) {
+            case 0: {
+                const value = await readLoginField(prompt, askPrompt({ localize: ['title', 'question', 'actions'],
+                    title: 'Custom provider', question: 'Provider id',
+                    detail: 'Lowercase letters, digits, and hyphens. This id is permanent.',
+                    initialInput: id, onCancelDraft: value => { id = value; }, signal: invocation.signal,
+                }), value => {
+                    const parsed = parseProviderId(value);
+                    if (reservedProviderIds(ctx).has(parsed))
+                        throw new Error(uiText(resolveUiLanguage(ctx.tui.prefs?.().uiLanguage), '{name} is a catalog provider. Choose it from the provider list.', { name: parsed }));
+                    return parsed;
+                });
+                if (value === null)
+                    return undefined;
+                id = value;
+                step = 1;
+                break;
+            }
+            case 1: {
+                const value = await readLoginField(prompt, askPrompt({ localize: ['title', 'question', 'actions'],
+                    title: 'Custom provider', question: 'Base URL',
+                    detail: 'Absolute http(s) prefix, for example http://127.0.0.1:11434/v1',
+                    initialInput: baseURL, onCancelDraft: value => { baseURL = value; }, signal: invocation.signal,
+                }), parseBaseURL);
+                if (value === null) {
+                    step = 0;
+                    break;
+                }
+                baseURL = value;
+                step = 2;
+                break;
+            }
+            case 2: {
+                const value = await prompt({ localize: true, title: 'Custom provider', question: 'API protocol',
+                    options: CUSTOM_PROTOCOLS.map(protocol => ({ label: protocol, value: protocol,
+                        description: protocol === 'openai-completions'
+                            ? 'Chat Completions — Ollama, vLLM, LM Studio, and most gateways'
+                            : protocol === 'openai-responses' ? 'OpenAI Responses API' : 'Anthropic Messages API' })),
+                    initialValue: api, allowCustom: false, notify: false, signal: invocation.signal,
+                });
+                if (value === null) {
+                    step = 1;
+                    break;
+                }
+                if (!CUSTOM_PROTOCOLS.includes(value))
+                    break;
+                api = value;
+                step = 3;
+                break;
+            }
+            case 3: {
+                apiKey = undefined;
+                const value = await readLoginField(prompt, askPrompt({ localize: ['title', 'question', 'actions'],
+                    title: `Login to ${id}`, question: `Paste your ${id} API key`,
+                    detail: 'Leave empty if the endpoint does not need a key.', secret: true,
+                    submitLabel: 'continue', signal: invocation.signal,
+                }), value => value.trim() === '' ? '' : normalizeApiKey(value, id));
+                if (value === null) {
+                    step = 2;
+                    break;
+                }
+                apiKey = value === '' ? undefined : value;
+                step = 4;
+                break;
+            }
+            case 4:
+                modelIds = await collectCustomModels(ctx, invocation, { baseURL, api,
+                    ...(apiKey === undefined ? {} : { apiKey }),
+                }, prompt);
+                if (modelIds === undefined)
+                    step = 3;
+                break;
+        }
     }
+    if (invocation.signal.aborted || modelIds === undefined)
+        return undefined;
     const ref = managedProviderCredentialRef(id);
     if (apiKey !== undefined) {
         const current = await ctx.credentials.describe(ref);
+        if (invocation.signal.aborted)
+            return undefined;
         if (current.configured && !current.writable) {
             return { kind: 'error', text: unmanagedCredentialMessage(ref, current, 'replace') };
         }
@@ -570,6 +560,8 @@ async function loginCustom(ctx, invocation) {
             return { kind: 'error', text: 'The API key could not be saved to the Harness credential store.' };
         }
     }
+    if (invocation.signal.aborted)
+        return undefined;
     try {
         await ctx.settings.mutate(PI_AI_SETTINGS, [{
                 op: 'set',
@@ -610,7 +602,7 @@ async function logoutDeepSeek(ctx, invocation) {
     if (current.source !== 'file') {
         return { kind: 'success', text: `DeepSeek is configured by ${credentialSource(current)}; the credential store cannot remove it.` };
     }
-    const answer = await ctx.tui.prompt({
+    const answer = await ctx.tui.prompt({ localize: true,
         title: 'Logout from DeepSeek',
         question: 'Remove the stored DeepSeek API key?',
         detail: 'The next model request will use DEEPSEEK_API_KEY from the launch environment when one is available.',
@@ -641,43 +633,6 @@ async function logoutDeepSeek(ctx, invocation) {
     }
     return { kind: 'success', text: 'Logged out from DeepSeek. The next model request falls back to the environment when available.' };
 }
-async function logoutDeepSeekAccount(ctx, invocation) {
-    const account = accountClient(ctx);
-    if (account === undefined)
-        return { kind: 'error', text: 'DeepSeek account integration is not mounted in this build.' };
-    let state;
-    try {
-        state = await account.getState();
-    }
-    catch {
-        return { kind: 'error', text: 'Could not read the shared DeepSeek account state.' };
-    }
-    if (state.status !== 'credential-stored') {
-        return { kind: 'success', text: 'No DeepSeek account grant is stored.' };
-    }
-    const answer = await ctx.tui.prompt({
-        title: 'Logout from DeepSeek account',
-        question: 'Sign out of the shared DeepSeek account?',
-        detail: 'Removes the local grant and revokes it in the background. The browser session is not signed out.',
-        options: [
-            { label: 'Cancel', value: 'cancel', description: 'Keep the account grant.' },
-            { label: 'Sign out', value: 'logout', description: 'Remove the local grant and revoke it in the background.' },
-        ],
-        initialValue: 'cancel',
-        allowCustom: false,
-        notify: false,
-        signal: invocation.signal,
-    });
-    if (answer !== 'logout')
-        return { kind: 'success' };
-    try {
-        await account.signOut(accountClientMetadata());
-    }
-    catch {
-        return { kind: 'error', text: 'Could not sign out of the DeepSeek account. Try again from DSH Web/Desktop.' };
-    }
-    return { kind: 'success', text: 'Signed out of the DeepSeek account. The local grant was removed; remote revocation continues in the background.' };
-}
 async function pickLogoutChoice(ctx, invocation) {
     const choices = await logoutableChoices(ctx);
     if (choices.length === 0)
@@ -687,7 +642,7 @@ async function pickLogoutChoice(ctx, invocation) {
     const values = choices.map(choice => choice === DEEPSEEK_ACCOUNT_CHOICE
         ? DEEPSEEK_ACCOUNT_CHOICE
         : isFlowRecordLogout(choice) ? flowChoiceValue(choice.key) : choice.provider);
-    const raw = await ctx.tui.prompt({
+    const raw = await ctx.tui.prompt({ localize: true,
         presentation: 'card',
         filterable: true,
         title: 'Provider',
@@ -732,7 +687,7 @@ async function logoutRecord(ctx, invocation, record) {
             text: `The stored ${record.label} sign-in is not removable from this session. Update that credential source directly and restart omdsh.`,
         };
     }
-    const answer = await ctx.tui.prompt({
+    const answer = await ctx.tui.prompt({ localize: true,
         title: `Logout from ${record.label}`,
         question: `Remove the stored ${record.label} sign-in?`,
         detail: 'The local credential record is deleted. Settings profiles and environment credentials stay in place. The issuer is not notified.',
@@ -773,7 +728,7 @@ async function logoutCatalog(ctx, invocation, entry) {
         return { kind: 'error', text: unmanagedCredentialMessage(managedRef, current, 'remove') };
     }
     const removesStoredKey = usesManaged && current.source === 'file';
-    const answer = await ctx.tui.prompt({
+    const answer = await ctx.tui.prompt({ localize: true,
         title: `Logout from ${label}`,
         question: removesStoredKey
             ? `Remove the stored ${label} API key and deactivate the route?`
@@ -810,172 +765,40 @@ async function logoutCatalog(ctx, invocation, entry) {
     }
     return { kind: 'success', text: `Logged out from ${label}.` };
 }
-function accountClient(ctx) {
-    return ctx.get('deepseekAccount');
-}
-function accountClientMetadata() {
-    return {
-        version: APP_VERSION,
-        locale: Intl.DateTimeFormat().resolvedOptions().locale,
-        timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60,
-    };
-}
-function accountCallbackOrigin(ctx) {
-    const server = ctx.get('webServer');
-    if (server === undefined || typeof server.port !== 'number' || server.port === 0)
-        return undefined;
-    return `${server.protocol}//${server.host}:${server.port}`;
-}
-function accountFailure(attempt) {
-    if (attempt?.phase === 'expired')
-        return 'The DeepSeek sign-in expired. Run /login to try again.';
-    if (attempt?.phase === 'failed')
-        return `DeepSeek sign-in failed${attempt.errorCode === undefined ? '' : ` (${attempt.errorCode})`}. Run /login to try again.`;
-    if (attempt?.phase === 'cancelled')
-        return 'DeepSeek sign-in was cancelled.';
-    return undefined;
-}
-async function waitForAccount(invocation, account, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (invocation.signal.aborted) {
-            const state = await account.getState().catch(() => undefined);
-            const id = state?.attempt?.id;
-            if (id !== undefined)
-                await account.cancelSignIn(id).catch(() => undefined);
-            return { kind: 'success' };
-        }
-        const state = await account.getState().catch(() => undefined);
-        if (state?.status === 'credential-stored' && state.attempt?.phase === 'succeeded') {
-            return { kind: 'success', text: 'Signed in to the DeepSeek account. Use /model to select the deepseek-account route; web search and fetch use the account token there.' };
-        }
-        const failure = accountFailure(state?.attempt);
-        if (failure !== undefined)
-            return { kind: 'error', text: failure };
-        await new Promise(resolve => setTimeout(resolve, 400));
-    }
-    const state = await account.getState().catch(() => undefined);
-    const id = state?.attempt?.id;
-    if (id !== undefined)
-        await account.cancelSignIn(id).catch(() => undefined);
-    return { kind: 'error', text: 'DeepSeek sign-in timed out before the browser completed. Run /login to try again.' };
-}
-async function loginDeepSeekAccount(ctx, invocation, config) {
-    const account = accountClient(ctx);
-    if (account === undefined)
-        return { kind: 'error', text: 'DeepSeek account integration is not mounted in this build.' };
-    let state;
-    try {
-        state = await account.getState();
-    }
-    catch {
-        return { kind: 'error', text: 'Could not read the shared DeepSeek account state.' };
-    }
-    if (state.status === 'credential-stored') {
-        const choice = await ctx.tui.prompt({
-            title: 'DeepSeek account',
-            question: 'The account is signed in and shared with DSH.',
-            detail: 'Use /model to select the deepseek-account route. Signing out removes the local grant; the DSH browser session is revoked in the background.',
-            options: [
-                { label: 'Use account route', value: 'use', description: 'Close this prompt; select the route in /model.' },
-                { label: 'Sign out', value: 'out', description: 'Remove the local grant and revoke it in the background.' },
-                { label: 'Cancel', value: 'cancel' },
-            ],
-            initialValue: 'use',
-            allowCustom: false,
-            notify: false,
-            signal: invocation.signal,
-        });
-        if (choice === null || choice === 'cancel' || choice === 'use') {
-            return { kind: 'success', text: 'Use /model to select the deepseek-account route.' };
-        }
-        try {
-            await account.signOut(accountClientMetadata());
-        }
-        catch {
-            return { kind: 'error', text: 'Could not sign out of the DeepSeek account. Try again from DSH Web/Desktop.' };
-        }
-        return { kind: 'success', text: 'Signed out of the DeepSeek account. The next account request requires sign-in again.' };
-    }
-    const server = ctx.get('webServer');
-    if (server === undefined || ctx.tui.interactive === false) {
-        return {
-            kind: 'error',
-            text: 'The loopback sign-in host is unavailable. Start omdsh with its normal terminal host, or sign in through DSH Web/Desktop and rerun /login.',
-        };
-    }
-    const origin = accountCallbackOrigin(ctx);
-    if (origin === undefined)
-        return { kind: 'error', text: 'The loopback sign-in host did not expose a port.' };
-    let initial;
-    try {
-        initial = await account.startSignIn(accountClientMetadata(), origin, 'web');
-    }
-    catch (error) {
-        return { kind: 'error', text: error instanceof Error ? error.message : 'Could not start DeepSeek sign-in.' };
-    }
-    const attempt = initial.attempt;
-    const failure = accountFailure(attempt);
-    if (failure !== undefined)
-        return { kind: 'error', text: failure };
-    let url = attempt?.authorizeUrl;
-    for (let i = 0; i < 40 && url === undefined; i += 1) {
-        if (invocation.signal.aborted)
-            break;
-        await new Promise(resolve => setTimeout(resolve, 100));
-        const next = await account.getState().catch(() => undefined);
-        const nextFailure = accountFailure(next?.attempt);
-        if (nextFailure !== undefined)
-            return { kind: 'error', text: nextFailure };
-        url = next?.attempt?.authorizeUrl;
-    }
-    if (url === undefined) {
-        const id = attempt?.id ?? (await account.getState().catch(() => undefined))?.attempt?.id;
-        if (id !== undefined)
-            await account.cancelSignIn(id).catch(() => undefined);
-        return { kind: 'error', text: 'DeepSeek did not return a browser URL for this sign-in attempt.' };
-    }
-    if (config.openBrowser !== false)
-        openExternal(url);
-    const answer = await ctx.tui.prompt({
-        title: 'DeepSeek account',
-        question: 'Complete sign-in in your browser, then return here.',
-        detail: `${url}
-
-This terminal is listening on ${origin}/oauth/callback until the attempt ends.`,
-        options: [
-            { label: 'I completed sign-in', value: 'done' },
-            { label: 'Cancel', value: 'cancel', description: 'Withdraw this sign-in attempt.' },
-        ],
-        initialValue: 'done',
-        allowCustom: false,
-        notify: false,
-        signal: invocation.signal,
-    });
-    if (answer !== 'done') {
-        const id = attempt?.id ?? (await account.getState().catch(() => undefined))?.attempt?.id;
-        if (id !== undefined)
-            await account.cancelSignIn(id).catch(() => undefined);
-        return { kind: 'success', text: 'DeepSeek sign-in cancelled.' };
-    }
-    return waitForAccount(invocation, account, 120_000);
-}
 async function login(ctx, invocation, config) {
     if (invocation.rawInput.trim() !== '') {
         return { kind: 'error', text: 'Usage: /login (paste the key only into the protected prompt)' };
     }
-    const choice = await pickLoginChoice(ctx, invocation);
-    if (choice === undefined)
-        return { kind: 'success' };
-    if (choice === DEEPSEEK_ACCOUNT_CHOICE)
-        return loginDeepSeekAccount(ctx, invocation, config);
-    if (choice === CUSTOM_PROVIDER_VALUE)
-        return loginCustom(ctx, invocation);
-    if (isAuthorizationFlow(choice))
-        return loginAuthorization(ctx, invocation, choice);
-    return isDeepSeek(choice)
-        ? loginDeepSeek(ctx, invocation, config)
-        : loginCatalog(ctx, invocation, choice);
+    const abort = new AbortController();
+    invocation = { ...invocation, signal: AbortSignal.any([invocation.signal, abort.signal]) };
+    const prompt = request => ctx.tui.prompt({ dismissLabel: 'Back', ...request,
+        ...(request.detail === undefined ? {} : { detail: request.detail.split('\n').map(line => uiText(resolveUiLanguage(ctx.tui.prefs?.().uiLanguage), line)).join('\n') }),
+        signal: invocation.signal, onSuperseded: () => abort.abort(),
+    });
+    const browse = createPromptBrowser(request => prompt({ ...request, dismissLabel: 'Cancel' }));
+    while (!invocation.signal.aborted) {
+        const choice = await pickLoginChoice(ctx, invocation, browse);
+        if (choice === undefined || invocation.signal.aborted)
+            return { kind: 'success' };
+        if (choice === DEEPSEEK_ACCOUNT_CHOICE) {
+            await openAccountSettings(ctx, invocation.signal, { ...config, signIn: true });
+            return { kind: 'success' };
+        }
+        if (choice === CUSTOM_PROVIDER_VALUE) {
+            const result = await loginCustom(ctx, invocation, prompt);
+            if (result !== undefined)
+                return result;
+            continue;
+        }
+        if (isAuthorizationFlow(choice))
+            return loginAuthorization(ctx, invocation, choice);
+        const result = isDeepSeek(choice)
+            ? await loginDeepSeek(ctx, invocation, config, prompt)
+            : await loginCatalog(ctx, invocation, choice, prompt);
+        if (result.kind !== 'success' || result.text !== undefined)
+            return result;
+    }
+    return { kind: 'success' };
 }
 async function logout(ctx, invocation) {
     if (invocation.rawInput.trim() !== '')
@@ -992,6 +815,7 @@ async function logout(ctx, invocation) {
         : logoutCatalog(ctx, invocation, choice);
 }
 export function apply(ctx, config = {}) {
+    ctx.inject(['deepseekAccount'], accountCtx => { bindAccountNotices(accountCtx); });
     registerCommands(ctx, [
         {
             name: 'login',