@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/oauth/anthropic-account-refusal.ts

@@ -31,6 +31,22 @@ export function bindAnthropicRefusalCredentialForSend(response: Response, owner:
   responseCredentials.set(response, Object.freeze({ ...owner, providerAccountUuid, checkProviderUuid: arguments.length >= 3 }));
 }
 
+/** Preserve the original send proof across internal error normalization, without renewing it. */
+export function carryAnthropicRefusalCredential(source: Response, target: Response): void {
+  const sent = responseCredentials.get(source);
+  if (sent) responseCredentials.set(target, sent);
+}
+
+/** Recheck after body consumption: a late refusal cannot acquire a replacement login's authority. */
+export function anthropicRefusalCredentialIsCurrent(response: Response, instance: AnthropicInstanceId, accountId: string): boolean {
+  const sent = responseCredentials.get(response);
+  if (!sent || sent.provider !== instance || sent.accountId !== accountId
+    || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return false;
+  const row = getAccountCredentialWithStatus(instance, accountId);
+  return !!row && !row.paused && !row.needsReauth
+    && (!sent.checkProviderUuid || row.credential.accountId === sent.providerAccountUuid);
+}
+
 async function isRevokedOAuthToken(response: Response, signal?: AbortSignal): Promise<boolean> {
   if (response.status !== 401) return false;
   try {
@@ -59,9 +75,11 @@ async function isAccountRefusal(response: Response, signal?: AbortSignal): Promi
     // Whole-message patterns: request-policy/model/resource refusals and quoted diagnostics
     // must not acquire account authority merely by containing entitlement keywords.
     if ("code" in error && error.code != null
-      && (typeof error.code !== "string" || !["subscription_required", "insufficient_quota", "permission_denied"].includes(error.code))) return false;
+      && (typeof error.code !== "string" || !["subscription_required", "insufficient_quota", "permission_denied", "oauth_org_not_allowed"].includes(error.code))) return false;
+    // The organization disabled subscription access: an account-scoped verdict, cooled like its siblings.
+    if (error.type === "oauth_org_not_allowed" || ("code" in error && error.code === "oauth_org_not_allowed")) return true;
     const message = error.message.trim();
-    if (error.type === "permission_error" && /^(?:Your account does not have access to Claude Code|Your (?:Claude )?subscription (?:has expired|is (?:expired|inactive))|Your account does not have an active subscription)[.!]?$/i.test(message)) return true;
+    if (error.type === "permission_error" && /^(?:Your account does not have access to Claude Code|Your (?:Claude )?subscription (?:has expired|is (?:expired|inactive))|Your account does not have an active subscription|(?:Your|This) organization has disabled Claude subscription access for Claude Code(?:\. Use an Anthropic API key instead, or ask your admin to enable access)?)[.!]?$/i.test(message)) return true;
     return (error.type === "billing_error" || error.type === "permission_error")
       && /^Your credit balance is too low to access the Anthropic API\.(?: Please go to Plans & Billing to upgrade or purchase credits\.)?$/i.test(message);
   } catch {

package/src/oauth/anthropic-oauth-definitions.ts

@@ -1,7 +1,7 @@
 import { ConfigMutationLockError } from "../config";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
-import { loginAnthropic, refreshAnthropicToken } from "./anthropic";
+import { ANTHROPIC_CODE_REDIRECT_URI, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import type { OAuthProviderDef } from "./index";
 import {
   clearOAuthRefreshIntent, clearOAuthRefreshIntentIfMatch, markOAuthRefreshIntentCleanupPending,
@@ -16,8 +16,10 @@ export function anthropicOAuthDefinition(instance: AnthropicInstanceId): OAuthPr
   return {
     login: (ctrl, opts) => loginAnthropic(ctrl, {
       instance, importLocal: instance === "anthropic2" || opts?.forceLogin ? "off" : "fallback",
+      codeMode: opts?.codeMode === true,
     }),
     refresh: refreshAnthropicToken,
+    codeRedirectUri: ANTHROPIC_CODE_REDIRECT_URI,
     providerConfig,
     defaultModel,
     // Subscription OAuth must never generate unattended traffic by default.

package/src/oauth/anthropic-routing.ts

@@ -19,7 +19,6 @@ import { clearAllAnthropicFamilyQuota, anthropicModelQuotaFor, anthropicModelPer
  */
 import { clearAllAnthropicRatePauses, anthropicRatePolicyFor, classifyAnthropic429, anthropicRetryAfterMs } from "./anthropic-rate-limit-policy";
 import { REFRESH_SKEW_MS } from "./refresh-policy";
-import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
 import { getCachedProviderAccountQuota } from "../providers/quota";
@@ -273,26 +272,7 @@ export function formatAnthropicProviderForLog(
   return `${providerName}-${formatAnthropicAccountOrdinal(accountId)}`;
 }
 
-export function anthropicSessionKeyFromParts(input: {
-  sessionIdHeader?: string | null;
-  threadIdHeader?: string | null;
-  promptCacheKey?: string | null;
-  clientThreadId?: string | null;
-  /** When true, prompt_cache_key is a shared Desktop cohort — ignore it for affinity. */
-  promptCacheKeyIsSharedCohort?: boolean;
-}): string | null {
-  const preferred = input.clientThreadId?.trim()
-    || input.sessionIdHeader?.trim()
-    || input.threadIdHeader?.trim()
-    || "";
-  if (preferred) {
-    return preferred.length <= 128 ? preferred : createHash("sha256").update(preferred).digest("hex");
-  }
-  if (input.promptCacheKeyIsSharedCohort) return null;
-  const cacheKey = input.promptCacheKey?.trim() ?? "";
-  if (!cacheKey) return null;
-  return cacheKey.length <= 128 ? cacheKey : createHash("sha256").update(cacheKey).digest("hex");
-}
+export { oauthSessionKeyFromParts as anthropicSessionKeyFromParts } from "./session-affinity-key";
 
 
 export type AnthropicCooldownRecoveryClaim = Readonly<{

package/src/oauth/anthropic.ts

@@ -15,6 +15,16 @@ const CALLBACK_PATH = "/callback";
 /** Profile enrichment budget on token refresh; login paths keep the resolver's own deadline. */
 const REFRESH_PROFILE_TIMEOUT_MS = 2_000;
 const SCOPES = "org:create_api_key user:profile user:inference";
+/**
+ * Provider-hosted code-display redirect: Anthropic renders `code#state` for the user to copy
+ * instead of redirecting to a local port. This is what makes login possible from a container or
+ * a hosted gateway, where no browser can reach this process. Same OAuth client as the callback
+ * flow — only the redirect differs, so it must be the redirect_uri used for BOTH the authorize
+ * request and the token exchange.
+ */
+export const ANTHROPIC_CODE_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+/** A displayed code is copied by hand across devices; the 300s callback wait is too short. */
+const CODE_MODE_TIMEOUT_MS = 10 * 60_000;
 
 // ── OAuth-request requirements applied by the anthropic adapter when authMode==="oauth" ──
 export const ANTHROPIC_OAUTH_BETA = "claude-code-20250219,oauth-2025-04-20";
@@ -142,10 +152,27 @@ async function withAccountProfile(credential: OAuthCredentials, signal?: AbortSi
 }
 
 export class AnthropicOAuthFlow extends OAuthCallbackFlow {
+  /**
+   * PKCE verifier for THIS flow. One `AnthropicOAuthFlow` is constructed per login and
+   * `generateAuthUrl` runs once on it, so the verifier is already flow-scoped: a second
+   * concurrent login builds a second instance and cannot reach this field.
+   */
   #verifier = "";
+  #codeMode: boolean;
 
-  constructor(ctrl: OAuthController) {
-    super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+  constructor(ctrl: OAuthController, opts?: { codeMode?: boolean }) {
+    if (opts?.codeMode) {
+      super(ctrl, {
+        preferredPort: CALLBACK_PORT,
+        callbackPath: CALLBACK_PATH,
+        redirectUri: ANTHROPIC_CODE_REDIRECT_URI,
+        skipCallbackServer: true,
+        timeoutMs: CODE_MODE_TIMEOUT_MS,
+      });
+    } else {
+      super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+    }
+    this.#codeMode = opts?.codeMode === true;
   }
 
   async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
@@ -163,8 +190,9 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
     });
     return {
       url: `${AUTHORIZE_URL}?${authParams.toString()}`,
-      instructions:
-        "Complete Claude login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+      instructions: this.#codeMode
+        ? "Open this URL in any browser, approve access, then paste the code Anthropic displays (it looks like code#state)."
+        : "Complete Claude login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
     };
   }
 
@@ -191,9 +219,12 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
 
 export async function loginAnthropic(
   ctrl: OAuthController,
-  opts?: { importLocal?: LocalTokenImportMode; instance?: AnthropicInstanceId },
+  opts?: { importLocal?: LocalTokenImportMode; instance?: AnthropicInstanceId; codeMode?: boolean },
 ): Promise<OAuthCredentials> {
-  const importLocal = opts?.importLocal ?? "off";
+  // A code-mode caller asked for a URL to show and a box to paste into. Importing a local
+  // Claude Code token instead would complete WITHOUT ever firing onAuth, so the caller would
+  // get no URL at all — a different outcome than the one its contract promises.
+  const importLocal = opts?.codeMode ? "off" : opts?.importLocal ?? "off";
   if (opts?.instance === "anthropic2" && importLocal !== "off") throw new AnthropicLocalCliImportError();
   if (importLocal !== "off") {
     const { detectClaudeCodeToken } = await import("./local-token-detect");
@@ -221,7 +252,7 @@ export async function loginAnthropic(
       );
     }
   }
-  return new AnthropicOAuthFlow(ctrl).login();
+  return new AnthropicOAuthFlow(ctrl, { codeMode: opts?.codeMode === true }).login();
 }
 
 export async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {

package/src/oauth/callback-server.ts

@@ -66,6 +66,15 @@ export interface OAuthCallbackFlowOptions {
   callbackBindHostname?: string;
   /** Exact redirect URI advertised to the provider; disables port fallback. */
   redirectUri?: string;
+  /**
+   * Code-display mode: the provider renders the authorization code for the user to paste, so
+   * this process never receives a redirect and must NOT open a listener. Requires `redirectUri`
+   * (the provider-hosted code page) and an `onManualCodeInput` channel — without one the flow
+   * would wait for a callback that can never arrive.
+   */
+  skipCallbackServer?: boolean;
+  /** Overrides the 300s wait for the code; code-display pastes are hand-typed and slower. */
+  timeoutMs?: number;
 }
 
 type BunServer = ReturnType<typeof Bun.serve>;
@@ -77,6 +86,8 @@ export abstract class OAuthCallbackFlow {
   callbackHostname: string;
   callbackBindHostname: string;
   redirectUri?: string;
+  skipCallbackServer: boolean;
+  timeoutMs: number;
   #callbackResolve?: (result: CallbackResult) => void;
   #callbackReject?: (error: string) => void;
 
@@ -86,6 +97,8 @@ export abstract class OAuthCallbackFlow {
     callbackPath: string = CALLBACK_PATH,
   ) {
     this.ctrl = ctrl;
+    this.skipCallbackServer = false;
+    this.timeoutMs = DEFAULT_TIMEOUT;
     if (typeof preferredPortOrOptions === "number") {
       this.preferredPort = preferredPortOrOptions;
       this.callbackPath = callbackPath;
@@ -98,6 +111,11 @@ export abstract class OAuthCallbackFlow {
     this.callbackHostname = preferredPortOrOptions.callbackHostname ?? DEFAULT_HOSTNAME;
     this.callbackBindHostname = preferredPortOrOptions.callbackBindHostname ?? DEFAULT_BIND_HOSTNAME;
     this.redirectUri = preferredPortOrOptions.redirectUri;
+    this.skipCallbackServer = preferredPortOrOptions.skipCallbackServer === true;
+    this.timeoutMs = preferredPortOrOptions.timeoutMs ?? DEFAULT_TIMEOUT;
+    if (this.skipCallbackServer && !this.redirectUri) {
+      throw new Error("skipCallbackServer requires an explicit redirectUri");
+    }
   }
 
   /** Build provider-specific authorization URL. */
@@ -132,6 +150,14 @@ export abstract class OAuthCallbackFlow {
   }
 
   async #startCallbackServer(expectedState: string): Promise<{ servers: BunServer[]; redirectUri: string }> {
+    if (this.skipCallbackServer) {
+      // The paste channel is the ONLY way this flow can complete. Fail loudly here rather than
+      // hanging until the timeout on a controller that can never deliver a code.
+      if (!this.ctrl.onManualCodeInput) {
+        throw new Error("Code-display login requires a manual code input channel");
+      }
+      return { servers: [], redirectUri: this.redirectUri! };
+    }
     try {
       const servers = this.#createServers(this.preferredPort, expectedState);
       if (this.redirectUri) {
@@ -226,7 +252,7 @@ export abstract class OAuthCallbackFlow {
   }
 
   #waitForCallback(expectedState: string): Promise<CallbackResult> {
-    const timeoutSignal = AbortSignal.timeout(DEFAULT_TIMEOUT);
+    const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
     const signal = this.ctrl.signal ? AbortSignal.any([this.ctrl.signal, timeoutSignal]) : timeoutSignal;
 
     const callbackPromise = new Promise<CallbackResult>((resolve, reject) => {

package/src/oauth/chatgpt-device.ts

@@ -1,5 +1,5 @@
 import type { OAuthController, OAuthCredentials } from "./types";
-import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken } from "./chatgpt";
+import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken } from "./chatgpt-shared";
 
 /**
  * OpenAI deviceauth (device-code) grant for the ChatGPT/Codex provider.

package/src/oauth/chatgpt-shared.ts

@@ -0,0 +1,83 @@
+import type { OAuthCredentials } from "./types";
+
+/**
+ * What the browser callback grant and the deviceauth grant share: the public PKCE client and the
+ * way a token response becomes credentials.
+ *
+ * This is a leaf on purpose. `./chatgpt-device` needs these, and `./chatgpt` needs the device
+ * grant for `flow: "device"`; importing them straight from `./chatgpt` made the pair a cycle.
+ */
+
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+
+/** Shared with the deviceauth grant in `./chatgpt-device`: same public PKCE client. */
+export const CHATGPT_CLIENT_ID = CLIENT_ID;
+export const CHATGPT_TOKEN_URL = TOKEN_URL;
+
+export function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) return undefined;
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")) as Record<string, unknown>;
+  } catch {
+    return undefined;
+  }
+}
+
+export function extractAccountId(idToken?: string, accessToken?: string): string | undefined {
+  for (const token of [idToken, accessToken]) {
+    if (!token) continue;
+    const payload = decodeJwtPayload(token);
+    if (!payload) continue;
+    if (typeof payload.chatgpt_account_id === "string") return payload.chatgpt_account_id;
+    const ns = payload["https://api.openai.com/auth"];
+    if (ns && typeof ns === "object" && typeof (ns as Record<string, unknown>).chatgpt_account_id === "string") {
+      return (ns as Record<string, unknown>).chatgpt_account_id as string;
+    }
+    const orgs = payload.organizations;
+    if (Array.isArray(orgs) && orgs[0] && typeof orgs[0].id === "string") return orgs[0].id as string;
+  }
+  return undefined;
+}
+
+export function extractEmail(idToken?: string, accessToken?: string): string | undefined {
+  for (const token of [idToken, accessToken]) {
+    if (!token) continue;
+    const payload = decodeJwtPayload(token);
+    if (!payload) continue;
+    if (typeof payload.email === "string") return payload.email.toLowerCase();
+  }
+  return undefined;
+}
+
+export function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
+  const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
+  // This parses a response from an external boundary, so the access token is
+  // validated rather than cast. A 200 carrying no access_token would otherwise
+  // resolve a login as successful with an undefined credential, which then gets
+  // silently declined at persistence — a success message and no account.
+  const accessToken = typeof data.access_token === "string" && data.access_token.length > 0
+    ? data.access_token
+    : undefined;
+  if (!accessToken) throw new Error("ChatGPT token response missing access token");
+  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
+  // ?? only guards null/undefined; NaN or a string expires_in would otherwise
+  // produce a NaN expiry that never compares as expired, and a negative duration
+  // would stamp an already-past expiry — both block refresh semantics.
+  const expiresIn =
+    typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in >= 0
+      ? data.expires_in
+      : 3600;
+  // The computed timestamp itself must stay finite: Number.MAX_VALUE passes
+  // Number.isFinite but overflows to Infinity once multiplied by 1000.
+  const computedExpires = Date.now() + expiresIn * 1000;
+  const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000;
+  return {
+    access: accessToken,
+    refresh: refreshToken,
+    expires,
+    accountId: extractAccountId(idToken, accessToken),
+    email: extractEmail(idToken, accessToken),
+  };
+}

package/src/oauth/chatgpt.ts

@@ -1,4 +1,5 @@
 import { OAuthCallbackFlow } from "./callback-server";
+import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken, decodeJwtPayload, extractAccountId, extractEmail } from "./chatgpt-shared";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { generatePKCE } from "./pkce";
 import { classifyChatgptRefreshFailure } from "../codex/chatgpt-refresh-failure";
@@ -102,44 +103,20 @@ function chatGptTokenError(status: number, body: string, label: string): ChatGpt
   );
 }
 
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/**
+ * The client and token decoding live in a leaf shared with the device grant.
+ * Re-exported so existing import sites keep their public helper surface.
+ */
+export { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken, decodeJwtPayload, extractAccountId, extractEmail };
+const CLIENT_ID = CHATGPT_CLIENT_ID;
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
-const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const TOKEN_URL = CHATGPT_TOKEN_URL;
 
-/** Shared with the deviceauth grant in `./chatgpt-device`: same public PKCE client. */
-export const CHATGPT_CLIENT_ID = CLIENT_ID;
-export const CHATGPT_TOKEN_URL = TOKEN_URL;
 const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
 const CALLBACK_PORT = 1455;
 const CALLBACK_PATH = "/auth/callback";
 const ORIGINATOR = "opencodex";
 
-export function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
-  const parts = token.split(".");
-  if (parts.length !== 3 || !parts[1]) return undefined;
-  try {
-    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")) as Record<string, unknown>;
-  } catch {
-    return undefined;
-  }
-}
-
-export function extractAccountId(idToken?: string, accessToken?: string): string | undefined {
-  for (const token of [idToken, accessToken]) {
-    if (!token) continue;
-    const payload = decodeJwtPayload(token);
-    if (!payload) continue;
-    if (typeof payload.chatgpt_account_id === "string") return payload.chatgpt_account_id;
-    const ns = payload["https://api.openai.com/auth"];
-    if (ns && typeof ns === "object" && typeof (ns as Record<string, unknown>).chatgpt_account_id === "string") {
-      return (ns as Record<string, unknown>).chatgpt_account_id as string;
-    }
-    const orgs = payload.organizations;
-    if (Array.isArray(orgs) && orgs[0] && typeof orgs[0].id === "string") return orgs[0].id as string;
-  }
-  return undefined;
-}
-
 /**
  * Three-way answer to "is this token marked as belonging to the ChatGPT account domain".
  * Only ChatGPT-specific claims count as markers: a top-level chatgpt_account_id or the
@@ -196,16 +173,6 @@ export function inspectChatGptDomainClaim(token: string): ChatGptDomainClaim {
   return accountId ? { kind: "valid", accountId } : { kind: "invalid" };
 }
 
-export function extractEmail(idToken?: string, accessToken?: string): string | undefined {
-  for (const token of [idToken, accessToken]) {
-    if (!token) continue;
-    const payload = decodeJwtPayload(token);
-    if (!payload) continue;
-    if (typeof payload.email === "string") return payload.email.toLowerCase();
-  }
-  return undefined;
-}
-
 /**
  * Identity-agreement view of one token for security-sensitive bindings. `accountId` follows the
  * existing extractAccountId precedence (top-level, then namespaced, then organizations[0]).
@@ -233,37 +200,6 @@ export function extractAccountIdClaims(token?: string): { accountId: string | un
   };
 }
 
-export function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
-  const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
-  // This parses a response from an external boundary, so the access token is
-  // validated rather than cast. A 200 carrying no access_token would otherwise
-  // resolve a login as successful with an undefined credential, which then gets
-  // silently declined at persistence — a success message and no account.
-  const accessToken = typeof data.access_token === "string" && data.access_token.length > 0
-    ? data.access_token
-    : undefined;
-  if (!accessToken) throw new Error("ChatGPT token response missing access token");
-  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
-  // ?? only guards null/undefined; NaN or a string expires_in would otherwise
-  // produce a NaN expiry that never compares as expired, and a negative duration
-  // would stamp an already-past expiry — both block refresh semantics.
-  const expiresIn =
-    typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in >= 0
-      ? data.expires_in
-      : 3600;
-  // The computed timestamp itself must stay finite: Number.MAX_VALUE passes
-  // Number.isFinite but overflows to Infinity once multiplied by 1000.
-  const computedExpires = Date.now() + expiresIn * 1000;
-  const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000;
-  return {
-    access: accessToken,
-    refresh: refreshToken,
-    expires,
-    accountId: extractAccountId(idToken, accessToken),
-    email: extractEmail(idToken, accessToken),
-  };
-}
-
 export class ChatGPTOAuthFlow extends OAuthCallbackFlow {
   #verifier = "";
   forceLogin = false;

package/src/oauth/dsh.ts

@@ -0,0 +1,203 @@
+/**
+ * DeepSeek Harness Account OAuth implementation (Import-first).
+ *
+ * Imports existing authenticated account from DeepSeek Harness Desktop
+ * (`$DSH_HOME/.credentials.yaml`, default `~/.dsh/.credentials.yaml`).
+ *
+ * Invariant: The DSH credential store is strictly READ-ONLY to OpenCodeX.
+ * OpenCodeX NEVER mutates, overwrites, deletes, or changes permissions of `~/.dsh/.credentials.yaml`.
+ */
+
+import type { OAuthController, OAuthCredentials } from "./types";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+
+export const DSH_PLATFORM_ORIGIN = "https://platform.deepseek.com";
+export const DSH_INFERENCE_ORIGIN = "https://api.deepseek.com/anthropic";
+
+export interface DshAccountDetectionResult {
+  detected: boolean;
+  token?: string;
+  issuer?: string;
+  error?: string;
+}
+
+export interface DshValidatedAccountIdentity {
+  valid: boolean;
+  accountId?: string;
+  email?: string;
+  name?: string;
+  error?: string;
+}
+
+export function resolveDshCredentialsPath(): string {
+  const dshHome = process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+  return join(dshHome, ".credentials.yaml");
+}
+
+/**
+ * Pure read-only probe to detect whether DeepSeek Harness Desktop is installed
+ * and signed in on this machine.
+ * NEVER writes, creates, mutates, or deletes any file.
+ */
+export function detectDshAccount(): DshAccountDetectionResult {
+  const filePath = resolveDshCredentialsPath();
+  if (!existsSync(filePath)) {
+    return { detected: false };
+  }
+  try {
+    const content = readFileSync(filePath, "utf8");
+    const data = Bun.YAML.parse(content) as Record<string, unknown> | null;
+    if (!data || typeof data !== "object") {
+      return { detected: false };
+    }
+    const records = data.records as Record<string, unknown> | undefined;
+    const accountRecord = records?.["deepseek-account-platform/default"] as {
+      kind?: string;
+      payload?: { version?: number; token?: string; issuer?: string };
+    } | undefined;
+
+    if (accountRecord?.kind === "grant" && typeof accountRecord.payload?.token === "string" && accountRecord.payload.token.length > 0) {
+      return {
+        detected: true,
+        token: accountRecord.payload.token,
+        issuer: accountRecord.payload.issuer ?? DSH_PLATFORM_ORIGIN,
+      };
+    }
+    return { detected: false };
+  } catch {
+    return { detected: false, error: "CREDENTIAL_FILE_READ_FAILED" };
+  }
+}
+
+/**
+ * Validate token against DeepSeek's authoritative profile endpoint:
+ * GET https://platform.deepseek.com/auth-api/v0/users/current
+ */
+export async function validateDshAccountToken(
+  token: string,
+  signal?: AbortSignal,
+): Promise<DshValidatedAccountIdentity> {
+  try {
+    const timeoutSignal = AbortSignal.timeout(10_000);
+    const combinedSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+    const response = await fetch(`${DSH_PLATFORM_ORIGIN}/auth-api/v0/users/current`, {
+      method: "GET",
+      headers: {
+        "x-dsh-auth-token": token,
+        "accept": "application/json",
+      },
+      redirect: "manual",
+      signal: combinedSignal,
+    });
+
+    if (response.status === 401) {
+      return { valid: false, error: "ACCOUNT_TOKEN_INVALID" };
+    }
+    if (!response.ok) {
+      return { valid: false, error: `Platform returned HTTP ${response.status}` };
+    }
+
+    const body = (await response.json()) as {
+      code?: number;
+      data?: {
+        biz_code?: number;
+        biz_data?: {
+          id?: string | null;
+          email?: string;
+          id_profile?: { name?: string | null; picture?: string | null };
+        };
+      };
+    };
+
+    if (body.code !== 0 || body.data?.biz_code !== 0 || !body.data.biz_data) {
+      return { valid: false, error: `Platform error code: ${body.code ?? "unknown"}` };
+    }
+
+    const biz = body.data.biz_data;
+    // Account-store slot matching and reauthentication require the same stable upstream ID.
+    // Email/phone/display names and a shared fallback must never identify an imported account.
+    const accountId = typeof biz.id === "string" ? biz.id.trim() : "";
+    if (!accountId) return { valid: false, error: "ACCOUNT_IDENTITY_UNVERIFIED" };
+    const email = typeof biz.email === "string" ? biz.email.trim() || undefined : undefined;
+    const name = typeof biz.id_profile?.name === "string" ? biz.id_profile.name.trim() || undefined : undefined;
+
+    return {
+      valid: true,
+      accountId,
+      email,
+      name,
+    };
+  } catch {
+    if (signal?.aborted) throw signal.reason ?? new DOMException("DSH login aborted", "AbortError");
+    // Parser and transport errors may contain profile data or credential-file contents.
+    return { valid: false, error: "PROFILE_VALIDATION_FAILED" };
+  }
+}
+
+export interface DshLoginOptions {
+  forceLogin?: boolean;
+}
+
+/**
+ * Explicit user login action for DSH Account.
+ * Reuses the existing DSH local credential after live authoritative validation.
+ */
+export async function loginDshAccount(
+  ctrl: OAuthController,
+  _opts: DshLoginOptions = {},
+): Promise<OAuthCredentials> {
+  if (ctrl.signal?.aborted) {
+    throw ctrl.signal.reason ?? new DOMException("DSH login aborted", "AbortError");
+  }
+
+  const detection = detectDshAccount();
+  if (!detection.detected || !detection.token) {
+    throw new Error(
+      "DeepSeek Harness account not found in ~/.dsh/.credentials.yaml. " +
+      "Please sign in to DeepSeek Harness Desktop first, then import your account.",
+    );
+  }
+
+  const validation = await validateDshAccountToken(detection.token, ctrl.signal);
+  if (!validation.valid || !validation.accountId) {
+    throw new Error(
+      `DeepSeek Harness account token in ~/.dsh/.credentials.yaml is invalid or expired (${validation.error ?? "unknown"}). ` +
+      "Please re-login in DeepSeek Harness Desktop, then try again.",
+    );
+  }
+
+  return {
+    access: detection.token,
+    refresh: detection.token,
+    expires: Number.MAX_SAFE_INTEGER,
+    accountId: validation.accountId,
+    email: validation.email,
+    source: "credential-file",
+  };
+}
+
+/**
+ * Token refresh for DSH Account.
+ * DSH accounts use long-lived session grant tokens without an automatic rotation endpoint.
+ * In accordance with the explicit-import contract, background or automatic refresh MUST NOT
+ * automatically re-read or adopt new credentials from ~/.dsh/.credentials.yaml.
+ * If the grant is rejected or expires, this throws a terminal error so the account transitions
+ * to needsReauth, requiring explicit user re-import.
+ */
+export async function refreshDshAccountToken(
+  _refreshToken: string,
+  _signal?: AbortSignal,
+  _credential?: OAuthCredentials,
+  _accountId?: string,
+): Promise<OAuthCredentials> {
+  throw new Error("DeepSeek Harness account session expired or revoked. Please sign in to DeepSeek Harness Desktop and re-import.");
+}
+
+/** Provider-owned auth hooks keep the shared OAuth registry within its line budget. */
+export const DSH_ACCOUNT_AUTH = {
+  login: loginDshAccount,
+  refresh: refreshDshAccountToken,
+  defaultRefreshPolicy: "disabled" as const,
+};