@cjhyy/code-shell-link 0.9.25 → 0.9.27

package/dist/catalog.js

@@ -27,7 +27,7 @@ export const LINK_PROVIDER_MANIFESTS = [
         id: "github",
         displayName: "GitHub",
         category: "developer",
-        description: text("读取仓库、文件、Issue 和 Pull Request。", "Read repositories, files, issues, and pull requests."),
+        description: text("读取仓库、文件、Issue 和 Pull Request；可审批创建 Issue、设置当前账号的 Star。", "Read repositories, files, issues, and pull requests; approve issue creation and account Star changes."),
         brandText: "GH",
         icon: "github",
         accent: "neutral",
@@ -37,26 +37,31 @@ export const LINK_PROVIDER_MANIFESTS = [
                 ...localToken("fine-grained-pat", text("GitHub 登录 / Fine-grained PAT", "GitHub sign-in / fine-grained PAT"), "Fine-grained PAT", "github_pat_…", {
                     title: text("创建 Fine-grained PAT", "Create a fine-grained PAT"),
                     summary: text("适合只授权指定仓库；创建页面会预填当前 Link Actions 所需权限。", "Best for selected repositories; the creation page pre-fills permissions required by the current Link Actions."),
-                    createCredentialUrl: "https://github.com/settings/personal-access-tokens/new?name=CodeShell+Link&description=Local+GitHub+connection+for+CodeShell&expires_in=90&contents=read&issues=write&pull_requests=read&metadata=read",
+                    createCredentialUrl: "https://github.com/settings/personal-access-tokens/new?name=CodeShell+Link&description=Local+GitHub+connection+for+CodeShell&expires_in=90&contents=read&issues=write&pull_requests=read&metadata=read&starring=write",
                     docsUrl: "https://docs.github.com/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens",
                     permissions: [
                         { id: "contents", label: "Contents: read", level: "required" },
                         { id: "issues", label: "Issues: write", level: "required" },
                         { id: "pull_requests", label: "Pull requests: read", level: "required" },
                         { id: "metadata", label: "Metadata: read", level: "required" },
+                        {
+                            id: "starring",
+                            label: "Starring: write (account; Star / Unstar)",
+                            level: "required",
+                        },
                     ],
                     steps: [
                         text("选择资源所有者和允许 CodeShell 访问的仓库。", "Choose the resource owner and repositories CodeShell may access."),
                         text("确认预填权限，设置有效期并生成 Token。", "Review the pre-filled permissions, set an expiry, and generate the token."),
                         text("复制 Token，回到这里粘贴并验证。", "Copy the token, return here, and verify it."),
                     ],
-                    note: text("Token 只显示一次；建议设置有效期并仅选择必要仓库。", "The token is shown once; set an expiry and select only necessary repositories."),
+                    note: text("Star / Unstar 另需账号级 Starring: write；这是修改当前账号收藏的权限。已有连接需明确重新连接，刷新不会扩大权限。Token 只显示一次。", "Star / Unstar needs account-level Starring: write, which modifies this account’s stars. Explicitly reconnect existing bindings; refreshing never expands grants. The token is shown once."),
                 }),
                 browserAuth: {
                     kind: "browser-oauth",
                     flow: "device-code",
                     displayName: text("在浏览器登录 GitHub", "Sign in to GitHub in your browser"),
-                    summary: text("无需安装 gh。CodeShell 显示一次性验证码，你在 GitHub 完成授权后即可连接。", "No gh installation required. CodeShell shows a one-time code and connects after you approve access on GitHub."),
+                    summary: text("无需安装 gh。CodeShell 显示一次性验证码；Star 功能还需 GitHub App 的 Starring 用户写权限及明确重新连接。", "No gh installation required. CodeShell shows a one-time code. Star actions additionally need GitHub App Starring user write permission and an explicit reconnect."),
                     docsUrl: "https://docs.github.com/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app#using-the-device-flow-to-generate-a-user-access-token",
                     privacyNote: text("授权页由 GitHub 托管；密码不经过 CodeShell。授权结果仅加密保存在当前设备。", "GitHub hosts the authorization page, so your password never passes through CodeShell. The resulting credential is encrypted only on this device."),
                 },
@@ -64,7 +69,7 @@ export const LINK_PROVIDER_MANIFESTS = [
                     kind: "cli-session",
                     command: "gh",
                     displayName: text("使用 GitHub CLI 登录", "Sign in with GitHub CLI"),
-                    summary: text("直接复用本机 GitHub CLI 会话，不复制或保存 GitHub Token。", "Reuse the GitHub CLI session on this device without copying or storing its GitHub token."),
+                    summary: text("复用本机 GitHub CLI 会话，不复制或保存 Token。CLI Actions 只读；创建 Issue 和设置 Star 请明确连接 PAT、浏览器 OAuth 或远程 Link。", "Reuse this device’s GitHub CLI session without copying or storing its token. CLI Actions are read-only; explicitly connect PAT, browser OAuth or remote Link for issue creation and Star changes."),
                     installUrl: "https://cli.github.com/",
                     privacyNote: text("Link 仅保存一条本地绑定记录；每次 Action 都由 gh 执行。断开 Link 不会退出 gh。", "Link stores only a local binding; every Action runs through gh. Disconnecting Link does not sign gh out."),
                 },
@@ -73,6 +78,9 @@ export const LINK_PROVIDER_MANIFESTS = [
         ],
         actionIds: [
             "list_repositories",
+            "get_repository",
+            "get_starred",
+            "set_starred",
             "get_readme",
             "get_file",
             "list_issues",

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { LINK_PROVIDER_MANIFESTS, getLinkProviderManifest, localizeLinkText } from "./catalog.js";
 export type { LinkAuthGuide, LinkAuthKind, LinkConnectionMethodManifest, LinkCliSessionAuth, LinkExecutionRuntime, LinkLocalizedText, LinkMethodAvailability, LinkPermissionGuide, LinkPermissionLevel, LinkProviderAccent, LinkProviderCategory, LinkProviderIcon, LinkProviderManifest, LinkSecretLocation, } from "./types.js";
-export type { LinkProviderView, LinkAuthorization, LinkConnectionInput, LinkErrorCode, LinkSnapshot, MaskedLinkConnection, TokenConnectionInput, } from "./management-types.js";
+export type { LinkProviderView, LinkAuthMode, LinkAuthorization, LinkAuthorizationInput, LinkAuthorizationResponse, LinkAuthorizationStep, LinkCredentialFieldView, LinkResourceGroupView, LinkConnectionInput, LinkErrorCode, LinkSnapshot, MaskedLinkConnection, TokenConnectionInput, } from "./management-types.js";

package/dist/management-types.d.ts

@@ -1,5 +1,7 @@
 import type { LinkProviderManifest } from "./types.js";
 export type LinkProviderView = LinkProviderManifest & {
+    /** Host-verified capabilities, distinct from short-lived authorization steps. */
+    authModes?: LinkAuthMode[];
     tokenLabel: string;
     tokenPlaceholder: string;
     actions: Array<{
@@ -15,6 +17,91 @@ export type LinkProviderView = LinkProviderManifest & {
         configurationCode?: "client_id_missing";
     };
 };
+export interface LinkAuthMode {
+    id: string;
+    methodId: string;
+    kind: "credential-input" | "local-session" | "device-code" | "redirect" | "qr-code";
+    label: string;
+    preferred?: boolean;
+    available: boolean;
+    unavailableReason?: string;
+}
+export interface LinkCredentialFieldView {
+    id: string;
+    label: string;
+    secret: boolean;
+    required: boolean;
+    placeholder?: string;
+    maxLength?: number;
+}
+export interface LinkResourceGroupView {
+    id: string;
+    label: string;
+    items: Array<{
+        id: string;
+        label: string;
+        description?: string;
+    }>;
+    minSelected?: number;
+    maxSelected?: number;
+    truncated?: boolean;
+}
+/** Only the current interaction is exposed; protocol credentials stay in their Host. */
+export type LinkAuthorizationStep = {
+    id: string;
+    expiresAt: string;
+} & ({
+    kind: "redirect";
+    authorizationUrl: string;
+} | {
+    kind: "device-code";
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+} | {
+    kind: "qr-code";
+    qr?: {
+        payload: string;
+        challengeExpiresAt: string;
+        instructions: string[];
+    };
+    phase: "awaiting-scan" | "awaiting-confirmation" | "expired";
+    canRefresh: boolean;
+} | {
+    kind: "credential-input";
+    purpose: "credential" | "verification-code" | "second-factor";
+    fields: LinkCredentialFieldView[];
+} | {
+    kind: "local-session";
+    session: {
+        installed: boolean;
+        authenticated: boolean;
+        account?: string;
+        message?: string;
+        canLogin?: boolean;
+        canInstall?: boolean;
+    };
+} | {
+    kind: "consent";
+    account: {
+        id?: string;
+        label: string;
+    };
+    permissions: Array<{
+        id: string;
+        label: string;
+        description?: string;
+        required?: boolean;
+    }>;
+    resourceGroups: LinkResourceGroupView[];
+} | {
+    kind: "processing";
+});
+export interface LinkAuthorizationResponse {
+    stepId: string;
+    operation: "submit" | "detect-session" | "login-session" | "bind-session" | "confirm" | "refresh-qr";
+    input?: Record<string, string | string[] | boolean>;
+}
 export interface MaskedLinkConnection {
     id: string;
     providerId: string;
@@ -43,6 +130,9 @@ export interface LinkSnapshot {
         cliBinding: boolean;
         deviceAuth: boolean;
         remoteAuth?: boolean;
+        authorizationSteps?: 1;
+        /** Same-origin launch tickets complete in the original owner without browser cookies. */
+        browserHandoff?: 1;
     };
     remoteServer?: {
         issuer: string;
@@ -62,11 +152,18 @@ export interface LinkConnectionInput {
 export interface TokenConnectionInput extends LinkConnectionInput {
     token: string;
 }
+export interface LinkAuthorizationInput extends LinkConnectionInput {
+    authModeId: string;
+}
 export type LinkErrorCode = "invalid_request" | "login_required" | "not_found" | "read_only" | "conflict" | "busy" | "provider_rejected" | "cli_unavailable" | "authorization_failed" | "authorization_expired" | "cancelled" | "unavailable";
 export interface LinkAuthorization {
     id: string;
     providerId: string;
     state: "pending" | "connected" | "failed" | "cancelled";
+    methodId?: string;
+    authModeId?: string;
+    expiresAt?: string;
+    step?: LinkAuthorizationStep;
     prompt?: {
         userCode: string;
         verificationUri: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-link",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Framework-independent provider manifests and authorization guides for CodeShell Link.",
   "type": "module",
   "main": "./dist/index.js",