@deepseek-harness-tui/dsh-tui 0.11.1 → 0.12.0

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/index.js

@@ -1,21 +1,27 @@
 /**
- * dsh-auth — subscription OAuth sign-in as LLM provider routes.
+ * Built-in subscription OAuth sign-in as LLM provider routes.
  *
- * One cordis plugin mounts the pi-ai catalog providers that ship OAuth flows
- * (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as `llm` registry routes, so
- * their models appear in every model picker the moment the plugin loads —
- * signing in is the only missing credential. `PiAiAdapter` runs with this
- * plugin's file-backed pi-ai `CredentialStore` injected
+ * One internal Cordis module mounts supported subscription routes from the
+ * installed pi-ai catalog (ChatGPT/Codex, Claude, Grok, and newer flows when
+ * available) as `llm` registry routes. Signed-in models appear in model
+ * pickers; unsigned routes remain addressable for saved sessions. When the
+ * Host supplies `deepseekAccount`, the same sign-in surface also delegates
+ * DeepSeek browser authorization to that service; the Host owns its model
+ * route, callback, and credential store.
+ * `PiAiAdapter` runs with this
+ * module's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve the stored OAuth credential through
  * the provider's own auth and rotate refresh tokens under the store's lock.
  * Login/logout run over the `userQuestions` seam, so they work on any
  * interactive surface and refuse cleanly where none exists (TUI-RUN-001).
  *
  * ```yaml
- * - id: dsh-auth
- *   name: 'dsh-auth'
+ * - id: dsh-tui-auth
+ *   name: '@deepseek-harness-tui/dsh-tui/oauth'
+ *   inject: [llm, commands]
  *   config:
- *     providers: [openai-codex, anthropic, xai]   # subset of the mounted set
+ *     # providers: [openai-codex, anthropic, xai]  # optional catalog subset;
+ *     # newer pi-ai also offers openai and meta
  *     # credentialsFile: /secure/path/credentials.json   # default $DSH_HOME/dsh-auth/
  *     # Per-provider catalog overrides, keyed by provider id then model id:
  *     # any optional field keeps the installed catalog's value. The example
@@ -30,7 +36,7 @@
  * (an llm-pi-ai settings profile for the same provider) is refused by the
  * registry — that refusal is logged and the remaining routes still mount.
  *
- * @module dsh-auth
+ * @module @deepseek-harness-tui/dsh-tui/oauth
  */
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -38,18 +44,18 @@ import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
 import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai';
 import { CredentialFile, defaultCredentialsFile } from './credentials.js';
-import { buildOAuthProfile, OAUTH_PROVIDER_IDS } from './profiles.js';
+import { availableOAuthProviderIds, buildOAuthProfile, OAUTH_PROVIDER_IDS } from './profiles.js';
 import { createDshAuthApi, DshAuthService } from './service.js';
 import { createAuthCommandHandler } from './command.js';
+import { createDeepSeekCallbackOriginResolver, deepSeekAccountFrom } from './deepseek.js';
 export const name = 'dsh-auth';
 /**
  * Deliberately empty. A hard code-level inject would deadlock any
  * composition lacking the `llm`/`commands` services at boot ("pending
  * (waiting for service: …)") — the failure mode dsh-tui documented for its
- * own optional rows (#183). Both services resolve per call through
- * `ctx.get` in {@link apply}; compositions that guarantee them (the
- * dsh-tui patch row, this package's bundle patch) declare the inject at the
- * *entry* level, where a stale patch cannot deadlock a newer boot.
+ * optional rows (#183). Both services resolve per call through `ctx.get` in
+ * {@link apply}; the profile patch declares the inject at the *entry* level,
+ * where a stale patch cannot deadlock a newer boot.
  */
 export const inject = [];
 const modelOverride = z.object({
@@ -57,7 +63,7 @@ const modelOverride = z.object({
     maxTokens: z.number().step(1).min(1),
 });
 export const Config = z.object({
-    providers: z.array(z.string()).default([...OAUTH_PROVIDER_IDS]),
+    providers: z.array(z.string()).default(availableOAuthProviderIds()),
     credentialsFile: z.string(),
     modelOverrides: z.dict(z.dict(modelOverride)),
 });
@@ -65,7 +71,9 @@ export { createDshAuthApi } from './service.js';
 export { QuestionBridge, describeEvent } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, buildOAuthProfile } from './profiles.js';
+export { OAUTH_PROVIDER_IDS, availableOAuthProviderIds, buildOAuthProfile } from './profiles.js';
+export { DEEPSEEK_ACCOUNT_PROVIDER, deepSeekAccountFrom, deepSeekCallbackOrigin, deepSeekClientMetadata, loginDeepSeekAccount } from './deepseek.js';
+export { WhaleCouponStore } from './bonus.js';
 /**
  * The ambient auth context providers may consult while resolving their own
  * auth. `env()` answers from the process environment; `fileExists()` answers
@@ -107,7 +115,7 @@ export class CredentialGatedAdapter extends PiAiAdapter {
 }
 /** Mount the routes, the service, and the command. */
 export function apply(ctx, config) {
-    const configured = config.providers ?? [...OAUTH_PROVIDER_IDS];
+    const configured = config.providers ?? availableOAuthProviderIds();
     const unknown = configured.filter(id => !OAUTH_PROVIDER_IDS.includes(id));
     if (unknown.length > 0 || configured.length === 0) {
         throw new Error(`dsh-auth: providers must be a non-empty subset of [${OAUTH_PROVIDER_IDS.join(', ')}]; got [${configured.join(', ')}]`);
@@ -156,17 +164,23 @@ export function apply(ctx, config) {
     // the plugin module; the defensive get-then-create matches how the TUI
     // mounts userQuestions.
     const service = ctx.get('dshAuth') ?? new DshAuthService(ctx);
+    const callbackOrigin = createDeepSeekCallbackOriginResolver(ctx);
     const api = createDshAuthApi({
         profiles,
         store,
+        resolveDeepSeekAccount: () => deepSeekAccountFrom(ctx),
+        coupons: service.coupons,
+        resolveCallbackOrigin: callbackOrigin.resolve,
         resolveAsk: () => {
             const questions = ctx.get('userQuestions');
             return questions === undefined ? undefined : request => questions.ask(request);
         },
-        logger: ctx.logger,
     });
     service.api = api;
     ctx.effect(function* () {
+        // LIFO disposal: release command registration, drain started logins, then
+        // close a fallback callback listener only this module mounted.
+        yield () => callbackOrigin.dispose();
         const releases = [];
         // Runtime service resolution (never a code-level inject — see `inject`):
         // absent services keep this plugin inert and logged, not the whole boot
@@ -197,7 +211,7 @@ export function apply(ctx, config) {
             const handler = createAuthCommandHandler(api);
             releases.push(commands.register({
                 name: 'auth',
-                description: 'Provider subscription sign-in (OAuth): status, login, logout',
+                description: 'Provider account sign-in (OAuth): status, login, logout',
                 handler: invocation => {
                     const operation = handler(invocation);
                     active.add(operation);

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/interaction.d.ts

@@ -6,19 +6,17 @@
  * their options, text/secret/manual-code prompts expect the custom-answer
  * input row.
  *
- * `notify()` restores the host contract pi-ai's browser flows assume: the
- * `auth_url` / `device_code` events expect the *host* to open the browser
- * (their authorize URLs run hundreds of characters — wrapped across panel
- * lines they are unclickable, and hand-copying picks up wrap artifacts that
- * corrupt the encoded `redirect_uri`, which the provider then rejects). So
- * the bridge opens the URL itself, then shows one waiting panel carrying
- * copy / reopen / cancel actions until the flow settles. The device-code
- * path gets the same treatment: its short code is the thing to copy, and
- * the verification page is auto-opened too.
+ * `notify()` opens browser/device URLs for pi-ai. Browser flows immediately
+ * race a callback server against a `manual_code` prompt; the URL and
+ * copy/reopen/cancel actions therefore share that SAME question with the
+ * paste field. A separate waiting question would claim the FIFO question
+ * surface first and make remote/headless callback fallback unreachable.
+ * Browser flows without a manual prompt still get a waiting panel. Device
+ * flows use that panel to show/copy the short code until polling settles.
  *
  * One `AbortController` owns the whole run: pi-ai reads `interaction.signal`
- * to abort the flow, every ask request carries it so surfaces close their
- * panels, and the waiting panel's cancel action fires it.
+ * to abort the flow, ask requests compose it with per-prompt cancellation,
+ * and the waiting panel's cancel action fires it.
  *
  * Nothing here assumes a browser or GUI *exists* (TUI-RUN-001): when no
  * opener or clipboard helper is available the panel degrades to showing the
@@ -26,7 +24,7 @@
  * registered at all, `ask` rejects and the login command turns that into a
  * clear refusal.
  *
- * @module dsh-auth/interaction
+ * @module @deepseek-harness-tui/dsh-tui/oauth/interaction
  */
 import type { AskUserQuestionItem, AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-questions';
 import type { PiAiAuthEvent, PiAiAuthInteraction, PiAiAuthPrompt } from './pi-ai.js';
@@ -54,15 +52,19 @@ export declare class QuestionBridge implements PiAiAuthInteraction {
     private readonly openUrl;
     private readonly copy;
     private waiting;
+    private pendingBrowserView;
+    private notice;
     private waitingClosed;
     constructor(ask: AskFn, runAbort: AbortController, helpers?: QuestionBridgeHelpers);
     prompt(prompt: PiAiAuthPrompt): Promise<string>;
     notify(event: PiAiAuthEvent): void;
     /** Close the waiting panel (if any) and stop answering for this run. */
     settle(): Promise<void>;
+    private retireWaiting;
     /**
      * Show the waiting panel until the flow settles or the user cancels,
      * re-asking after a copy/reopen action with a one-line status prefix.
      */
     private runWaitingPanel;
 }
+//# sourceMappingURL=interaction.d.ts.map

package/lib/types/dsh-adapter/oauth/interaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/interaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAGjG,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEpF,4EAA4E;AAC5E,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,mBAAmB,EAAE,CAAA;IAChC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAA;AAEpC,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9C;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAU1D;AA6CD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,mBAAmB;IAatD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAb3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IACzD,OAAO,CAAC,OAAO,CAGF;IACb,OAAO,CAAC,kBAAkB,CAAyB;IACnD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,aAAa,CAAQ;gBAGV,GAAG,EAAE,KAAK,EACV,QAAQ,EAAE,eAAe,EAC1C,OAAO,GAAE,qBAA0B;IAO/B,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAqFrD,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAgClC,wEAAwE;IAClE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAOf,aAAa;IAM3B;;;OAGG;YACW,eAAe;CAgD9B"}

package/lib/types/dsh-adapter/oauth/interaction.js

@@ -0,0 +1,283 @@
+/**
+ * The `AuthInteraction` bridge: pi-ai OAuth flows speak prompts and events;
+ * every interactive surface in this ecosystem speaks `ctx.userQuestions`.
+ *
+ * `prompt()` maps one pi-ai prompt onto one question — `select` prompts carry
+ * their options, text/secret/manual-code prompts expect the custom-answer
+ * input row.
+ *
+ * `notify()` opens browser/device URLs for pi-ai. Browser flows immediately
+ * race a callback server against a `manual_code` prompt; the URL and
+ * copy/reopen/cancel actions therefore share that SAME question with the
+ * paste field. A separate waiting question would claim the FIFO question
+ * surface first and make remote/headless callback fallback unreachable.
+ * Browser flows without a manual prompt still get a waiting panel. Device
+ * flows use that panel to show/copy the short code until polling settles.
+ *
+ * One `AbortController` owns the whole run: pi-ai reads `interaction.signal`
+ * to abort the flow, ask requests compose it with per-prompt cancellation,
+ * and the waiting panel's cancel action fires it.
+ *
+ * Nothing here assumes a browser or GUI *exists* (TUI-RUN-001): when no
+ * opener or clipboard helper is available the panel degrades to showing the
+ * URL / code verbatim with a clear note, and where no question provider is
+ * registered at all, `ask` rejects and the login command turns that into a
+ * clear refusal.
+ *
+ * @module @deepseek-harness-tui/dsh-tui/oauth/interaction
+ */
+import { t } from '../../i18n.js';
+import { copyToClipboard, openInBrowser } from './opener.js';
+/** Human-readable copy for one notify event. */
+export function describeEvent(event) {
+    switch (event.type) {
+        case 'auth_url':
+            return t('oauth-event-auth-url', { url: event.url });
+        case 'device_code':
+            return t('oauth-event-device-code', { uri: event.verificationUri, code: event.userCode });
+        case 'info':
+        case 'progress':
+            return event.message;
+    }
+}
+/** One answer row, or a thrown error when the surface returned nothing usable. */
+function singleAnswer(answer) {
+    const row = answer.answers[0];
+    if (row === undefined)
+        throw new Error('dsh-auth: the question surface returned no answer');
+    return { selected: row.selected[0], custom: row.custom };
+}
+function authUrlView(url, instructions, opened, notice) {
+    const lead = opened
+        ? `${t('oauth-auth-url-opened')}\n${t('oauth-auth-url-opened-fallback')}`
+        : `${t('oauth-auth-url-manual')}\n${t('oauth-auth-url-copy-hint')}`;
+    const body = [notice, lead, instructions, url].filter(part => part !== undefined && part !== '').join('\n');
+    return {
+        kind: 'auth_url', body, copyLabel: t('oauth-copy-link'), copyText: url,
+        reopenLabel: t('oauth-open-again'), cancelLabel: t('oauth-cancel'), reopenUrl: url,
+    };
+}
+function deviceCodeView(userCode, verificationUri, opened) {
+    const lead = opened
+        ? t('oauth-device-opened', { uri: verificationUri })
+        : t('oauth-device-manual', { uri: verificationUri });
+    return {
+        kind: 'device_code', body: `${lead}\n  ${userCode}`,
+        copyLabel: t('oauth-copy-code'), copyText: userCode,
+        reopenLabel: t('oauth-open-again'), cancelLabel: t('oauth-cancel'), reopenUrl: verificationUri,
+    };
+}
+/**
+ * The bridge for one login run. At most one waiting panel exists at a time;
+ * `settle()` retires it when the flow ends (any outcome), so a completed or
+ * failed login never leaves an interactive dead end on screen.
+ */
+export class QuestionBridge {
+    ask;
+    runAbort;
+    signal;
+    openUrl;
+    copy;
+    waiting;
+    pendingBrowserView;
+    notice;
+    waitingClosed = false;
+    constructor(ask, runAbort, helpers = {}) {
+        this.ask = ask;
+        this.runAbort = runAbort;
+        this.signal = runAbort.signal;
+        this.openUrl = helpers.openUrl ?? openInBrowser;
+        this.copy = helpers.copyText ?? copyToClipboard;
+    }
+    async prompt(prompt) {
+        if (this.waitingClosed)
+            throw new Error('Login cancelled');
+        const browserView = prompt.type === 'manual_code' ? this.pendingBrowserView : undefined;
+        if (browserView !== undefined) {
+            this.pendingBrowserView = undefined;
+            await this.retireWaiting();
+        }
+        // pi-ai's callback race supplies a per-prompt abort signal. It must not
+        // replace the login-wide signal: cancelling either one closes the ask.
+        const signal = prompt.signal === undefined ? this.signal : AbortSignal.any([prompt.signal, this.signal]);
+        const secretNote = prompt.type === 'secret' ? t('oauth-secret-unmasked') : '';
+        let actionNote;
+        while (true) {
+            if (this.waitingClosed)
+                throw new Error('Login cancelled');
+            signal.throwIfAborted();
+            const question = prompt.type === 'select'
+                ? {
+                    id: 'dsh-auth-prompt',
+                    header: 'dsh-auth',
+                    question: prompt.message,
+                    options: prompt.options.map(option => ({
+                        label: option.label,
+                        ...(option.description === undefined ? {} : { description: option.description }),
+                    })),
+                }
+                : {
+                    id: 'dsh-auth-prompt',
+                    header: 'dsh-auth',
+                    question: prompt.message,
+                    ...(browserView === undefined
+                        ? (prompt.placeholder === undefined
+                            ? (secretNote === '' ? {} : { detail: secretNote })
+                            : { detail: [prompt.placeholder, secretNote].filter(part => part !== '').join('\n') })
+                        : {
+                            detail: [actionNote, browserView.body].filter(part => part !== undefined).join('\n'),
+                            options: [
+                                { label: browserView.copyLabel },
+                                { label: browserView.reopenLabel },
+                                { label: browserView.cancelLabel },
+                            ],
+                        }),
+                };
+            let answer;
+            try {
+                answer = singleAnswer(await this.ask({ questions: [question], signal }));
+            }
+            catch (error) {
+                if (typeof error === 'object' && error !== null
+                    && error.code === 'ASK_CANCELLED') {
+                    this.runAbort.abort('user cancelled sign-in');
+                }
+                throw error;
+            }
+            signal.throwIfAborted();
+            if (prompt.type === 'select') {
+                const label = answer.selected;
+                const option = label === undefined ? undefined : prompt.options.find(candidate => candidate.label === label);
+                if (option === undefined) {
+                    if (answer.custom !== undefined && answer.custom !== '')
+                        return answer.custom;
+                    throw new Error('dsh-auth: the selection answer did not match an offered option');
+                }
+                return option.id;
+            }
+            // The TUI may attach the focused option label while typing on it;
+            // entered callback text takes precedence over a copy/reopen action.
+            const custom = answer.custom?.trim();
+            if (custom !== undefined && custom !== '')
+                return custom;
+            if (browserView === undefined)
+                throw new Error('dsh-auth: the text answer was empty');
+            if (answer.selected === browserView.copyLabel) {
+                const copied = await this.copy(browserView.copyText).catch(() => false);
+                actionNote = t(copied ? 'oauth-copied' : 'oauth-copy-failed');
+                continue;
+            }
+            if (answer.selected === browserView.reopenLabel) {
+                const opened = this.openUrl(browserView.reopenUrl);
+                actionNote = t(opened ? 'oauth-reopened' : 'oauth-open-failed');
+                continue;
+            }
+            if (answer.selected === browserView.cancelLabel) {
+                this.runAbort.abort('user cancelled sign-in');
+                throw new Error('Login cancelled');
+            }
+            throw new Error('dsh-auth: the authorization question returned no action or code');
+        }
+    }
+    notify(event) {
+        if (this.waitingClosed || this.signal.aborted)
+            return;
+        if (event.type === 'info') {
+            this.notice = event.message;
+            return;
+        }
+        if (event.type === 'auth_url') {
+            if (this.pendingBrowserView !== undefined)
+                return;
+            const opened = this.openUrl(event.url);
+            const view = authUrlView(event.url, event.instructions, opened, this.notice);
+            this.notice = undefined;
+            this.pendingBrowserView = view;
+            // Current pi-ai browser flows call manual_code synchronously after
+            // notify. Defer the fallback panel one microtask so that prompt can
+            // consume this view without placing a second ask in the FIFO queue.
+            queueMicrotask(() => {
+                if (this.pendingBrowserView === view && !this.waitingClosed) {
+                    void this.runWaitingPanel(view).catch(() => this.runAbort.abort('authorization panel failed'));
+                }
+            });
+            return;
+        }
+        if (event.type === 'device_code') {
+            if (this.waiting !== undefined)
+                return;
+            const opened = this.openUrl(event.verificationUri);
+            void this.runWaitingPanel(deviceCodeView(event.userCode, event.verificationUri, opened))
+                .catch(() => this.runAbort.abort('authorization panel failed'));
+        }
+        // Progress lines are transient; the flow's next prompt or waiting panel
+        // carries the actionable state.
+    }
+    /** Close the waiting panel (if any) and stop answering for this run. */
+    async settle() {
+        this.waitingClosed = true;
+        this.pendingBrowserView = undefined;
+        await this.retireWaiting();
+        this.waiting = undefined;
+    }
+    async retireWaiting() {
+        const waiting = this.waiting;
+        waiting?.controller.abort();
+        await waiting?.answer;
+    }
+    /**
+     * Show the waiting panel until the flow settles or the user cancels,
+     * re-asking after a copy/reopen action with a one-line status prefix.
+     */
+    async runWaitingPanel(view) {
+        let body = view.body;
+        const active = () => !this.waitingClosed && !this.signal.aborted
+            && (view.kind === 'device_code' || this.pendingBrowserView === view);
+        while (active()) {
+            const controller = new AbortController();
+            const answer = this.ask({
+                questions: [{
+                        id: 'dsh-auth-waiting',
+                        header: 'dsh-auth',
+                        question: t('oauth-waiting'),
+                        detail: body,
+                        options: [
+                            { label: view.copyLabel },
+                            { label: view.reopenLabel },
+                            { label: view.cancelLabel },
+                        ],
+                    }],
+                signal: AbortSignal.any([controller.signal, this.signal]),
+            })
+                .then(singleAnswer)
+                .catch(() => {
+                if (!controller.signal.aborted && active())
+                    this.runAbort.abort('authorization panel was dismissed');
+                return undefined;
+            });
+            this.waiting = { controller, answer };
+            const response = await answer;
+            if (this.waiting?.controller === controller)
+                this.waiting = undefined;
+            if (response === undefined || !active())
+                return;
+            if (response.selected === undefined) {
+                body = `${t('oauth-choose-action')}\n${view.body}`;
+                continue;
+            }
+            if (response.selected === view.cancelLabel) {
+                this.runAbort.abort('user cancelled sign-in');
+                return;
+            }
+            if (response.selected === view.copyLabel) {
+                const copied = await this.copy(view.copyText).catch(() => false);
+                body = `${t(copied ? 'oauth-copied' : 'oauth-copy-failed')}\n${view.body}`;
+                continue;
+            }
+            if (response.selected === view.reopenLabel) {
+                const opened = this.openUrl(view.reopenUrl);
+                body = `${t(opened ? 'oauth-reopened' : 'oauth-open-failed')}\n${view.body}`;
+            }
+        }
+    }
+}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/opener.d.ts

@@ -11,7 +11,7 @@
  * Every path is best-effort and never throws: a missing opener or clipboard
  * degrades to the URL staying on screen with a copy action.
  *
- * @module dsh-auth/opener
+ * @module @deepseek-harness-tui/dsh-tui/oauth/opener
  */
 /** The browser-opening command for this platform, or undefined when unknown. */
 export declare function openerFor(url: string): {
@@ -30,3 +30,4 @@ export declare function openInBrowser(url: string): boolean;
  * order. Resolves whether one succeeded; never rejects.
  */
 export declare function copyToClipboard(text: string): Promise<boolean>;
+//# sourceMappingURL=opener.d.ts.map

package/lib/types/dsh-adapter/oauth/opener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opener.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/opener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAkBlH;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBlD;AA8BD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKpE"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/opener.js

@@ -11,7 +11,7 @@
  * Every path is best-effort and never throws: a missing opener or clipboard
  * degrades to the URL staying on screen with a copy action.
  *
- * @module dsh-auth/opener
+ * @module @deepseek-harness-tui/dsh-tui/oauth/opener
  */
 import { spawn } from 'node:child_process';
 /** The browser-opening command for this platform, or undefined when unknown. */

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/pi-ai.d.ts

@@ -1,9 +1,9 @@
 /**
  * The pi-ai instance owned by the installed dsh-llm-pi-ai adapter.
  *
- * dsh-llm-pi-ai rc.2 depends on pi-ai 0.82.x while alpha.1 depends on 0.84.x.
- * Loading a second catalog from dsh-auth and handing its Provider objects to
- * the adapter crosses package instances and is neither type- nor runtime-safe.
+ * Different host prereleases can depend on different pi-ai versions. Loading
+ * a second catalog in this module and handing its Provider objects to the
+ * adapter crosses package instances and is neither type- nor runtime-safe.
  * Resolve the adapter's own dependency instead, and derive every public type
  * from the adapter contract so this package owns no pi-ai version.
  */
@@ -18,6 +18,13 @@ type PiAiOAuth = NonNullable<PiAiProvider['auth']['oauth']>;
 export type PiAiAuthInteraction = Parameters<PiAiOAuth['login']>[0];
 export type PiAiAuthPrompt = Parameters<PiAiAuthInteraction['prompt']>[0];
 export type PiAiAuthEvent = Parameters<PiAiAuthInteraction['notify']>[0];
+/** pi-ai 0.87.1 added this optional login context; older flows ignore it. */
+export interface PiAiLoginOptions {
+    getDeviceId?: () => string;
+}
+/** Keep the optional second argument compatible with older adapter typings. */
+export declare function loginOAuth(oauth: PiAiOAuth, interaction: PiAiAuthInteraction, options: PiAiLoginOptions): ReturnType<PiAiOAuth['login']>;
 /** Fresh Provider objects from the exact pi-ai module used by dsh-llm-pi-ai. */
 export declare const adapterBuiltinProviders: () => readonly PiAiProvider[];
 export {};
+//# sourceMappingURL=pi-ai.d.ts.map

package/lib/types/dsh-adapter/oauth/pi-ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-ai.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/pi-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAMjG,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAA;AAEjF,KAAK,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;AAC1C,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AACrD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AACzD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1F,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzF,KAAK,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAExE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;CAC3B;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,gBAAgB,GACxB,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAKhC;AAmBD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,QAjBd,SAAS,YAAY,EAiBoB,CAAA"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/pi-ai.js

@@ -1,9 +1,9 @@
 /**
  * The pi-ai instance owned by the installed dsh-llm-pi-ai adapter.
  *
- * dsh-llm-pi-ai rc.2 depends on pi-ai 0.82.x while alpha.1 depends on 0.84.x.
- * Loading a second catalog from dsh-auth and handing its Provider objects to
- * the adapter crosses package instances and is neither type- nor runtime-safe.
+ * Different host prereleases can depend on different pi-ai versions. Loading
+ * a second catalog in this module and handing its Provider objects to the
+ * adapter crosses package instances and is neither type- nor runtime-safe.
  * Resolve the adapter's own dependency instead, and derive every public type
  * from the adapter contract so this package owns no pi-ai version.
  */
@@ -11,6 +11,11 @@ import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
+/** Keep the optional second argument compatible with older adapter typings. */
+export function loginOAuth(oauth, interaction, options) {
+    const compatible = oauth;
+    return compatible.login(interaction, options);
+}
 /** Locate the first pi-ai catalog Node would resolve from dsh-llm-pi-ai. */
 function adapterCatalogUrl() {
     const adapterManifest = import.meta.resolve('@deepseek-ai/dsh-llm-pi-ai/package.json');

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/profiles.d.ts

@@ -11,14 +11,16 @@
  * (llm-pi-ai's own `DEFAULT_*` constants are not exported; the values below
  * are those constants, and the comment on each says so).
  *
- * @module dsh-auth/profiles
+ * @module @deepseek-harness-tui/dsh-tui/oauth/profiles
  */
 import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
 import { type PiAiProvider } from './pi-ai.js';
-/** Provider routes this build mounts, in picker order. */
-export declare const OAUTH_PROVIDER_IDS: readonly ["openai-codex", "anthropic", "xai"];
+/** Subscription routes this build can mount, in picker order. */
+export declare const OAUTH_PROVIDER_IDS: readonly ["openai", "openai-codex", "anthropic", "xai", "meta"];
 /** One routable provider id. */
 export type OAuthProviderId = (typeof OAUTH_PROVIDER_IDS)[number];
+/** Mount only flows actually shipped by the adapter's pi-ai instance. */
+export declare function availableOAuthProviderIds(): OAuthProviderId[];
 /**
  * One per-model catalog override a deployment may name, keyed by model id.
  * Every field is optional; an absent field keeps the installed catalog's
@@ -43,3 +45,4 @@ export declare function oauthOf(route: PiAiProvider): NonNullable<PiAiProvider['
  *   {@link ModelOverride}); `undefined` serves the installed catalog unchanged.
  */
 export declare function buildOAuthProfile(id: string, modelOverrides?: Readonly<Record<string, ModelOverride>>): ResolvedPiAiProviderProfile;
+//# sourceMappingURL=profiles.d.ts.map

package/lib/types/dsh-adapter/oauth/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAC7E,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AAEvE,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,iEAAkE,CAAA;AAEjG,gCAAgC;AAChC,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE,yEAAyE;AACzE,wBAAgB,yBAAyB,IAAI,eAAe,EAAE,CAG7D;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAuBD,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAMvF;AAmCD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GACvD,2BAA2B,CAuB7B"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/profiles.js

@@ -11,12 +11,17 @@
  * (llm-pi-ai's own `DEFAULT_*` constants are not exported; the values below
  * are those constants, and the comment on each says so).
  *
- * @module dsh-auth/profiles
+ * @module @deepseek-harness-tui/dsh-tui/oauth/profiles
  */
 import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
 import { adapterBuiltinProviders } from './pi-ai.js';
-/** Provider routes this build mounts, in picker order. */
-export const OAUTH_PROVIDER_IDS = ['openai-codex', 'anthropic', 'xai'];
+/** Subscription routes this build can mount, in picker order. */
+export const OAUTH_PROVIDER_IDS = ['openai', 'openai-codex', 'anthropic', 'xai', 'meta'];
+/** Mount only flows actually shipped by the adapter's pi-ai instance. */
+export function availableOAuthProviderIds() {
+    const catalog = new Map(adapterBuiltinProviders().map(provider => [provider.id, provider]));
+    return OAUTH_PROVIDER_IDS.filter(id => catalog.get(id)?.auth.oauth !== undefined);
+}
 /** llm-pi-ai `DEFAULT_MAX_REQUEST_IMAGE_BYTES` (20 MiB, base64 payload bound). */
 const MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
 /** llm-pi-ai `DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET` (2048×2048 pixels). */
@@ -86,6 +91,9 @@ export function buildOAuthProfile(id, modelOverrides) {
         throw new Error(`dsh-auth: "${id}" is not an OAuth provider this build mounts (${OAUTH_PROVIDER_IDS.join(', ')})`);
     }
     const catalog = withModelOverrides(catalogProviderOf(id), modelOverrides);
+    // An older pi-ai catalog can know the route but not its newer OAuth flow
+    // (notably `openai`). Explicit requests must fail at boot, not at /auth.
+    oauthOf(catalog);
     return {
         provider: id,
         displayName: catalog.name,