@deepseek-harness-tui/dsh-tui 0.11.2 → 0.12.0

package/lib/types/dsh-adapter/oauth/deepseek.js

@@ -0,0 +1,189 @@
+/**
+ * TUI interaction for the Host-owned DeepSeek account authorization flow.
+ *
+ * The Host owns PKCE, its callback route, credential persistence, and the
+ * `deepseek-account` LLM route. This module supplies a loopback callback
+ * origin, mounts the official Host listener when an older bundle patch omits
+ * it, and displays the Host's safe attempt state through the existing question
+ * panel. It never reads or writes the account grant.
+ */
+import { readFileSync } from 'node:fs';
+import { getLang } from '../../i18n.js';
+import { QuestionBridge } from './interaction.js';
+export const DEEPSEEK_ACCOUNT_PROVIDER = 'deepseek-account';
+/** Resolve late: the account provider is absent on older DSH hosts. */
+export function deepSeekAccountFrom(ctx) {
+    return ctx.get('deepseekAccount');
+}
+/** The Host webServer may be shared, supplied by the TUI row, or mounted as a fallback. */
+export function deepSeekCallbackOrigin(ctx) {
+    const server = ctx.get('webServer');
+    const port = server?.port;
+    if (port === undefined || !Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('DeepSeek sign-in needs an active Host webServer for the browser callback');
+    }
+    return `http://127.0.0.1:${port}`;
+}
+/**
+ * Keep DeepSeek login usable after a profile-only update from a global TUI
+ * whose older bundle patch still mounts `dsh-tui-auth` but has no webserver
+ * row. The official Host listener is mounted only on the first login that
+ * needs it; an existing Web or user-owned listener is never replaced.
+ */
+export function createDeepSeekCallbackOriginResolver(ctx) {
+    let fallback;
+    let mounting;
+    let disposed = false;
+    const mountFallback = async () => {
+        const { WebServer } = await import('@deepseek-ai/dsh-host-webserver');
+        if (disposed)
+            throw new Error('dsh-auth: callback listener owner was disposed');
+        // Another Host row may have become available while the import resolved.
+        if (ctx.get('webServer') !== undefined)
+            return;
+        const fiber = ctx.root.plugin(WebServer, { host: '127.0.0.1', port: 0 });
+        fallback = fiber;
+        try {
+            await fiber;
+        }
+        catch (error) {
+            fallback = undefined;
+            try {
+                await fiber.dispose();
+            }
+            catch (disposeError) {
+                throw new AggregateError([error, disposeError], 'DeepSeek callback listener failed to start and dispose');
+            }
+            throw error;
+        }
+    };
+    return {
+        resolve: async () => {
+            if (disposed)
+                throw new Error('dsh-auth: callback listener owner was disposed');
+            if (ctx.get('webServer') === undefined) {
+                // A declared but unavailable listener is a composition decision or
+                // failure, not the missing row of an older global TUI patch.
+                const loader = ctx.get('loader');
+                for (const entry of loader?.entries() ?? []) {
+                    if (entry.options.id === 'dsh-tui-webserver'
+                        || entry.options.name === '@deepseek-ai/dsh-host-webserver') {
+                        return deepSeekCallbackOrigin(ctx);
+                    }
+                }
+                mounting ??= mountFallback().finally(() => { mounting = undefined; });
+                try {
+                    await mounting;
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    throw new Error(`DeepSeek sign-in could not start a Host webServer callback listener: ${message}`, { cause: error });
+                }
+            }
+            if (disposed)
+                throw new Error('dsh-auth: callback listener owner was disposed');
+            return deepSeekCallbackOrigin(ctx);
+        },
+        dispose: async () => {
+            disposed = true;
+            await mounting?.catch(() => undefined);
+            await fallback?.dispose();
+            fallback = undefined;
+        },
+    };
+}
+const tuiVersion = (() => {
+    try {
+        const manifest = JSON.parse(readFileSync(new URL(import.meta.resolve('@deepseek-harness-tui/dsh-tui/package.json')), 'utf8'));
+        return typeof manifest.version === 'string' ? manifest.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
+/** Platform request identity is supplied by the current TUI, not cached by the Host. */
+export function deepSeekClientMetadata() {
+    return {
+        version: tuiVersion,
+        locale: getLang() === 'zh' ? 'zh-CN' : 'en-US',
+        timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60,
+    };
+}
+function succeeded(state, id) {
+    return state.attempt?.id === id && state.attempt.phase === 'succeeded' && state.status === 'credential-stored';
+}
+/**
+ * Start (or join) the upstream browser attempt, display its URL, and wait for
+ * the upstream state stream. Esc/external abort cancels the exact attempt;
+ * a commit that won that race is reported as success instead of a false
+ * cancellation. The question panel is always retired before returning.
+ */
+export async function loginDeepSeekAccount(account, callbackOrigin, ask, signal, helpers = {}) {
+    const runAbort = new AbortController();
+    const forwardAbort = () => runAbort.abort(signal?.reason);
+    if (signal !== undefined) {
+        if (signal.aborted)
+            forwardAbort();
+        else
+            signal.addEventListener('abort', forwardAbort, { once: true });
+    }
+    const bridge = new QuestionBridge(ask, runAbort, helpers);
+    let id;
+    let active = false;
+    try {
+        runAbort.signal.throwIfAborted();
+        // Match Desktop's login_source for Platform-side promotion eligibility.
+        const initial = await account.startSignIn(deepSeekClientMetadata(), callbackOrigin, 'desktop');
+        id = initial.attempt?.id;
+        if (id === undefined)
+            throw new Error('DeepSeek sign-in returned no attempt');
+        active = true;
+        runAbort.signal.throwIfAborted();
+        let shownUrl;
+        try {
+            for await (const state of account.watch(runAbort.signal)) {
+                const attempt = state.attempt;
+                if (attempt?.id !== id)
+                    throw new Error('DeepSeek sign-in attempt was replaced');
+                if (attempt.phase === 'waiting-browser' && attempt.authorizeUrl !== undefined
+                    && attempt.authorizeUrl !== shownUrl) {
+                    shownUrl = attempt.authorizeUrl;
+                    bridge.notify({ type: 'auth_url', url: shownUrl });
+                }
+                if (attempt.phase === 'succeeded') {
+                    active = false;
+                    if (!succeeded(state, id))
+                        throw new Error('DeepSeek sign-in succeeded without a stored credential');
+                    return;
+                }
+                if (attempt.phase === 'failed' || attempt.phase === 'expired' || attempt.phase === 'cancelled') {
+                    active = false;
+                    throw new Error(`DeepSeek sign-in ${attempt.phase}${attempt.errorCode === undefined ? '' : ` (${attempt.errorCode})`}`);
+                }
+            }
+        }
+        catch (error) {
+            if (!runAbort.signal.aborted)
+                throw error;
+        }
+        if (runAbort.signal.aborted) {
+            const afterCancel = await account.cancelSignIn(id);
+            active = false;
+            if (succeeded(afterCancel, id))
+                return;
+            throw new Error('DeepSeek sign-in cancelled');
+        }
+        throw new Error('DeepSeek sign-in state stream ended before completion');
+    }
+    finally {
+        signal?.removeEventListener('abort', forwardAbort);
+        runAbort.abort();
+        try {
+            if (active && id !== undefined)
+                await account.cancelSignIn(id);
+        }
+        finally {
+            await bridge.settle();
+        }
+    }
+}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/index.d.ts

@@ -1,21 +1,27 @@
 /**
- * dsh-auth — subscription OAuth sign-in as LLM provider routes.
+ * Built-in subscription OAuth sign-in as LLM provider routes.
  *
- * One cordis plugin mounts the pi-ai catalog providers that ship OAuth flows
- * (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as `llm` registry routes, so
- * their models appear in every model picker the moment the plugin loads —
- * signing in is the only missing credential. `PiAiAdapter` runs with this
- * plugin's file-backed pi-ai `CredentialStore` injected
+ * One internal Cordis module mounts supported subscription routes from the
+ * installed pi-ai catalog (ChatGPT/Codex, Claude, Grok, and newer flows when
+ * available) as `llm` registry routes. Signed-in models appear in model
+ * pickers; unsigned routes remain addressable for saved sessions. When the
+ * Host supplies `deepseekAccount`, the same sign-in surface also delegates
+ * DeepSeek browser authorization to that service; the Host owns its model
+ * route, callback, and credential store.
+ * `PiAiAdapter` runs with this
+ * module's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve the stored OAuth credential through
  * the provider's own auth and rotate refresh tokens under the store's lock.
  * Login/logout run over the `userQuestions` seam, so they work on any
  * interactive surface and refuse cleanly where none exists (TUI-RUN-001).
  *
  * ```yaml
- * - id: dsh-auth
- *   name: 'dsh-auth'
+ * - id: dsh-tui-auth
+ *   name: '@deepseek-harness-tui/dsh-tui/oauth'
+ *   inject: [llm, commands]
  *   config:
- *     providers: [openai-codex, anthropic, xai]   # subset of the mounted set
+ *     # providers: [openai-codex, anthropic, xai]  # optional catalog subset;
+ *     # newer pi-ai also offers openai and meta
  *     # credentialsFile: /secure/path/credentials.json   # default $DSH_HOME/dsh-auth/
  *     # Per-provider catalog overrides, keyed by provider id then model id:
  *     # any optional field keeps the installed catalog's value. The example
@@ -30,7 +36,7 @@
  * (an llm-pi-ai settings profile for the same provider) is refused by the
  * registry — that refusal is logged and the remaining routes still mount.
  *
- * @module dsh-auth
+ * @module @deepseek-harness-tui/dsh-tui/oauth
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
@@ -43,15 +49,14 @@ export declare const name = "dsh-auth";
  * Deliberately empty. A hard code-level inject would deadlock any
  * composition lacking the `llm`/`commands` services at boot ("pending
  * (waiting for service: …)") — the failure mode dsh-tui documented for its
- * own optional rows (#183). Both services resolve per call through
- * `ctx.get` in {@link apply}; compositions that guarantee them (the
- * dsh-tui patch row, this package's bundle patch) declare the inject at the
- * *entry* level, where a stale patch cannot deadlock a newer boot.
+ * optional rows (#183). Both services resolve per call through `ctx.get` in
+ * {@link apply}; the profile patch declares the inject at the *entry* level,
+ * where a stale patch cannot deadlock a newer boot.
  */
 export declare const inject: readonly string[];
 /** Plugin configuration. */
 export interface Config {
-    /** Provider routes to mount; every entry must ship an OAuth flow in the installed pi-ai catalog. */
+    /** Provider routes to mount; omitted means every supported flow in the installed pi-ai catalog. */
     providers?: string[];
     /** Credential file override; default `$DSH_HOME/dsh-auth/credentials.json`. */
     credentialsFile?: string;
@@ -70,7 +75,9 @@ export { QuestionBridge, describeEvent } from './interaction.js';
 export type { AskFn, QuestionBridgeHelpers } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, buildOAuthProfile, type ModelOverride } from './profiles.js';
+export { OAUTH_PROVIDER_IDS, availableOAuthProviderIds, buildOAuthProfile, type ModelOverride } from './profiles.js';
+export { DEEPSEEK_ACCOUNT_PROVIDER, deepSeekAccountFrom, deepSeekCallbackOrigin, deepSeekClientMetadata, loginDeepSeekAccount } from './deepseek.js';
+export { WhaleCouponStore } from './bonus.js';
 /**
  * The adapter the plugin registers: a {@link PiAiAdapter} whose *advisory
  * catalog* is credential-gated. A provider with no stored OAuth credential
@@ -92,3 +99,4 @@ export declare class CredentialGatedAdapter extends PiAiAdapter {
 }
 /** Mount the routes, the service, and the command. */
 export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/dsh-adapter/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,OAAO,KAAK,EAAc,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,EAAoE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AAOpH,eAAO,MAAM,IAAI,aAAa,CAAA;AAC9B;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,MAAM,EAAO,CAAA;AAgB3C,4BAA4B;AAC5B,MAAM,WAAW,MAAM;IACrB,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;CAC/D;AAOD,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAI3B,CAAA;AAEF,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACvG,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AACpH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAkB7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAuB,SAAQ,WAAW;IAGnD,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAD9B,OAAO,EAAE,kBAAkB,EACV,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;IAKzD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;CAI9E;AAED,sDAAsD;AACtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuHxD"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/index.js

@@ -1,21 +1,27 @@
 /**
- * dsh-auth — subscription OAuth sign-in as LLM provider routes.
+ * Built-in subscription OAuth sign-in as LLM provider routes.
  *
- * One cordis plugin mounts the pi-ai catalog providers that ship OAuth flows
- * (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as `llm` registry routes, so
- * their models appear in every model picker the moment the plugin loads —
- * signing in is the only missing credential. `PiAiAdapter` runs with this
- * plugin's file-backed pi-ai `CredentialStore` injected
+ * One internal Cordis module mounts supported subscription routes from the
+ * installed pi-ai catalog (ChatGPT/Codex, Claude, Grok, and newer flows when
+ * available) as `llm` registry routes. Signed-in models appear in model
+ * pickers; unsigned routes remain addressable for saved sessions. When the
+ * Host supplies `deepseekAccount`, the same sign-in surface also delegates
+ * DeepSeek browser authorization to that service; the Host owns its model
+ * route, callback, and credential store.
+ * `PiAiAdapter` runs with this
+ * module's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve the stored OAuth credential through
  * the provider's own auth and rotate refresh tokens under the store's lock.
  * Login/logout run over the `userQuestions` seam, so they work on any
  * interactive surface and refuse cleanly where none exists (TUI-RUN-001).
  *
  * ```yaml
- * - id: dsh-auth
- *   name: 'dsh-auth'
+ * - id: dsh-tui-auth
+ *   name: '@deepseek-harness-tui/dsh-tui/oauth'
+ *   inject: [llm, commands]
  *   config:
- *     providers: [openai-codex, anthropic, xai]   # subset of the mounted set
+ *     # providers: [openai-codex, anthropic, xai]  # optional catalog subset;
+ *     # newer pi-ai also offers openai and meta
  *     # credentialsFile: /secure/path/credentials.json   # default $DSH_HOME/dsh-auth/
  *     # Per-provider catalog overrides, keyed by provider id then model id:
  *     # any optional field keeps the installed catalog's value. The example
@@ -30,7 +36,7 @@
  * (an llm-pi-ai settings profile for the same provider) is refused by the
  * registry — that refusal is logged and the remaining routes still mount.
  *
- * @module dsh-auth
+ * @module @deepseek-harness-tui/dsh-tui/oauth
  */
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -38,18 +44,18 @@ import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
 import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai';
 import { CredentialFile, defaultCredentialsFile } from './credentials.js';
-import { buildOAuthProfile, OAUTH_PROVIDER_IDS } from './profiles.js';
+import { availableOAuthProviderIds, buildOAuthProfile, OAUTH_PROVIDER_IDS } from './profiles.js';
 import { createDshAuthApi, DshAuthService } from './service.js';
 import { createAuthCommandHandler } from './command.js';
+import { createDeepSeekCallbackOriginResolver, deepSeekAccountFrom } from './deepseek.js';
 export const name = 'dsh-auth';
 /**
  * Deliberately empty. A hard code-level inject would deadlock any
  * composition lacking the `llm`/`commands` services at boot ("pending
  * (waiting for service: …)") — the failure mode dsh-tui documented for its
- * own optional rows (#183). Both services resolve per call through
- * `ctx.get` in {@link apply}; compositions that guarantee them (the
- * dsh-tui patch row, this package's bundle patch) declare the inject at the
- * *entry* level, where a stale patch cannot deadlock a newer boot.
+ * optional rows (#183). Both services resolve per call through `ctx.get` in
+ * {@link apply}; the profile patch declares the inject at the *entry* level,
+ * where a stale patch cannot deadlock a newer boot.
  */
 export const inject = [];
 const modelOverride = z.object({
@@ -57,7 +63,7 @@ const modelOverride = z.object({
     maxTokens: z.number().step(1).min(1),
 });
 export const Config = z.object({
-    providers: z.array(z.string()).default([...OAUTH_PROVIDER_IDS]),
+    providers: z.array(z.string()).default(availableOAuthProviderIds()),
     credentialsFile: z.string(),
     modelOverrides: z.dict(z.dict(modelOverride)),
 });
@@ -65,7 +71,9 @@ export { createDshAuthApi } from './service.js';
 export { QuestionBridge, describeEvent } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, buildOAuthProfile } from './profiles.js';
+export { OAUTH_PROVIDER_IDS, availableOAuthProviderIds, buildOAuthProfile } from './profiles.js';
+export { DEEPSEEK_ACCOUNT_PROVIDER, deepSeekAccountFrom, deepSeekCallbackOrigin, deepSeekClientMetadata, loginDeepSeekAccount } from './deepseek.js';
+export { WhaleCouponStore } from './bonus.js';
 /**
  * The ambient auth context providers may consult while resolving their own
  * auth. `env()` answers from the process environment; `fileExists()` answers
@@ -107,7 +115,7 @@ export class CredentialGatedAdapter extends PiAiAdapter {
 }
 /** Mount the routes, the service, and the command. */
 export function apply(ctx, config) {
-    const configured = config.providers ?? [...OAUTH_PROVIDER_IDS];
+    const configured = config.providers ?? availableOAuthProviderIds();
     const unknown = configured.filter(id => !OAUTH_PROVIDER_IDS.includes(id));
     if (unknown.length > 0 || configured.length === 0) {
         throw new Error(`dsh-auth: providers must be a non-empty subset of [${OAUTH_PROVIDER_IDS.join(', ')}]; got [${configured.join(', ')}]`);
@@ -156,17 +164,23 @@ export function apply(ctx, config) {
     // the plugin module; the defensive get-then-create matches how the TUI
     // mounts userQuestions.
     const service = ctx.get('dshAuth') ?? new DshAuthService(ctx);
+    const callbackOrigin = createDeepSeekCallbackOriginResolver(ctx);
     const api = createDshAuthApi({
         profiles,
         store,
+        resolveDeepSeekAccount: () => deepSeekAccountFrom(ctx),
+        coupons: service.coupons,
+        resolveCallbackOrigin: callbackOrigin.resolve,
         resolveAsk: () => {
             const questions = ctx.get('userQuestions');
             return questions === undefined ? undefined : request => questions.ask(request);
         },
-        logger: ctx.logger,
     });
     service.api = api;
     ctx.effect(function* () {
+        // LIFO disposal: release command registration, drain started logins, then
+        // close a fallback callback listener only this module mounted.
+        yield () => callbackOrigin.dispose();
         const releases = [];
         // Runtime service resolution (never a code-level inject — see `inject`):
         // absent services keep this plugin inert and logged, not the whole boot
@@ -197,7 +211,7 @@ export function apply(ctx, config) {
             const handler = createAuthCommandHandler(api);
             releases.push(commands.register({
                 name: 'auth',
-                description: 'Provider subscription sign-in (OAuth): status, login, logout',
+                description: 'Provider account sign-in (OAuth): status, login, logout',
                 handler: invocation => {
                     const operation = handler(invocation);
                     active.add(operation);

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/interaction.d.ts

@@ -6,19 +6,17 @@
  * their options, text/secret/manual-code prompts expect the custom-answer
  * input row.
  *
- * `notify()` restores the host contract pi-ai's browser flows assume: the
- * `auth_url` / `device_code` events expect the *host* to open the browser
- * (their authorize URLs run hundreds of characters — wrapped across panel
- * lines they are unclickable, and hand-copying picks up wrap artifacts that
- * corrupt the encoded `redirect_uri`, which the provider then rejects). So
- * the bridge opens the URL itself, then shows one waiting panel carrying
- * copy / reopen / cancel actions until the flow settles. The device-code
- * path gets the same treatment: its short code is the thing to copy, and
- * the verification page is auto-opened too.
+ * `notify()` opens browser/device URLs for pi-ai. Browser flows immediately
+ * race a callback server against a `manual_code` prompt; the URL and
+ * copy/reopen/cancel actions therefore share that SAME question with the
+ * paste field. A separate waiting question would claim the FIFO question
+ * surface first and make remote/headless callback fallback unreachable.
+ * Browser flows without a manual prompt still get a waiting panel. Device
+ * flows use that panel to show/copy the short code until polling settles.
  *
  * One `AbortController` owns the whole run: pi-ai reads `interaction.signal`
- * to abort the flow, every ask request carries it so surfaces close their
- * panels, and the waiting panel's cancel action fires it.
+ * to abort the flow, ask requests compose it with per-prompt cancellation,
+ * and the waiting panel's cancel action fires it.
  *
  * Nothing here assumes a browser or GUI *exists* (TUI-RUN-001): when no
  * opener or clipboard helper is available the panel degrades to showing the
@@ -26,7 +24,7 @@
  * registered at all, `ask` rejects and the login command turns that into a
  * clear refusal.
  *
- * @module dsh-auth/interaction
+ * @module @deepseek-harness-tui/dsh-tui/oauth/interaction
  */
 import type { AskUserQuestionItem, AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-questions';
 import type { PiAiAuthEvent, PiAiAuthInteraction, PiAiAuthPrompt } from './pi-ai.js';
@@ -54,15 +52,19 @@ export declare class QuestionBridge implements PiAiAuthInteraction {
     private readonly openUrl;
     private readonly copy;
     private waiting;
+    private pendingBrowserView;
+    private notice;
     private waitingClosed;
     constructor(ask: AskFn, runAbort: AbortController, helpers?: QuestionBridgeHelpers);
     prompt(prompt: PiAiAuthPrompt): Promise<string>;
     notify(event: PiAiAuthEvent): void;
     /** Close the waiting panel (if any) and stop answering for this run. */
     settle(): Promise<void>;
+    private retireWaiting;
     /**
      * Show the waiting panel until the flow settles or the user cancels,
      * re-asking after a copy/reopen action with a one-line status prefix.
      */
     private runWaitingPanel;
 }
+//# sourceMappingURL=interaction.d.ts.map

package/lib/types/dsh-adapter/oauth/interaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/interaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAGjG,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEpF,4EAA4E;AAC5E,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,mBAAmB,EAAE,CAAA;IAChC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAA;AAEpC,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9C;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAU1D;AA6CD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,mBAAmB;IAatD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAb3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IACzD,OAAO,CAAC,OAAO,CAGF;IACb,OAAO,CAAC,kBAAkB,CAAyB;IACnD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,aAAa,CAAQ;gBAGV,GAAG,EAAE,KAAK,EACV,QAAQ,EAAE,eAAe,EAC1C,OAAO,GAAE,qBAA0B;IAO/B,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAqFrD,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAgClC,wEAAwE;IAClE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAOf,aAAa;IAM3B;;;OAGG;YACW,eAAe;CAgD9B"}