@deepseek-harness-tui/dsh-tui 0.11.2 → 0.12.0

package/lib/types/dsh-adapter/oauth/interaction.js

@@ -0,0 +1,283 @@
+/**
+ * The `AuthInteraction` bridge: pi-ai OAuth flows speak prompts and events;
+ * every interactive surface in this ecosystem speaks `ctx.userQuestions`.
+ *
+ * `prompt()` maps one pi-ai prompt onto one question — `select` prompts carry
+ * their options, text/secret/manual-code prompts expect the custom-answer
+ * input row.
+ *
+ * `notify()` opens browser/device URLs for pi-ai. Browser flows immediately
+ * race a callback server against a `manual_code` prompt; the URL and
+ * copy/reopen/cancel actions therefore share that SAME question with the
+ * paste field. A separate waiting question would claim the FIFO question
+ * surface first and make remote/headless callback fallback unreachable.
+ * Browser flows without a manual prompt still get a waiting panel. Device
+ * flows use that panel to show/copy the short code until polling settles.
+ *
+ * One `AbortController` owns the whole run: pi-ai reads `interaction.signal`
+ * to abort the flow, ask requests compose it with per-prompt cancellation,
+ * and the waiting panel's cancel action fires it.
+ *
+ * Nothing here assumes a browser or GUI *exists* (TUI-RUN-001): when no
+ * opener or clipboard helper is available the panel degrades to showing the
+ * URL / code verbatim with a clear note, and where no question provider is
+ * registered at all, `ask` rejects and the login command turns that into a
+ * clear refusal.
+ *
+ * @module @deepseek-harness-tui/dsh-tui/oauth/interaction
+ */
+import { t } from '../../i18n.js';
+import { copyToClipboard, openInBrowser } from './opener.js';
+/** Human-readable copy for one notify event. */
+export function describeEvent(event) {
+    switch (event.type) {
+        case 'auth_url':
+            return t('oauth-event-auth-url', { url: event.url });
+        case 'device_code':
+            return t('oauth-event-device-code', { uri: event.verificationUri, code: event.userCode });
+        case 'info':
+        case 'progress':
+            return event.message;
+    }
+}
+/** One answer row, or a thrown error when the surface returned nothing usable. */
+function singleAnswer(answer) {
+    const row = answer.answers[0];
+    if (row === undefined)
+        throw new Error('dsh-auth: the question surface returned no answer');
+    return { selected: row.selected[0], custom: row.custom };
+}
+function authUrlView(url, instructions, opened, notice) {
+    const lead = opened
+        ? `${t('oauth-auth-url-opened')}\n${t('oauth-auth-url-opened-fallback')}`
+        : `${t('oauth-auth-url-manual')}\n${t('oauth-auth-url-copy-hint')}`;
+    const body = [notice, lead, instructions, url].filter(part => part !== undefined && part !== '').join('\n');
+    return {
+        kind: 'auth_url', body, copyLabel: t('oauth-copy-link'), copyText: url,
+        reopenLabel: t('oauth-open-again'), cancelLabel: t('oauth-cancel'), reopenUrl: url,
+    };
+}
+function deviceCodeView(userCode, verificationUri, opened) {
+    const lead = opened
+        ? t('oauth-device-opened', { uri: verificationUri })
+        : t('oauth-device-manual', { uri: verificationUri });
+    return {
+        kind: 'device_code', body: `${lead}\n  ${userCode}`,
+        copyLabel: t('oauth-copy-code'), copyText: userCode,
+        reopenLabel: t('oauth-open-again'), cancelLabel: t('oauth-cancel'), reopenUrl: verificationUri,
+    };
+}
+/**
+ * The bridge for one login run. At most one waiting panel exists at a time;
+ * `settle()` retires it when the flow ends (any outcome), so a completed or
+ * failed login never leaves an interactive dead end on screen.
+ */
+export class QuestionBridge {
+    ask;
+    runAbort;
+    signal;
+    openUrl;
+    copy;
+    waiting;
+    pendingBrowserView;
+    notice;
+    waitingClosed = false;
+    constructor(ask, runAbort, helpers = {}) {
+        this.ask = ask;
+        this.runAbort = runAbort;
+        this.signal = runAbort.signal;
+        this.openUrl = helpers.openUrl ?? openInBrowser;
+        this.copy = helpers.copyText ?? copyToClipboard;
+    }
+    async prompt(prompt) {
+        if (this.waitingClosed)
+            throw new Error('Login cancelled');
+        const browserView = prompt.type === 'manual_code' ? this.pendingBrowserView : undefined;
+        if (browserView !== undefined) {
+            this.pendingBrowserView = undefined;
+            await this.retireWaiting();
+        }
+        // pi-ai's callback race supplies a per-prompt abort signal. It must not
+        // replace the login-wide signal: cancelling either one closes the ask.
+        const signal = prompt.signal === undefined ? this.signal : AbortSignal.any([prompt.signal, this.signal]);
+        const secretNote = prompt.type === 'secret' ? t('oauth-secret-unmasked') : '';
+        let actionNote;
+        while (true) {
+            if (this.waitingClosed)
+                throw new Error('Login cancelled');
+            signal.throwIfAborted();
+            const question = prompt.type === 'select'
+                ? {
+                    id: 'dsh-auth-prompt',
+                    header: 'dsh-auth',
+                    question: prompt.message,
+                    options: prompt.options.map(option => ({
+                        label: option.label,
+                        ...(option.description === undefined ? {} : { description: option.description }),
+                    })),
+                }
+                : {
+                    id: 'dsh-auth-prompt',
+                    header: 'dsh-auth',
+                    question: prompt.message,
+                    ...(browserView === undefined
+                        ? (prompt.placeholder === undefined
+                            ? (secretNote === '' ? {} : { detail: secretNote })
+                            : { detail: [prompt.placeholder, secretNote].filter(part => part !== '').join('\n') })
+                        : {
+                            detail: [actionNote, browserView.body].filter(part => part !== undefined).join('\n'),
+                            options: [
+                                { label: browserView.copyLabel },
+                                { label: browserView.reopenLabel },
+                                { label: browserView.cancelLabel },
+                            ],
+                        }),
+                };
+            let answer;
+            try {
+                answer = singleAnswer(await this.ask({ questions: [question], signal }));
+            }
+            catch (error) {
+                if (typeof error === 'object' && error !== null
+                    && error.code === 'ASK_CANCELLED') {
+                    this.runAbort.abort('user cancelled sign-in');
+                }
+                throw error;
+            }
+            signal.throwIfAborted();
+            if (prompt.type === 'select') {
+                const label = answer.selected;
+                const option = label === undefined ? undefined : prompt.options.find(candidate => candidate.label === label);
+                if (option === undefined) {
+                    if (answer.custom !== undefined && answer.custom !== '')
+                        return answer.custom;
+                    throw new Error('dsh-auth: the selection answer did not match an offered option');
+                }
+                return option.id;
+            }
+            // The TUI may attach the focused option label while typing on it;
+            // entered callback text takes precedence over a copy/reopen action.
+            const custom = answer.custom?.trim();
+            if (custom !== undefined && custom !== '')
+                return custom;
+            if (browserView === undefined)
+                throw new Error('dsh-auth: the text answer was empty');
+            if (answer.selected === browserView.copyLabel) {
+                const copied = await this.copy(browserView.copyText).catch(() => false);
+                actionNote = t(copied ? 'oauth-copied' : 'oauth-copy-failed');
+                continue;
+            }
+            if (answer.selected === browserView.reopenLabel) {
+                const opened = this.openUrl(browserView.reopenUrl);
+                actionNote = t(opened ? 'oauth-reopened' : 'oauth-open-failed');
+                continue;
+            }
+            if (answer.selected === browserView.cancelLabel) {
+                this.runAbort.abort('user cancelled sign-in');
+                throw new Error('Login cancelled');
+            }
+            throw new Error('dsh-auth: the authorization question returned no action or code');
+        }
+    }
+    notify(event) {
+        if (this.waitingClosed || this.signal.aborted)
+            return;
+        if (event.type === 'info') {
+            this.notice = event.message;
+            return;
+        }
+        if (event.type === 'auth_url') {
+            if (this.pendingBrowserView !== undefined)
+                return;
+            const opened = this.openUrl(event.url);
+            const view = authUrlView(event.url, event.instructions, opened, this.notice);
+            this.notice = undefined;
+            this.pendingBrowserView = view;
+            // Current pi-ai browser flows call manual_code synchronously after
+            // notify. Defer the fallback panel one microtask so that prompt can
+            // consume this view without placing a second ask in the FIFO queue.
+            queueMicrotask(() => {
+                if (this.pendingBrowserView === view && !this.waitingClosed) {
+                    void this.runWaitingPanel(view).catch(() => this.runAbort.abort('authorization panel failed'));
+                }
+            });
+            return;
+        }
+        if (event.type === 'device_code') {
+            if (this.waiting !== undefined)
+                return;
+            const opened = this.openUrl(event.verificationUri);
+            void this.runWaitingPanel(deviceCodeView(event.userCode, event.verificationUri, opened))
+                .catch(() => this.runAbort.abort('authorization panel failed'));
+        }
+        // Progress lines are transient; the flow's next prompt or waiting panel
+        // carries the actionable state.
+    }
+    /** Close the waiting panel (if any) and stop answering for this run. */
+    async settle() {
+        this.waitingClosed = true;
+        this.pendingBrowserView = undefined;
+        await this.retireWaiting();
+        this.waiting = undefined;
+    }
+    async retireWaiting() {
+        const waiting = this.waiting;
+        waiting?.controller.abort();
+        await waiting?.answer;
+    }
+    /**
+     * Show the waiting panel until the flow settles or the user cancels,
+     * re-asking after a copy/reopen action with a one-line status prefix.
+     */
+    async runWaitingPanel(view) {
+        let body = view.body;
+        const active = () => !this.waitingClosed && !this.signal.aborted
+            && (view.kind === 'device_code' || this.pendingBrowserView === view);
+        while (active()) {
+            const controller = new AbortController();
+            const answer = this.ask({
+                questions: [{
+                        id: 'dsh-auth-waiting',
+                        header: 'dsh-auth',
+                        question: t('oauth-waiting'),
+                        detail: body,
+                        options: [
+                            { label: view.copyLabel },
+                            { label: view.reopenLabel },
+                            { label: view.cancelLabel },
+                        ],
+                    }],
+                signal: AbortSignal.any([controller.signal, this.signal]),
+            })
+                .then(singleAnswer)
+                .catch(() => {
+                if (!controller.signal.aborted && active())
+                    this.runAbort.abort('authorization panel was dismissed');
+                return undefined;
+            });
+            this.waiting = { controller, answer };
+            const response = await answer;
+            if (this.waiting?.controller === controller)
+                this.waiting = undefined;
+            if (response === undefined || !active())
+                return;
+            if (response.selected === undefined) {
+                body = `${t('oauth-choose-action')}\n${view.body}`;
+                continue;
+            }
+            if (response.selected === view.cancelLabel) {
+                this.runAbort.abort('user cancelled sign-in');
+                return;
+            }
+            if (response.selected === view.copyLabel) {
+                const copied = await this.copy(view.copyText).catch(() => false);
+                body = `${t(copied ? 'oauth-copied' : 'oauth-copy-failed')}\n${view.body}`;
+                continue;
+            }
+            if (response.selected === view.reopenLabel) {
+                const opened = this.openUrl(view.reopenUrl);
+                body = `${t(opened ? 'oauth-reopened' : 'oauth-open-failed')}\n${view.body}`;
+            }
+        }
+    }
+}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/opener.d.ts

@@ -11,7 +11,7 @@
  * Every path is best-effort and never throws: a missing opener or clipboard
  * degrades to the URL staying on screen with a copy action.
  *
- * @module dsh-auth/opener
+ * @module @deepseek-harness-tui/dsh-tui/oauth/opener
  */
 /** The browser-opening command for this platform, or undefined when unknown. */
 export declare function openerFor(url: string): {
@@ -30,3 +30,4 @@ export declare function openInBrowser(url: string): boolean;
  * order. Resolves whether one succeeded; never rejects.
  */
 export declare function copyToClipboard(text: string): Promise<boolean>;
+//# sourceMappingURL=opener.d.ts.map

package/lib/types/dsh-adapter/oauth/opener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opener.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/opener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAkBlH;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBlD;AA8BD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKpE"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/opener.js

@@ -11,7 +11,7 @@
  * Every path is best-effort and never throws: a missing opener or clipboard
  * degrades to the URL staying on screen with a copy action.
  *
- * @module dsh-auth/opener
+ * @module @deepseek-harness-tui/dsh-tui/oauth/opener
  */
 import { spawn } from 'node:child_process';
 /** The browser-opening command for this platform, or undefined when unknown. */

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/pi-ai.d.ts

@@ -1,9 +1,9 @@
 /**
  * The pi-ai instance owned by the installed dsh-llm-pi-ai adapter.
  *
- * dsh-llm-pi-ai rc.2 depends on pi-ai 0.82.x while alpha.1 depends on 0.84.x.
- * Loading a second catalog from dsh-auth and handing its Provider objects to
- * the adapter crosses package instances and is neither type- nor runtime-safe.
+ * Different host prereleases can depend on different pi-ai versions. Loading
+ * a second catalog in this module and handing its Provider objects to the
+ * adapter crosses package instances and is neither type- nor runtime-safe.
  * Resolve the adapter's own dependency instead, and derive every public type
  * from the adapter contract so this package owns no pi-ai version.
  */
@@ -18,6 +18,13 @@ type PiAiOAuth = NonNullable<PiAiProvider['auth']['oauth']>;
 export type PiAiAuthInteraction = Parameters<PiAiOAuth['login']>[0];
 export type PiAiAuthPrompt = Parameters<PiAiAuthInteraction['prompt']>[0];
 export type PiAiAuthEvent = Parameters<PiAiAuthInteraction['notify']>[0];
+/** pi-ai 0.87.1 added this optional login context; older flows ignore it. */
+export interface PiAiLoginOptions {
+    getDeviceId?: () => string;
+}
+/** Keep the optional second argument compatible with older adapter typings. */
+export declare function loginOAuth(oauth: PiAiOAuth, interaction: PiAiAuthInteraction, options: PiAiLoginOptions): ReturnType<PiAiOAuth['login']>;
 /** Fresh Provider objects from the exact pi-ai module used by dsh-llm-pi-ai. */
 export declare const adapterBuiltinProviders: () => readonly PiAiProvider[];
 export {};
+//# sourceMappingURL=pi-ai.d.ts.map

package/lib/types/dsh-adapter/oauth/pi-ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-ai.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/pi-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAMjG,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAA;AAEjF,KAAK,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;AAC1C,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AACrD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AACzD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1F,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzF,KAAK,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAExE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;CAC3B;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,gBAAgB,GACxB,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAKhC;AAmBD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,QAjBd,SAAS,YAAY,EAiBoB,CAAA"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/pi-ai.js

@@ -1,9 +1,9 @@
 /**
  * The pi-ai instance owned by the installed dsh-llm-pi-ai adapter.
  *
- * dsh-llm-pi-ai rc.2 depends on pi-ai 0.82.x while alpha.1 depends on 0.84.x.
- * Loading a second catalog from dsh-auth and handing its Provider objects to
- * the adapter crosses package instances and is neither type- nor runtime-safe.
+ * Different host prereleases can depend on different pi-ai versions. Loading
+ * a second catalog in this module and handing its Provider objects to the
+ * adapter crosses package instances and is neither type- nor runtime-safe.
  * Resolve the adapter's own dependency instead, and derive every public type
  * from the adapter contract so this package owns no pi-ai version.
  */
@@ -11,6 +11,11 @@ import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
+/** Keep the optional second argument compatible with older adapter typings. */
+export function loginOAuth(oauth, interaction, options) {
+    const compatible = oauth;
+    return compatible.login(interaction, options);
+}
 /** Locate the first pi-ai catalog Node would resolve from dsh-llm-pi-ai. */
 function adapterCatalogUrl() {
     const adapterManifest = import.meta.resolve('@deepseek-ai/dsh-llm-pi-ai/package.json');

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/profiles.d.ts

@@ -11,14 +11,16 @@
  * (llm-pi-ai's own `DEFAULT_*` constants are not exported; the values below
  * are those constants, and the comment on each says so).
  *
- * @module dsh-auth/profiles
+ * @module @deepseek-harness-tui/dsh-tui/oauth/profiles
  */
 import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
 import { type PiAiProvider } from './pi-ai.js';
-/** Provider routes this build mounts, in picker order. */
-export declare const OAUTH_PROVIDER_IDS: readonly ["openai-codex", "anthropic", "xai"];
+/** Subscription routes this build can mount, in picker order. */
+export declare const OAUTH_PROVIDER_IDS: readonly ["openai", "openai-codex", "anthropic", "xai", "meta"];
 /** One routable provider id. */
 export type OAuthProviderId = (typeof OAUTH_PROVIDER_IDS)[number];
+/** Mount only flows actually shipped by the adapter's pi-ai instance. */
+export declare function availableOAuthProviderIds(): OAuthProviderId[];
 /**
  * One per-model catalog override a deployment may name, keyed by model id.
  * Every field is optional; an absent field keeps the installed catalog's
@@ -43,3 +45,4 @@ export declare function oauthOf(route: PiAiProvider): NonNullable<PiAiProvider['
  *   {@link ModelOverride}); `undefined` serves the installed catalog unchanged.
  */
 export declare function buildOAuthProfile(id: string, modelOverrides?: Readonly<Record<string, ModelOverride>>): ResolvedPiAiProviderProfile;
+//# sourceMappingURL=profiles.d.ts.map

package/lib/types/dsh-adapter/oauth/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAC7E,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AAEvE,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,iEAAkE,CAAA;AAEjG,gCAAgC;AAChC,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE,yEAAyE;AACzE,wBAAgB,yBAAyB,IAAI,eAAe,EAAE,CAG7D;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAuBD,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAMvF;AAmCD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GACvD,2BAA2B,CAuB7B"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/profiles.js

@@ -11,12 +11,17 @@
  * (llm-pi-ai's own `DEFAULT_*` constants are not exported; the values below
  * are those constants, and the comment on each says so).
  *
- * @module dsh-auth/profiles
+ * @module @deepseek-harness-tui/dsh-tui/oauth/profiles
  */
 import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
 import { adapterBuiltinProviders } from './pi-ai.js';
-/** Provider routes this build mounts, in picker order. */
-export const OAUTH_PROVIDER_IDS = ['openai-codex', 'anthropic', 'xai'];
+/** Subscription routes this build can mount, in picker order. */
+export const OAUTH_PROVIDER_IDS = ['openai', 'openai-codex', 'anthropic', 'xai', 'meta'];
+/** Mount only flows actually shipped by the adapter's pi-ai instance. */
+export function availableOAuthProviderIds() {
+    const catalog = new Map(adapterBuiltinProviders().map(provider => [provider.id, provider]));
+    return OAUTH_PROVIDER_IDS.filter(id => catalog.get(id)?.auth.oauth !== undefined);
+}
 /** llm-pi-ai `DEFAULT_MAX_REQUEST_IMAGE_BYTES` (20 MiB, base64 payload bound). */
 const MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
 /** llm-pi-ai `DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET` (2048×2048 pixels). */
@@ -86,6 +91,9 @@ export function buildOAuthProfile(id, modelOverrides) {
         throw new Error(`dsh-auth: "${id}" is not an OAuth provider this build mounts (${OAUTH_PROVIDER_IDS.join(', ')})`);
     }
     const catalog = withModelOverrides(catalogProviderOf(id), modelOverrides);
+    // An older pi-ai catalog can know the route but not its newer OAuth flow
+    // (notably `openai`). Explicit requests must fail at boot, not at /auth.
+    oauthOf(catalog);
     return {
         provider: id,
         displayName: catalog.name,

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/service.d.ts

@@ -1,17 +1,19 @@
 /**
- * The `ctx.dshAuth` service: the programmatic surface over this plugin's
+ * The `ctx.dshAuth` service: the programmatic surface over this module's
  * mounted OAuth routes. UIs (the dsh-tui /provider wizard, a web settings
  * page) enumerate providers with masked sign-in state and drive login/logout
  * without touching the credential file or the pi-ai flow objects; the `/auth`
  * command in `command.ts` is a thin textual veneer over the same api.
  *
- * @module dsh-auth/service
+ * @module @deepseek-harness-tui/dsh-tui/oauth/service
  */
 import { Service } from '@deepseek-ai/cordis';
 import type { Context } from '@deepseek-ai/cordis';
 import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
 import { CredentialFile } from './credentials.js';
 import { type AskFn } from './interaction.js';
+import { type DeepSeekAccountAuth } from './deepseek.js';
+import { WhaleCouponStore } from './bonus.js';
 /** One provider's sign-in state; never carries token material. */
 export interface DshAuthSignInStatus {
     provider: string;
@@ -30,7 +32,8 @@ export interface DshAuthSignInStatus {
 export interface DshAuthLoginResult {
     provider: string;
     oauthLabel: string;
-    expiresAt: number;
+    /** pi-ai tokens expire; the Host-owned DeepSeek account grant has no expiry. */
+    expiresAt: number | undefined;
 }
 /** The service api consumed by commands and UIs. */
 export interface DshAuthApi {
@@ -43,12 +46,13 @@ export interface DshAuthApi {
      *   unknown, a login is already running, or the flow itself fails.
      */
     login(provider?: string, signal?: AbortSignal): Promise<DshAuthLoginResult>;
-    /** Remove one provider's stored credential; resolves whether one existed. */
+    /** Cancel an active sign-in and remove the stored credential; resolves whether one existed. */
     logout(provider: string): Promise<boolean>;
 }
 /** Cordis service holder; `api` is set by the plugin's apply. */
 export declare class DshAuthService extends Service {
     api: DshAuthApi | undefined;
+    readonly coupons: WhaleCouponStore;
     constructor(ctx: Context);
 }
 /** Everything the api factory needs; all cordis surface is injected, so tests run without a host. */
@@ -57,9 +61,11 @@ export interface DshAuthApiDeps {
     store: CredentialFile;
     /** The interactive ask surface, resolved per call so mounting order never matters. */
     resolveAsk: () => AskFn | undefined;
-    logger: {
-        warn(message: string): void;
-    };
+    /** Optional upstream account service; older hosts have only pi-ai routes. */
+    resolveDeepSeekAccount?: () => DeepSeekAccountAuth | undefined;
+    /** The active Host callback listener's browser-accessible loopback origin. */
+    resolveCallbackOrigin?: () => string | Promise<string>;
+    coupons?: WhaleCouponStore;
 }
 /**
  * The api implementation. One login runs per provider at a time (an in-flight
@@ -67,3 +73,4 @@ export interface DshAuthApiDeps {
  * attempt for the same provider fails fast instead of stacking two flows.
  */
 export declare function createDshAuthApi(deps: DshAuthApiDeps): DshAuthApi;
+//# sourceMappingURL=service.d.ts.map

package/lib/types/dsh-adapter/oauth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAC7E,OAAO,EAAsB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAErE,OAAO,EAAkB,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAE7D,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAgB7C,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAA;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAA;IAClB,gEAAgE;IAChE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,mFAAmF;IACnF,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,SAAS,IAAI,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAA;IACpD;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC3E,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC3C;AAED,iEAAiE;AACjE,qBAAa,cAAe,SAAQ,OAAO;IACzC,GAAG,EAAE,UAAU,GAAG,SAAS,CAAA;IAC3B,QAAQ,CAAC,OAAO,mBAAyB;gBAE7B,GAAG,EAAE,OAAO;CAGzB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;IAC1D,KAAK,EAAE,cAAc,CAAA;IACrB,sFAAsF;IACtF,UAAU,EAAE,MAAM,KAAK,GAAG,SAAS,CAAA;IACnC,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAA;IAC9D,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAoBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAkJjE"}