@deepseek-harness-tui/dsh-tui 0.11.2 → 0.13.0

package/lib/types/dsh-adapter/migrate/sessionize.js

@@ -51,11 +51,8 @@
 import { ToolCallId, createAssistantMessage, createSystemMessage, createToolResultMessage, createUserMessage, } from '@deepseek-ai/dsh-llm';
 import { SESSION_FORMAT_VERSION, Session, } from '@deepseek-ai/dsh-session';
 import { userTitleData } from '../compat/sessionLog.js';
+import { estimateTokens } from '../channel/usage.js';
 import { normalizeTitle } from './parse/title.js';
-/** Rough token estimate for shadowed text (the compaction metering field). */
-function estimateTokens(chars) {
-    return Math.ceil(chars / 4);
-}
 /** Blocks for one migrated step, in source order (reasoning before the text
  *  it explains, tool calls where the model made them). A step with no
  *  content keeps one empty text block so the assistant message stays
@@ -130,7 +127,7 @@ export function sessionize(id, agentId, session) {
     const writePrompt = (prompt) => {
         if (prompt === '')
             return;
-        surfaceChars += prompt.length;
+        surfaceTokens += estimateTokens(prompt);
         events.push(model.append('user/message', createUserMessage({
             content: [{ type: 'text', text: prompt }],
             source: { kind: 'user' },
@@ -161,9 +158,11 @@ export function sessionize(id, agentId, session) {
         }
     };
     let compactions = 0;
-    // Text volume on the surface since the last checkpoint, for the summary's
-    // shadowedTokenCount (an estimate, like the live engine's).
-    let surfaceChars = 0;
+    // Estimated model-visible tokens on the surface since the last checkpoint,
+    // for the summary's shadowedTokenCount (an estimate, like the live engine's;
+    // the shared CJK-aware estimator keeps migrated CJK sessions from being
+    // under-counted ~3x the way the old chars/4 did — issue #1170).
+    let surfaceTokens = 0;
     /** Fold every surface node after the head into one checkpoint; false when
      *  there is nothing to fold (the upstream contract needs a non-empty span). */
     const writeCompaction = (summary, summaryModel) => {
@@ -180,7 +179,7 @@ export function sessionize(id, agentId, session) {
             summary: [{ type: 'text', text: summary }],
             shadowedRange: range,
             shadowedSeqs: shadowed,
-            shadowedTokenCount: estimateTokens(surfaceChars),
+            shadowedTokenCount: surfaceTokens,
             provider: `migrated:${agentId}`,
             model: summaryModel ?? agentId,
         }));
@@ -190,7 +189,7 @@ export function sessionize(id, agentId, session) {
             source: { kind: 'compact-checkpoint', compactionId },
         }), { surfaceOp: { op: 'replace', startSeq: range.start, endSeq: range.end }, sourceEventSeqs: shadowed }));
         events.push(untyped.append('compaction/end', { compactionId, turn: null }));
-        surfaceChars = summary.length;
+        surfaceTokens = estimateTokens(summary);
         return true;
     };
     let turnIndex = 0;
@@ -236,9 +235,9 @@ export function sessionize(id, agentId, session) {
             for (const input of imported.inputs)
                 writePrompt(input);
             for (const block of imported.blocks)
-                surfaceChars += block.type === 'tool-call' ? block.arguments.length : block.text.length;
+                surfaceTokens += estimateTokens(block.type === 'tool-call' ? block.arguments : block.text);
             for (const result of imported.results)
-                surfaceChars += result.text.length;
+                surfaceTokens += estimateTokens(result.text);
             events.push(model.append('assistant/message', {
                 turn: turnIndex,
                 step,

package/lib/types/dsh-adapter/oauth/bonus.d.ts

@@ -0,0 +1,27 @@
+import type { DeepSeekAccount, AccountBonusOrderId, AccountUserId } from '@deepseek-ai/dsh-deepseek-account';
+export interface WhaleCouponNotice {
+    readonly accountId: AccountUserId;
+    readonly orderId: AccountBonusOrderId;
+    readonly amount: string;
+    readonly currency: 'CNY' | 'USD';
+    readonly expiresAt: string;
+}
+type BonusAccount = Pick<DeepSeekAccount, 'getUnnotifiedBonuses' | 'ackBonusNotified'>;
+/** TUI-only presentation of a Platform-confirmed login grant. */
+export declare class WhaleCouponStore {
+    private readonly listeners;
+    private readonly seen;
+    private notice;
+    private account;
+    private generation;
+    readonly subscribe: (listener: () => void) => (() => void);
+    readonly getSnapshot: () => WhaleCouponNotice | null;
+    refresh(account: BonusAccount): Promise<void>;
+    /** Called only after the modal has painted; a read alone never acknowledges. */
+    shown(orderId: AccountBonusOrderId): void;
+    dismiss(orderId: AccountBonusOrderId): void;
+    clear(): void;
+    private emit;
+}
+export {};
+//# sourceMappingURL=bonus.d.ts.map

package/lib/types/dsh-adapter/oauth/bonus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bonus.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/bonus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AAG5G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,sBAAsB,GAAG,kBAAkB,CAAC,CAAA;AAEtF,iEAAiE;AACjE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,UAAU,CAAI;IAEtB,QAAQ,CAAC,SAAS,GAAI,UAAU,MAAM,IAAI,KAAG,CAAC,MAAM,IAAI,CAAC,CAGxD;IAED,QAAQ,CAAC,WAAW,QAAO,iBAAiB,GAAG,IAAI,CAAe;IAE5D,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBnD,gFAAgF;IAChF,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IASzC,OAAO,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAS3C,KAAK,IAAI,IAAI;IAQb,OAAO,CAAC,IAAI;CACb"}

package/lib/types/dsh-adapter/oauth/bonus.js

@@ -0,0 +1,69 @@
+import { deepSeekClientMetadata } from './deepseek.js';
+/** TUI-only presentation of a Platform-confirmed login grant. */
+export class WhaleCouponStore {
+    listeners = new Set();
+    seen = new Set();
+    notice = null;
+    account;
+    generation = 0;
+    subscribe = (listener) => {
+        this.listeners.add(listener);
+        return () => { this.listeners.delete(listener); };
+    };
+    getSnapshot = () => this.notice;
+    async refresh(account) {
+        const generation = ++this.generation;
+        if (this.listeners.size === 0)
+            return;
+        let batch;
+        try {
+            batch = await account.getUnnotifiedBonuses(deepSeekClientMetadata());
+        }
+        catch {
+            return;
+        }
+        if (generation !== this.generation || batch === null)
+            return;
+        const granted = batch.bonuses.find(bonus => bonus.campaign === 'dsh_login_bonus'
+            && !this.seen.has(`${batch.accountId}:${bonus.orderId}`)
+            && (Number.isNaN(Date.parse(bonus.expiresAt)) || Date.parse(bonus.expiresAt) > Date.now()));
+        if (granted === undefined)
+            return;
+        this.account = account;
+        this.notice = {
+            accountId: batch.accountId, orderId: granted.orderId,
+            amount: granted.amount, currency: granted.currency, expiresAt: granted.expiresAt,
+        };
+        this.emit();
+    }
+    /** Called only after the modal has painted; a read alone never acknowledges. */
+    shown(orderId) {
+        const notice = this.notice;
+        if (notice?.orderId !== orderId || this.account === undefined)
+            return;
+        const key = `${notice.accountId}:${notice.orderId}`;
+        if (this.seen.has(key))
+            return;
+        this.seen.add(key);
+        void this.account.ackBonusNotified(notice.accountId, orderId, deepSeekClientMetadata()).catch(() => false);
+    }
+    dismiss(orderId) {
+        if (this.notice?.orderId !== orderId)
+            return;
+        this.shown(orderId);
+        const account = this.account;
+        this.notice = null;
+        this.emit();
+        if (account !== undefined)
+            void this.refresh(account);
+    }
+    clear() {
+        this.generation++;
+        this.notice = null;
+        this.account = undefined;
+        this.seen.clear();
+        this.emit();
+    }
+    emit() { for (const listener of this.listeners)
+        listener(); }
+}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/command.d.ts

@@ -2,7 +2,7 @@
  * The `/auth` command: a textual veneer over the {@link DshAuthApi} — status
  * listing, login (optionally picking the provider interactively), logout.
  *
- * @module dsh-auth/command
+ * @module @deepseek-harness-tui/dsh-tui/oauth/command
  */
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands';
 import type { DshAuthApi } from './service.js';
@@ -12,3 +12,4 @@ import type { DshAuthApi } from './service.js';
  * propagate for the host's own error surface.
  */
 export declare function createAuthCommandHandler(api: DshAuthApi): (invocation: CommandInvocation) => Promise<CommandResult>;
+//# sourceMappingURL=command.d.ts.map

package/lib/types/dsh-adapter/oauth/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/command.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAA;AA0BnE;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,UAAU,EAAE,iBAAiB,KAAK,OAAO,CAAC,aAAa,CAAC,CAiCnH"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/command.js

@@ -2,13 +2,15 @@
  * The `/auth` command: a textual veneer over the {@link DshAuthApi} — status
  * listing, login (optionally picking the provider interactively), logout.
  *
- * @module dsh-auth/command
+ * @module @deepseek-harness-tui/dsh-tui/oauth/command
  */
 const USAGE = 'Usage: /auth [status] | /auth login [provider] | /auth logout <provider>';
 function renderStatus(rows) {
     const lines = rows.map(row => {
         const state = row.signedIn
-            ? `signed in — token expires ${new Date(row.expiresAt ?? 0).toISOString()}`
+            ? row.expiresAt === undefined
+                ? 'signed in'
+                : `signed in — token expires ${new Date(row.expiresAt).toISOString()}`
             : row.expired
                 ? 'signed in, token expired — /auth login to refresh'
                 : 'not signed in';
@@ -41,8 +43,9 @@ export function createAuthCommandHandler(api) {
                 const result = await api.login(target, invocation.signal);
                 return {
                     kind: 'success',
-                    text: `Signed in to ${result.oauthLabel} (${result.provider}); token expires `
-                        + `${new Date(result.expiresAt).toISOString()}. Its models are selectable via /model.`,
+                    text: `Signed in to ${result.oauthLabel} (${result.provider})`
+                        + `${result.expiresAt === undefined ? '' : `; token expires ${new Date(result.expiresAt).toISOString()}`}. `
+                        + 'Its models are selectable via /model.',
                 };
             }
             catch (error) {

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/credentials.d.ts

@@ -3,15 +3,15 @@
  * one JSON document, one credential per provider id.
  *
  * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
- * permissions best-effort on every platform. All mutations go through
- * {@link CredentialFile.modify}, which serializes read-modify-write cycles
- * per provider in-process — pi-ai runs its OAuth refresh *inside* `modify`,
- * so the exclusion here is what keeps concurrent requests from
- * double-refreshing a rotated token. The file is the single source of truth;
+ * permissions best-effort on every platform. Mutations share an in-process
+ * queue and a cross-process file lock; pi-ai runs its OAuth refresh *inside*
+ * {@link CredentialFile.modify}, so the exclusion also keeps concurrent
+ * requests from double-refreshing a rotated token. The file is the single
+ * source of truth;
  * nothing here ever logs token material, and {@link CredentialFile.describe}
  * reports only non-secret metadata for status surfaces.
  *
- * @module dsh-auth/credentials
+ * @module @deepseek-harness-tui/dsh-tui/oauth/credentials
  */
 import type { PiAiCredential, PiAiCredentialInfo, PiAiCredentialStore } from './pi-ai.js';
 /** The stored credential shape: a pi-ai `OAuthCredential`. */
@@ -30,10 +30,12 @@ export declare function defaultCredentialsFile(): string;
  */
 export declare class CredentialFile implements PiAiCredentialStore {
     readonly path: string;
-    /** Per-provider operation chains: modify/delete never overlap for one id. */
-    private readonly chains;
-    private cache;
+    /** One document needs one read-modify-write queue, regardless of provider. */
+    private pending;
+    private deviceId;
     constructor(path: string);
+    /** Stable per-store UUID for pi-ai's OpenAI ChatGPT agent-host identity. */
+    getOrCreateDeviceId(): string;
     /** The stored credential for one provider, possibly expired. */
     read(providerId: string): Promise<PiAiCredential | undefined>;
     /** Stored credential metadata without resolving or exposing secrets. */
@@ -53,8 +55,9 @@ export declare class CredentialFile implements PiAiCredentialStore {
         expiresAt: number;
         expired: boolean;
     }[]>;
-    /** Run one operation after every earlier operation for the same provider. */
+    /** Keep the entire read-modify-rename cycle exclusive across processes. */
     private chain;
     private load;
     private save;
 }
+//# sourceMappingURL=credentials.d.ts.map

package/lib/types/dsh-adapter/oauth/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEzF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAA;AAQ9E,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAOpF;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,IAAI,MAAM,CAK/C;AAKD;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAoB;gBAExB,IAAI,EAAE,MAAM;IAIxB,4EAA4E;IAC5E,mBAAmB,IAAI,MAAM;IAiC7B,gEAAgE;IAC1D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAInE,wEAAwE;IAClE,IAAI,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC;IAQpD;;;;;OAKG;IACG,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,GAC/E,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IActC,iDAAiD;IAC3C,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C,4EAA4E;IACtE,QAAQ,IAAI,OAAO,CAAC,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAY/F,2EAA2E;IAC3E,OAAO,CAAC,KAAK;YAUC,IAAI;YAuCJ,IAAI;CAWnB"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/credentials.js

@@ -3,19 +3,21 @@
  * one JSON document, one credential per provider id.
  *
  * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
- * permissions best-effort on every platform. All mutations go through
- * {@link CredentialFile.modify}, which serializes read-modify-write cycles
- * per provider in-process — pi-ai runs its OAuth refresh *inside* `modify`,
- * so the exclusion here is what keeps concurrent requests from
- * double-refreshing a rotated token. The file is the single source of truth;
+ * permissions best-effort on every platform. Mutations share an in-process
+ * queue and a cross-process file lock; pi-ai runs its OAuth refresh *inside*
+ * {@link CredentialFile.modify}, so the exclusion also keeps concurrent
+ * requests from double-refreshing a rotated token. The file is the single
+ * source of truth;
  * nothing here ever logs token material, and {@link CredentialFile.describe}
  * reports only non-secret metadata for status surfaces.
  *
- * @module dsh-auth/credentials
+ * @module @deepseek-harness-tui/dsh-tui/oauth/credentials
  */
+import { randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
+import { withFileLock } from '@deepseek-ai/dsh-atomic-write';
 /** Narrow an unknown parsed value into a stored credential, or reject it. */
 export function asStoredCredential(value) {
     if (typeof value !== 'object' || value === null)
@@ -38,6 +40,7 @@ export function defaultCredentialsFile() {
     return join(root, 'dsh-auth', 'credentials.json');
 }
 const EMPTY_DOCUMENT = { version: 1, providers: {} };
+const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 /**
  * The credential file. IO failures throw (loud, naming the path) rather than
  * degrading to an empty store: silently treating a corrupt or unreadable
@@ -46,12 +49,49 @@ const EMPTY_DOCUMENT = { version: 1, providers: {} };
  */
 export class CredentialFile {
     path;
-    /** Per-provider operation chains: modify/delete never overlap for one id. */
-    chains = new Map();
-    cache;
+    /** One document needs one read-modify-write queue, regardless of provider. */
+    pending = Promise.resolve();
+    deviceId;
     constructor(path) {
         this.path = path;
     }
+    /** Stable per-store UUID for pi-ai's OpenAI ChatGPT agent-host identity. */
+    getOrCreateDeviceId() {
+        if (this.deviceId !== undefined)
+            return this.deviceId;
+        const path = join(dirname(this.path), 'device-id');
+        let value;
+        try {
+            value = readFileSync(path, 'utf8');
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT') {
+                throw new Error(`dsh-auth: cannot read device ID file ${path}: ${String(error)}`);
+            }
+            mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+            try {
+                writeFileSync(path, `${randomUUID()}\n`, { flag: 'wx', mode: 0o600 });
+            }
+            catch (writeError) {
+                // A second process may have created the same installation ID first.
+                if (writeError?.code !== 'EEXIST') {
+                    throw new Error(`dsh-auth: cannot write device ID file ${path}: ${String(writeError)}`);
+                }
+            }
+            try {
+                value = readFileSync(path, 'utf8');
+            }
+            catch (readError) {
+                throw new Error(`dsh-auth: cannot read device ID file ${path}: ${String(readError)}`);
+            }
+        }
+        const id = value.trim();
+        if (!DEVICE_ID_PATTERN.test(id)) {
+            throw new Error(`dsh-auth: device ID file ${path} is not a UUID; fix or remove it by hand`);
+        }
+        this.deviceId = id;
+        return id;
+    }
     /** The stored credential for one provider, possibly expired. */
     async read(providerId) {
         return (await this.load()).providers[providerId];
@@ -71,7 +111,7 @@ export class CredentialFile {
      * credential. Rejections from `fn` propagate without touching the file.
      */
     async modify(providerId, fn) {
-        return this.chain(providerId, async () => {
+        return this.chain(async () => {
             const document = await this.load();
             const current = document.providers[providerId];
             const replacement = await fn(current);
@@ -86,7 +126,7 @@ export class CredentialFile {
     }
     /** Remove one provider's credential (logout). */
     async delete(providerId) {
-        await this.chain(providerId, async () => {
+        await this.chain(async () => {
             const document = await this.load();
             if (!(providerId in document.providers))
                 return;
@@ -107,23 +147,24 @@ export class CredentialFile {
             expired: credential.expires <= now,
         }));
     }
-    /** Run one operation after every earlier operation for the same provider. */
-    chain(provider, operation) {
-        const run = (this.chains.get(provider) ?? Promise.resolve()).then(operation, operation);
-        this.chains.set(provider, run.then(() => undefined, () => undefined));
+    /** Keep the entire read-modify-rename cycle exclusive across processes. */
+    chain(operation) {
+        const run = this.pending.then(() => {
+            mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+            // pi-ai may refresh a token over the network while holding this lock.
+            return withFileLock(this.path, operation, { waitMs: 120_000 });
+        });
+        this.pending = run.then(() => undefined, () => undefined);
         return run;
     }
     async load() {
-        if (this.cache !== undefined)
-            return this.cache;
         let text;
         try {
             text = readFileSync(this.path, 'utf8');
         }
         catch (error) {
             if (error?.code === 'ENOENT') {
-                this.cache = EMPTY_DOCUMENT;
-                return this.cache;
+                return EMPTY_DOCUMENT;
             }
             throw new Error(`dsh-auth: cannot read credential file ${this.path}: ${String(error)}`);
         }
@@ -150,13 +191,11 @@ export class CredentialFile {
             }
             providers[provider] = credential;
         }
-        this.cache = { version: 1, providers };
-        return this.cache;
+        return { version: 1, providers };
     }
     async save(document) {
         const text = JSON.stringify(document, null, 2) + '\n';
         const directory = dirname(this.path);
-        mkdirSync(directory, { recursive: true, mode: 0o700 });
         const temporary = join(directory, `.${Math.random().toString(36).slice(2)}.tmp`);
         try {
             writeFileSync(temporary, text, { mode: 0o600 });
@@ -165,6 +204,5 @@ export class CredentialFile {
         catch (error) {
             throw new Error(`dsh-auth: cannot write credential file ${this.path}: ${String(error)}`);
         }
-        this.cache = document;
     }
 }

package/lib/types/dsh-adapter/oauth/deepseek.d.ts

@@ -0,0 +1,39 @@
+/**
+ * TUI interaction for the Host-owned DeepSeek account authorization flow.
+ *
+ * The Host owns PKCE, its callback route, credential persistence, and the
+ * `deepseek-account` LLM route. This module supplies a loopback callback
+ * origin, mounts the official Host listener when an older bundle patch omits
+ * it, and displays the Host's safe attempt state through the existing question
+ * panel. It never reads or writes the account grant.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { AccountClientMetadata, DeepSeekAccount } from '@deepseek-ai/dsh-deepseek-account';
+import { type AskFn, type QuestionBridgeHelpers } from './interaction.js';
+export declare const DEEPSEEK_ACCOUNT_PROVIDER = "deepseek-account";
+/** Only the account operations this interaction surface consumes. */
+export type DeepSeekAccountAuth = Pick<DeepSeekAccount, 'getState' | 'startSignIn' | 'cancelSignIn' | 'signOut' | 'watch'> & Partial<Pick<DeepSeekAccount, 'getUnnotifiedBonuses' | 'ackBonusNotified'>>;
+/** Resolve late: the account provider is absent on older DSH hosts. */
+export declare function deepSeekAccountFrom(ctx: Context): DeepSeekAccountAuth | undefined;
+/** The Host webServer may be shared, supplied by the TUI row, or mounted as a fallback. */
+export declare function deepSeekCallbackOrigin(ctx: Context): string;
+/**
+ * Keep DeepSeek login usable after a profile-only update from a global TUI
+ * whose older bundle patch still mounts `dsh-tui-auth` but has no webserver
+ * row. The official Host listener is mounted only on the first login that
+ * needs it; an existing Web or user-owned listener is never replaced.
+ */
+export declare function createDeepSeekCallbackOriginResolver(ctx: Context): {
+    resolve(): Promise<string>;
+    dispose(): Promise<void>;
+};
+/** Platform request identity is supplied by the current TUI, not cached by the Host. */
+export declare function deepSeekClientMetadata(): AccountClientMetadata;
+/**
+ * Start (or join) the upstream browser attempt, display its URL, and wait for
+ * the upstream state stream. Esc/external abort cancels the exact attempt;
+ * a commit that won that race is reported as success instead of a false
+ * cancellation. The question panel is always retired before returning.
+ */
+export declare function loginDeepSeekAccount(account: DeepSeekAccountAuth, callbackOrigin: string, ask: AskFn, signal?: AbortSignal, helpers?: QuestionBridgeHelpers): Promise<void>;
+//# sourceMappingURL=deepseek.d.ts.map

package/lib/types/dsh-adapter/oauth/deepseek.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deepseek.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/deepseek.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,qBAAqB,EAAe,eAAe,EAAmB,MAAM,mCAAmC,CAAA;AAG7H,OAAO,EAAkB,KAAK,KAAK,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAEzF,eAAO,MAAM,yBAAyB,qBAAqB,CAAA;AAE3D,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC,GACtH,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,sBAAsB,GAAG,kBAAkB,CAAC,CAAC,CAAA;AAE/E,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAEjF;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAO3D;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG;IAClE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB,CA0DA;AAWD,wFAAwF;AACxF,wBAAgB,sBAAsB,IAAI,qBAAqB,CAM9D;AAMD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,KAAK,EACV,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyDf"}