@edge-sky/dsh-oauth-adapter 0.1.1-rc.9 → 0.1.2-beta.1

package/README.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record: the git blob hash of each side as of the
 # last confirmed-consistent state. Both languages carry equal authority.
-README.md: a39895b8270728ff304536ba2df6d927e21f6f20
-README.zh.md: b2d5ac29a0087cf4df1f7a7ce7757acbe780fc3c
+README.md: c4642ceaea18fbc2482a1a121893d9e5ee2662c4
+README.zh.md: 7641d4bdcd89a0bfa9a247a4dc59013c0614e434

package/README.md

@@ -4,8 +4,17 @@ English | [中文](README.zh.md)
 
 An OAuth account page for the DSH Web profile. It supports:
 
-- [x] OpenAI Codex
-- [x] GitHub Copilot
+| Provider | pi-ai sign-in path |
+| --- | --- |
+| OpenAI Codex | Browser callback or device code |
+| GitHub Copilot | GitHub or GitHub Enterprise device code |
+| Anthropic | Browser callback with manual code/redirect fallback |
+| Kimi For Coding | Device code |
+| OpenRouter | Browser PKCE callback |
+| Radius | Browser PKCE callback or device code |
+| xAI | Device code |
+
+Each account is shown only as available when the installed `@deepseek-ai/dsh-llm-pi-ai` actually registers its OAuth flow. This keeps older or differently bundled pi-ai versions fail-closed instead of exposing a login button that cannot work.
 
 The adapter has only been tested with DSH `0.1.1-rc.2`; compatibility with future versions is not guaranteed.
 
@@ -27,9 +36,14 @@ Start DSH:
 npx @deepseek-ai/dsh web
 ```
 
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/78a59190-8029-4c60-bc50-b763312540f7" />
+
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/e0cc6591-73a4-4e87-9ef6-68950126b290" />
+
+
 ## How it works
 
-DSH integrates pi-ai through the `@deepseek-ai/dsh-llm-pi-ai` adapter, but does not provide an OAuth entry point. `@edge-sky/dsh-oauth-adapter` registers pi-ai's existing Codex and Copilot login flows with the DSH Authorization Service.
+DSH integrates pi-ai through the `@deepseek-ai/dsh-llm-pi-ai` adapter, but does not provide an OAuth entry point. `@edge-sky/dsh-oauth-adapter` exposes pi-ai's existing provider login flows through the DSH Authorization Service. Browser links, device codes, text and secret input, method selection, cancellation, and withdrawn prompts all use the same provider-neutral transport.
 
 Because DSH does not currently mount the `ctx.authorization` service, this plugin also mounts it manually.
 

package/README.zh.md

@@ -4,8 +4,17 @@
 
 为 DSH Web profile 提供独立的 OAuth 账户页面。当前支持：
 
-- [x] OpenAI Codex
-- [x] GitHub Copilot
+| 提供商 | pi-ai 登录路径 |
+| --- | --- |
+| OpenAI Codex | 浏览器回调或设备码 |
+| GitHub Copilot | GitHub 或 GitHub Enterprise 设备码 |
+| Anthropic | 浏览器回调，并支持手工粘贴授权码/重定向地址 |
+| Kimi For Coding | 设备码 |
+| OpenRouter | 浏览器 PKCE 回调 |
+| Radius | 浏览器 PKCE 回调或设备码 |
+| xAI | 设备码 |
+
+只有当当前安装的 `@deepseek-ai/dsh-llm-pi-ai` 确实注册了对应 OAuth 流程时，账户才会显示为可用。这样旧版或采用不同 pi-ai bundle 的 DSH 会安全地禁用登录按钮，而不会暴露无法完成的流程。
 
 当前仅对 DSH`0.1.1-rc.2`进行了测试，不保证未来版本的兼容性
 
@@ -27,9 +36,14 @@ npx @deepseek-ai/dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
 npx @deepseek-ai/dsh web
 ```
 
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/134ec856-e17b-4800-bb87-069851986d3e" />
+
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/8007002a-a036-4cf4-b015-d4e50eff25d9" />
+
+
 ## 工作原理
 
-DSH 通过 `@deepseek-ai/dsh-llm-pi-ai` 适配器接入 pi-ai，但并没有提供 OAuth 的入口。`@edge-sky/dsh-oauth-adapter` 将 pi-ai 已有的 Codex 与 Copilot 登录流程注册到 DSH Authorization Service。
+DSH 通过 `@deepseek-ai/dsh-llm-pi-ai` 适配器接入 pi-ai，但并没有提供 OAuth 的入口。`@edge-sky/dsh-oauth-adapter` 通过 DSH Authorization Service 暴露 pi-ai 已有的 provider 登录流程。浏览器链接、设备码、文本与密码输入、登录方式选择、取消和撤回提示均通过同一套 provider-neutral 传输完成。
 
 由于 DSH 目前并没有挂载`ctx.authorization`服务，因此该插件同时手动对其进行了挂载
 

package/lib/client.js

@@ -6,6 +6,49 @@ window.__ModuleLoader__.load({
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 		let react = require("react");
 		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/protocol.ts
+		/** Shared browser/Host wire vocabulary for the OAuth account surface. */
+		const OAUTH_SOCKET_PATH = "/_edge-sky/dsh-oauth";
+		const OAUTH_SOCKET_PROTOCOL = "dsh-oauth-v1";
+		const PROVIDERS = [
+			{
+				id: "openai-codex",
+				key: "llm-pi-ai/openai-codex",
+				fallbackLabel: "OpenAI Codex",
+				modelGroupLabel: "OpenAI Codex (OAuth)"
+			},
+			{
+				id: "github-copilot",
+				key: "llm-pi-ai/github-copilot",
+				fallbackLabel: "GitHub Copilot",
+				modelGroupLabel: "GitHub Copilot (OAuth)"
+			},
+			{
+				id: "anthropic",
+				key: "llm-pi-ai/anthropic",
+				fallbackLabel: "Anthropic",
+				modelGroupLabel: "Anthropic (OAuth)"
+			},
+			{
+				id: "kimi-coding",
+				key: "llm-pi-ai/kimi-coding",
+				fallbackLabel: "Kimi For Coding",
+				modelGroupLabel: "Kimi For Coding (OAuth)"
+			},
+			{
+				id: "openrouter",
+				key: "llm-pi-ai/openrouter",
+				fallbackLabel: "OpenRouter",
+				modelGroupLabel: "OpenRouter (OAuth)"
+			},
+			{
+				id: "xai",
+				key: "llm-pi-ai/xai",
+				fallbackLabel: "xAI",
+				modelGroupLabel: "xAI (OAuth)"
+			}
+		];
+		//#endregion
 		//#region src/client/OAuthAccountsSection.tsx
 		/** OAuth account settings page. */
 		function safeHttpUrl(value) {
@@ -92,6 +135,16 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		function ErrorPanel(props) {
+			const collapsible = props.detail !== void 0 && (props.detail.includes("\n") || props.detail.length > 240);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dsh-oauth-error",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: props.message }), props.detail !== void 0 && (collapsible ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
+					className: "dsh-oauth-error-details",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: props.t("technicalDetails") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", { children: props.detail })]
+				}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", { children: props.detail }))]
+			});
+		}
 		function AttemptPanel(props) {
 			const [copied, setCopied] = (0, react.useState)(false);
 			const url = safeHttpUrl(props.attempt.notice?.url);
@@ -125,9 +178,10 @@ window.__ModuleLoader__.load({
 						controller: props.controller,
 						t: props.t
 					}, props.attempt.prompt.id),
-					props.attempt.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: "dsh-oauth-error",
-						children: props.attempt.error
+					props.attempt.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ErrorPanel, {
+						message: props.attempt.error,
+						...props.attempt.errorDetail === void 0 ? {} : { detail: props.attempt.errorDetail },
+						t: props.t
 					}),
 					props.attempt.id !== void 0 && (props.attempt.phase === "running" || props.attempt.phase === "starting") && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						className: "dsh-oauth-button",
@@ -158,9 +212,10 @@ window.__ModuleLoader__.load({
 						className: "dsh-oauth-intro",
 						children: t("intro")
 					}),
-					snapshot.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: "dsh-oauth-error",
-						children: snapshot.error
+					snapshot.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ErrorPanel, {
+						message: snapshot.error,
+						...snapshot.errorDetail === void 0 ? {} : { detail: snapshot.errorDetail },
+						t
 					}),
 					snapshot.connection !== "open" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						className: "dsh-oauth-button",
@@ -177,7 +232,7 @@ window.__ModuleLoader__.load({
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
 						className: "dsh-oauth-list",
-						children: ["openai-codex", "github-copilot"].map((provider) => {
+						children: PROVIDERS.map(({ id: provider }) => {
 							const account = accountByProvider.get(provider);
 							const attempt = snapshot.attempt?.provider === provider ? snapshot.attempt : void 0;
 							const busy = account?.inFlight === true || attempt?.phase === "running" || attempt?.phase === "starting";
@@ -261,6 +316,7 @@ window.__ModuleLoader__.load({
 			authorized: "Sign-in completed.",
 			cancelled: "Sign-in was cancelled.",
 			failed: "Sign-in failed.",
+			technicalDetails: "Technical details",
 			submit: "Continue",
 			copy: "Copy code",
 			copied: "Copied",
@@ -292,6 +348,7 @@ window.__ModuleLoader__.load({
 			authorized: "登录已完成。",
 			cancelled: "登录已取消。",
 			failed: "登录失败。",
+			technicalDetails: "技术详情",
 			submit: "继续",
 			copy: "复制代码",
 			copied: "已复制",
@@ -303,11 +360,6 @@ window.__ModuleLoader__.load({
 			hostDisconnected: "与 DSH 的 OAuth 连接已中断。"
 		};
 		//#endregion
-		//#region src/protocol.ts
-		/** Shared browser/Host wire vocabulary for the OAuth account surface. */
-		const OAUTH_SOCKET_PATH = "/_edge-sky/dsh-oauth";
-		const OAUTH_SOCKET_PROTOCOL = "dsh-oauth-v1";
-		//#endregion
 		//#region src/client/store.ts
 		/** Browser state machine for the plugin-owned OAuth WebSocket. */
 		function socketUrl() {
@@ -355,7 +407,7 @@ window.__ModuleLoader__.load({
 			getSnapshot = () => this.snapshot;
 			begin(provider) {
 				if (this.snapshot.attempt?.phase === "starting" || this.snapshot.attempt?.phase === "running") return;
-				const { error: _error, ...current } = this.snapshot;
+				const { error: _error, errorDetail: _errorDetail, ...current } = this.snapshot;
 				this.update({
 					...current,
 					attempt: {
@@ -426,7 +478,7 @@ window.__ModuleLoader__.load({
 				socket.addEventListener("open", () => {
 					if (this.socket !== socket) return;
 					this.reconnectDelay = 500;
-					const { error: _error, ...current } = this.snapshot;
+					const { error: _error, errorDetail: _errorDetail, ...current } = this.snapshot;
 					this.update({
 						...current,
 						connection: "open"
@@ -442,10 +494,12 @@ window.__ModuleLoader__.load({
 					try {
 						value = JSON.parse(event.data);
 					} catch {
-						this.update({
+						const next = {
 							...this.snapshot,
 							error: "DSH returned an invalid OAuth message."
-						});
+						};
+						delete next.errorDetail;
+						this.update(next);
 						return;
 					}
 					if (isServerMessage(value)) this.receive(value);
@@ -461,7 +515,7 @@ window.__ModuleLoader__.load({
 						return;
 					}
 					const attempt = this.snapshot.attempt;
-					this.update({
+					const interrupted = {
 						...this.snapshot,
 						connection: "reconnecting",
 						error: "The OAuth connection to DSH was interrupted.",
@@ -470,7 +524,10 @@ window.__ModuleLoader__.load({
 							phase: "failed",
 							error: "The OAuth connection to DSH was interrupted."
 						} }
-					});
+					};
+					delete interrupted.errorDetail;
+					if (interrupted.attempt?.error === "The OAuth connection to DSH was interrupted.") delete interrupted.attempt.errorDetail;
+					this.update(interrupted);
 					const delay = this.reconnectDelay;
 					this.reconnectDelay = Math.min(this.reconnectDelay * 2, 5e3);
 					this.reconnectTimer = window.setTimeout(() => {
@@ -482,10 +539,12 @@ window.__ModuleLoader__.load({
 			}
 			send(command) {
 				if (this.socket?.readyState !== WebSocket.OPEN) {
-					this.update({
+					const next = {
 						...this.snapshot,
 						error: "The OAuth connection to DSH is not ready."
-					});
+					};
+					delete next.errorDetail;
+					this.update(next);
 					return;
 				}
 				this.socket.send(JSON.stringify(command));
@@ -504,7 +563,7 @@ window.__ModuleLoader__.load({
 						this.update(nextSnapshot);
 						return;
 					case "started":
-						const { error: _error, ...current } = this.snapshot;
+						const { error: _error, errorDetail: _errorDetail, ...current } = this.snapshot;
 						this.update({
 							...current,
 							attempt: {
@@ -567,17 +626,26 @@ window.__ModuleLoader__.load({
 					}
 					case "error": {
 						const attempt = this.snapshot.attempt;
-						if (message.attemptId !== void 0 && attempt?.id === message.attemptId) this.update({
-							...this.snapshot,
-							attempt: {
+						if (message.attemptId !== void 0 && attempt?.id === message.attemptId) {
+							const nextAttempt = {
 								...attempt,
 								error: message.message
-							}
-						});
-						else this.update({
-							...this.snapshot,
-							error: message.message
-						});
+							};
+							if (message.detail === void 0) delete nextAttempt.errorDetail;
+							else nextAttempt.errorDetail = message.detail;
+							this.update({
+								...this.snapshot,
+								attempt: nextAttempt
+							});
+						} else {
+							const next = {
+								...this.snapshot,
+								error: message.message
+							};
+							if (message.detail === void 0) delete next.errorDetail;
+							else next.errorDetail = message.detail;
+							this.update(next);
+						}
 						return;
 					}
 					case "ack": return;
@@ -595,7 +663,7 @@ window.__ModuleLoader__.load({
 .dsh-oauth-section{display:flex;flex-direction:column;gap:12px;max-width:720px;color:var(--dsw-alias-label-primary)}
 .dsh-oauth-title{margin:0;font-size:16px;line-height:24px;font-weight:500}
 .dsh-oauth-intro,.dsh-oauth-muted{margin:0;font-size:13px;line-height:20px;color:var(--dsw-alias-label-tertiary)}
-.dsh-oauth-error{margin:0;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}
+.dsh-oauth-error{display:flex;flex-direction:column;gap:6px;margin:0;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}.dsh-oauth-error p{margin:0}.dsh-oauth-error pre{box-sizing:border-box;max-width:100%;max-height:320px;margin:0;padding:8px;border:1px solid var(--dsw-alias-border-l2);border-radius:6px;overflow:auto;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-primary);font:11px/17px ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;white-space:pre-wrap;overflow-wrap:anywhere}.dsh-oauth-error-details summary{cursor:pointer;color:var(--dsw-alias-label-secondary);user-select:none}.dsh-oauth-error-details[open] summary{margin-bottom:6px}
 .dsh-oauth-list{display:flex;flex-direction:column;gap:8px;margin:4px 0 0;padding:0;list-style:none}
 .dsh-oauth-card{display:flex;flex-direction:column;gap:10px;padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:12px}
 .dsh-oauth-head{display:flex;align-items:center;gap:8px;flex-wrap:wrap}.dsh-oauth-name{font-size:14px;font-weight:500}.dsh-oauth-state{display:inline-flex;align-items:center;gap:6px;padding:3px 8px;border-radius:999px;background:var(--dsw-alias-interactive-bg-hover);font-size:12px;color:var(--dsw-alias-label-secondary)}
@@ -607,6 +675,7 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/index.ts
 		const NS = "settings.oauth-accounts";
+		const MODEL_SETTINGS_VISIBILITY = "modelSettingsVisibility";
 		/** Required browser services for settings placement and localized copy. */
 		const inject = ["slots", "locale"];
 		/** Register the OAuth account page and its app-lifetime connection controller. */
@@ -628,6 +697,10 @@ window.__ModuleLoader__.load({
 			ctx.effect(() => () => {
 				controller.dispose();
 			}, "dsh-oauth-adapter: controller");
+			ctx.inject([MODEL_SETTINGS_VISIBILITY], (scope) => {
+				const visibility = scope.get(MODEL_SETTINGS_VISIBILITY);
+				scope.effect(() => visibility.registerHiddenProviders(PROVIDERS.map((provider) => provider.id)), "dsh-oauth-adapter: hide OAuth providers from Models settings");
+			});
 			const t = ctx.locale.bind(NS);
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",

package/lib/index.d.ts

@@ -33,6 +33,8 @@ export declare function isLoopbackAddress(address: string | undefined): boolean;
 export declare function safeNoticeUrl(value: string | undefined): string | undefined;
 /** Validate the browser handshake before `ws` takes ownership of the socket. */
 export declare function acceptsBrowserUpgrade(request: IncomingMessage): boolean;
+/** Format one Host failure for browser diagnostics without forwarding credentials or unbounded data. */
+export declare function formatErrorDetail(error: unknown): string;
 /** Mount the loopback-only OAuth WebSocket over official rc2 services. */
 export declare function apply(ctx: OAuthContext, config: Config): () => Promise<void>;
 export {};

package/lib/index.js

@@ -4,6 +4,7 @@
  * @module @edge-sky/dsh-oauth-adapter
  */
 import { randomUUID } from 'node:crypto';
+import { inspect } from 'node:util';
 import { settingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from '@deepseek-ai/schemastery';
 import WebSocket, { WebSocketServer } from 'ws';
@@ -55,6 +56,13 @@ function promptView(prompt, provider) {
             : {},
     };
 }
+function providerPromptAnswer(prompt, provider, value) {
+    if (provider === 'github-copilot' && prompt.kind === 'text'
+        && prompt.message === GITHUB_DOMAIN_PROMPT && value.trim().length === 0) {
+        return 'github.com';
+    }
+    return value;
+}
 /** Whether a socket address belongs to the local host. */
 export function isLoopbackAddress(address) {
     return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
@@ -101,6 +109,67 @@ function rawLength(raw) {
         return raw.reduce((total, chunk) => total + chunk.byteLength, 0);
     return raw.byteLength;
 }
+const MAX_ERROR_DETAIL_LENGTH = 12 * 1024;
+const MAX_ERROR_CAUSE_DEPTH = 6;
+function redactErrorDetail(value) {
+    return value
+        .replace(/(\bAuthorization\b\s*["']?\s*[:=]\s*["']?)(?:Bearer\s+)?([^"'\s,}&]+)/giu, '$1[REDACTED]')
+        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/giu, 'Bearer [REDACTED]')
+        .replace(/(\b(?:access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|api[_-]?key)\b\s*["']?\s*[:=]\s*["']?)([^"'\s,}&]+)/giu, '$1[REDACTED]')
+        .replace(/\b(?:github_pat_|gh[opusr]_|sk-)[A-Za-z0-9_-]{12,}\b/gu, '[REDACTED]');
+}
+function errorProperties(value) {
+    const record = value;
+    const properties = ['code', 'status', 'statusCode']
+        .flatMap((key) => {
+        const entry = record[key];
+        return typeof entry === 'string' || typeof entry === 'number' ? [`${key}: ${String(entry)}`] : [];
+    });
+    return properties.length === 0 ? undefined : properties.join(', ');
+}
+/** Format one Host failure for browser diagnostics without forwarding credentials or unbounded data. */
+export function formatErrorDetail(error) {
+    const sections = [];
+    const seen = new Set();
+    let current = error;
+    for (let depth = 0; current !== undefined && depth < MAX_ERROR_CAUSE_DEPTH; depth += 1) {
+        if (typeof current === 'object' && current !== null) {
+            if (seen.has(current)) {
+                sections.push('Caused by: [circular error cause]');
+                current = undefined;
+                break;
+            }
+            seen.add(current);
+        }
+        const prefix = depth === 0 ? '' : 'Caused by: ';
+        if (current instanceof Error) {
+            const properties = errorProperties(current);
+            const rendered = current.stack ?? `${current.name}: ${current.message}`;
+            sections.push(`${prefix}${rendered}${properties === undefined ? '' : `\n${properties}`}`);
+            current = current.cause;
+            continue;
+        }
+        sections.push(prefix + (typeof current === 'string'
+            ? current
+            : inspect(current, {
+                breakLength: 120,
+                compact: false,
+                customInspect: false,
+                depth: 4,
+                maxArrayLength: 40,
+                maxStringLength: 4096,
+                sorted: true,
+            })));
+        current = undefined;
+        break;
+    }
+    if (current !== undefined)
+        sections.push('Caused by: [additional causes omitted]');
+    const redacted = redactErrorDetail(sections.join('\n'));
+    if (redacted.length <= MAX_ERROR_DETAIL_LENGTH)
+        return redacted;
+    return `${redacted.slice(0, MAX_ERROR_DETAIL_LENGTH)}\n[diagnostic truncated]`;
+}
 /** One ownership-scoped browser authorization connection. */
 class OAuthConnection {
     ctx;
@@ -124,7 +193,7 @@ class OAuthConnection {
             this.queue = this.queue.then(() => this.receive(raw.toString())).catch((error) => {
                 this.ctx.logger.warn('dsh-oauth-adapter: command handling failed');
                 this.ctx.logger.warn(error);
-                this.sendError('operation-failed', 'the OAuth operation failed');
+                this.sendError('operation-failed', 'the OAuth operation failed', undefined, undefined, formatErrorDetail(error));
             });
         });
         socket.on('close', () => {
@@ -150,11 +219,12 @@ class OAuthConnection {
         if (this.socket.readyState === WebSocket.OPEN)
             this.socket.send(JSON.stringify(message));
     }
-    sendError(code, message, requestId, attemptId) {
+    sendError(code, message, requestId, attemptId, detail) {
         this.send({
             type: 'error', code, message,
             ...requestId === undefined ? {} : { requestId },
             ...attemptId === undefined ? {} : { attemptId },
+            ...detail === undefined ? {} : { detail },
         });
     }
     async receive(raw) {
@@ -226,7 +296,7 @@ class OAuthConnection {
         catch (error) {
             this.ctx.logger.warn('dsh-oauth-adapter: credential status read failed');
             this.ctx.logger.warn(error);
-            this.sendError('operation-failed', 'account status is unavailable', requestId);
+            this.sendError('operation-failed', 'account status is unavailable', requestId, undefined, formatErrorDetail(error));
         }
     }
     begin(command) {
@@ -278,14 +348,14 @@ class OAuthConnection {
                 catch (error) {
                     this.ctx.logger.warn('dsh-oauth-adapter: model route activation failed for %s', provider.id);
                     this.ctx.logger.warn(error);
-                    this.sendError('model-route-unavailable', 'sign-in completed, but the OAuth model route could not be enabled', undefined, attempt.id);
+                    this.sendError('model-route-unavailable', 'sign-in completed, but the OAuth model route could not be enabled', undefined, attempt.id, formatErrorDetail(error));
                 }
             }
             this.finish(attempt, outcome.status);
         }, (error) => {
             this.ctx.logger.warn('dsh-oauth-adapter: provider sign-in failed for %s', attempt.provider);
             this.ctx.logger.warn(error);
-            this.sendError('sign-in-failed', 'sign-in failed; inspect the DSH Host log', undefined, attempt.id);
+            this.sendError('sign-in-failed', 'sign-in failed', undefined, attempt.id, formatErrorDetail(error));
             this.finish(attempt, 'failed');
         });
     }
@@ -310,7 +380,7 @@ class OAuthConnection {
                 });
             };
             attempt.prompts.set(promptId, {
-                resolve: value => { finish(() => { resolve(value); }); },
+                resolve: value => { finish(() => { resolve(providerPromptAnswer(prompt, attempt.provider, value)); }); },
                 reject: reason => { finish(() => { reject(reason); }); },
             });
             prompt.signal?.addEventListener('abort', withdraw, { once: true });
@@ -370,7 +440,7 @@ class OAuthConnection {
         catch (error) {
             this.ctx.logger.warn('dsh-oauth-adapter: sign-out failed for %s', provider.id);
             this.ctx.logger.warn(error);
-            this.sendError('operation-failed', 'sign-out failed; inspect the DSH Host log', command.requestId);
+            this.sendError('operation-failed', 'sign-out failed', command.requestId, undefined, formatErrorDetail(error));
         }
     }
     finish(attempt, status) {

package/lib/protocol.d.ts

@@ -13,6 +13,26 @@ export declare const PROVIDERS: readonly [{
     readonly key: "llm-pi-ai/github-copilot";
     readonly fallbackLabel: "GitHub Copilot";
     readonly modelGroupLabel: "GitHub Copilot (OAuth)";
+}, {
+    readonly id: "anthropic";
+    readonly key: "llm-pi-ai/anthropic";
+    readonly fallbackLabel: "Anthropic";
+    readonly modelGroupLabel: "Anthropic (OAuth)";
+}, {
+    readonly id: "kimi-coding";
+    readonly key: "llm-pi-ai/kimi-coding";
+    readonly fallbackLabel: "Kimi For Coding";
+    readonly modelGroupLabel: "Kimi For Coding (OAuth)";
+}, {
+    readonly id: "openrouter";
+    readonly key: "llm-pi-ai/openrouter";
+    readonly fallbackLabel: "OpenRouter";
+    readonly modelGroupLabel: "OpenRouter (OAuth)";
+}, {
+    readonly id: "xai";
+    readonly key: "llm-pi-ai/xai";
+    readonly fallbackLabel: "xAI";
+    readonly modelGroupLabel: "xAI (OAuth)";
 }];
 export type ProviderId = (typeof PROVIDERS)[number]['id'];
 export interface AccountView {
@@ -104,6 +124,8 @@ export type ServerMessage = {
     attemptId?: string;
     code: OAuthErrorCode;
     message: string;
+    /** Bounded, credential-redacted Host diagnostic for optional UI expansion. */
+    detail?: string;
 };
 export type CommandParseResult = {
     ok: true;

package/lib/protocol.js

@@ -12,6 +12,22 @@ export const PROVIDERS = [
         id: 'github-copilot', key: 'llm-pi-ai/github-copilot', fallbackLabel: 'GitHub Copilot',
         modelGroupLabel: 'GitHub Copilot (OAuth)',
     },
+    {
+        id: 'anthropic', key: 'llm-pi-ai/anthropic', fallbackLabel: 'Anthropic',
+        modelGroupLabel: 'Anthropic (OAuth)',
+    },
+    {
+        id: 'kimi-coding', key: 'llm-pi-ai/kimi-coding', fallbackLabel: 'Kimi For Coding',
+        modelGroupLabel: 'Kimi For Coding (OAuth)',
+    },
+    {
+        id: 'openrouter', key: 'llm-pi-ai/openrouter', fallbackLabel: 'OpenRouter',
+        modelGroupLabel: 'OpenRouter (OAuth)',
+    },
+    {
+        id: 'xai', key: 'llm-pi-ai/xai', fallbackLabel: 'xAI',
+        modelGroupLabel: 'xAI (OAuth)',
+    },
 ];
 const ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function isRecord(value) {

package/lib/types/client/locales.d.ts

@@ -19,6 +19,7 @@ export declare const en: {
     readonly authorized: "Sign-in completed.";
     readonly cancelled: "Sign-in was cancelled.";
     readonly failed: "Sign-in failed.";
+    readonly technicalDetails: "Technical details";
     readonly submit: "Continue";
     readonly copy: "Copy code";
     readonly copied: "Copied";

package/lib/types/client/store.d.ts

@@ -16,12 +16,14 @@ export interface AttemptView {
     notice?: NoticeView;
     prompt?: ActivePromptView;
     error?: string;
+    errorDetail?: string;
 }
 export interface OAuthAccountsSnapshot {
     connection: 'connecting' | 'open' | 'reconnecting' | 'closed';
     accounts: readonly AccountView[];
     attempt?: AttemptView;
     error?: string;
+    errorDetail?: string;
 }
 type Listener = () => void;
 /** Remove interaction-only content once an authorization attempt settles. */

package/lib/types/client/styles.d.ts

@@ -1,3 +1,3 @@
 /** Plugin-owned styles, injected and removed with the browser Cordis fiber. */
-export declare const styles = "\n.dsh-oauth-section{display:flex;flex-direction:column;gap:12px;max-width:720px;color:var(--dsw-alias-label-primary)}\n.dsh-oauth-title{margin:0;font-size:16px;line-height:24px;font-weight:500}\n.dsh-oauth-intro,.dsh-oauth-muted{margin:0;font-size:13px;line-height:20px;color:var(--dsw-alias-label-tertiary)}\n.dsh-oauth-error{margin:0;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}\n.dsh-oauth-list{display:flex;flex-direction:column;gap:8px;margin:4px 0 0;padding:0;list-style:none}\n.dsh-oauth-card{display:flex;flex-direction:column;gap:10px;padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:12px}\n.dsh-oauth-head{display:flex;align-items:center;gap:8px;flex-wrap:wrap}.dsh-oauth-name{font-size:14px;font-weight:500}.dsh-oauth-state{display:inline-flex;align-items:center;gap:6px;padding:3px 8px;border-radius:999px;background:var(--dsw-alias-interactive-bg-hover);font-size:12px;color:var(--dsw-alias-label-secondary)}\n.dsh-oauth-dot{width:7px;height:7px;border-radius:50%;background:var(--dsw-alias-label-tertiary)}.dsh-oauth-state[data-state=ready] .dsh-oauth-dot{background:var(--dsw-alias-state-success-primary)}.dsh-oauth-state[data-state=warning] .dsh-oauth-dot{background:var(--dsw-alias-state-error-primary)}.dsh-oauth-state[data-state=authorizing] .dsh-oauth-dot{background:var(--dsw-alias-button-info-fill)}\n.dsh-oauth-actions{display:flex;gap:6px;margin-left:auto}.dsh-oauth-button{box-sizing:border-box;display:inline-flex;align-items:center;justify-content:center;min-height:30px;padding:0 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:15px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:18px;cursor:pointer}.dsh-oauth-button[data-variant=primary]{border-color:transparent;background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}.dsh-oauth-button[data-variant=danger]{border-color:transparent;color:var(--dsw-alias-state-error-primary)}.dsh-oauth-button:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-solid)}.dsh-oauth-button[data-variant=primary]:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover);color:var(--dsw-alias-label-primary-foreground)}.dsh-oauth-button[data-variant=danger]:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.dsh-oauth-button:focus-visible{outline:none;box-shadow:0 0 0 2px var(--dsw-alias-border-l3)}.dsh-oauth-button:disabled{cursor:not-allowed;opacity:.4}\n.dsh-oauth-flow{display:flex;flex-direction:column;gap:8px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l3);font-size:13px;line-height:20px}.dsh-oauth-link{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:8px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:9px;background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary);text-decoration:none}.dsh-oauth-link:hover{background:var(--dsw-alias-interactive-bg-hover-solid)}.dsh-oauth-link-label{font-weight:500}.dsh-oauth-link-host{max-width:240px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--dsw-alias-label-tertiary);font-size:12px}.dsh-oauth-link-icon{color:var(--dsw-alias-brand-text)}.dsh-oauth-code{display:flex;align-items:center;gap:8px}.dsh-oauth-code code{padding:5px 8px;border-radius:6px;background:var(--dsw-alias-bg-module-platform);font-size:14px;letter-spacing:.08em}\n.dsh-oauth-prompt{display:flex;flex-direction:column;gap:7px}.dsh-oauth-input,.dsh-oauth-select{box-sizing:border-box;width:100%;height:34px;padding:0 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-primary)}\n";
+export declare const styles = "\n.dsh-oauth-section{display:flex;flex-direction:column;gap:12px;max-width:720px;color:var(--dsw-alias-label-primary)}\n.dsh-oauth-title{margin:0;font-size:16px;line-height:24px;font-weight:500}\n.dsh-oauth-intro,.dsh-oauth-muted{margin:0;font-size:13px;line-height:20px;color:var(--dsw-alias-label-tertiary)}\n.dsh-oauth-error{display:flex;flex-direction:column;gap:6px;margin:0;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}.dsh-oauth-error p{margin:0}.dsh-oauth-error pre{box-sizing:border-box;max-width:100%;max-height:320px;margin:0;padding:8px;border:1px solid var(--dsw-alias-border-l2);border-radius:6px;overflow:auto;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-primary);font:11px/17px ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;white-space:pre-wrap;overflow-wrap:anywhere}.dsh-oauth-error-details summary{cursor:pointer;color:var(--dsw-alias-label-secondary);user-select:none}.dsh-oauth-error-details[open] summary{margin-bottom:6px}\n.dsh-oauth-list{display:flex;flex-direction:column;gap:8px;margin:4px 0 0;padding:0;list-style:none}\n.dsh-oauth-card{display:flex;flex-direction:column;gap:10px;padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:12px}\n.dsh-oauth-head{display:flex;align-items:center;gap:8px;flex-wrap:wrap}.dsh-oauth-name{font-size:14px;font-weight:500}.dsh-oauth-state{display:inline-flex;align-items:center;gap:6px;padding:3px 8px;border-radius:999px;background:var(--dsw-alias-interactive-bg-hover);font-size:12px;color:var(--dsw-alias-label-secondary)}\n.dsh-oauth-dot{width:7px;height:7px;border-radius:50%;background:var(--dsw-alias-label-tertiary)}.dsh-oauth-state[data-state=ready] .dsh-oauth-dot{background:var(--dsw-alias-state-success-primary)}.dsh-oauth-state[data-state=warning] .dsh-oauth-dot{background:var(--dsw-alias-state-error-primary)}.dsh-oauth-state[data-state=authorizing] .dsh-oauth-dot{background:var(--dsw-alias-button-info-fill)}\n.dsh-oauth-actions{display:flex;gap:6px;margin-left:auto}.dsh-oauth-button{box-sizing:border-box;display:inline-flex;align-items:center;justify-content:center;min-height:30px;padding:0 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:15px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:18px;cursor:pointer}.dsh-oauth-button[data-variant=primary]{border-color:transparent;background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}.dsh-oauth-button[data-variant=danger]{border-color:transparent;color:var(--dsw-alias-state-error-primary)}.dsh-oauth-button:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-solid)}.dsh-oauth-button[data-variant=primary]:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover);color:var(--dsw-alias-label-primary-foreground)}.dsh-oauth-button[data-variant=danger]:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.dsh-oauth-button:focus-visible{outline:none;box-shadow:0 0 0 2px var(--dsw-alias-border-l3)}.dsh-oauth-button:disabled{cursor:not-allowed;opacity:.4}\n.dsh-oauth-flow{display:flex;flex-direction:column;gap:8px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l3);font-size:13px;line-height:20px}.dsh-oauth-link{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:8px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:9px;background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary);text-decoration:none}.dsh-oauth-link:hover{background:var(--dsw-alias-interactive-bg-hover-solid)}.dsh-oauth-link-label{font-weight:500}.dsh-oauth-link-host{max-width:240px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--dsw-alias-label-tertiary);font-size:12px}.dsh-oauth-link-icon{color:var(--dsw-alias-brand-text)}.dsh-oauth-code{display:flex;align-items:center;gap:8px}.dsh-oauth-code code{padding:5px 8px;border-radius:6px;background:var(--dsw-alias-bg-module-platform);font-size:14px;letter-spacing:.08em}\n.dsh-oauth-prompt{display:flex;flex-direction:column;gap:7px}.dsh-oauth-input,.dsh-oauth-select{box-sizing:border-box;width:100%;height:34px;padding:0 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-primary)}\n";
 //# sourceMappingURL=styles.d.ts.map

package/lib/types/protocol.d.ts

@@ -13,6 +13,26 @@ export declare const PROVIDERS: readonly [{
     readonly key: "llm-pi-ai/github-copilot";
     readonly fallbackLabel: "GitHub Copilot";
     readonly modelGroupLabel: "GitHub Copilot (OAuth)";
+}, {
+    readonly id: "anthropic";
+    readonly key: "llm-pi-ai/anthropic";
+    readonly fallbackLabel: "Anthropic";
+    readonly modelGroupLabel: "Anthropic (OAuth)";
+}, {
+    readonly id: "kimi-coding";
+    readonly key: "llm-pi-ai/kimi-coding";
+    readonly fallbackLabel: "Kimi For Coding";
+    readonly modelGroupLabel: "Kimi For Coding (OAuth)";
+}, {
+    readonly id: "openrouter";
+    readonly key: "llm-pi-ai/openrouter";
+    readonly fallbackLabel: "OpenRouter";
+    readonly modelGroupLabel: "OpenRouter (OAuth)";
+}, {
+    readonly id: "xai";
+    readonly key: "llm-pi-ai/xai";
+    readonly fallbackLabel: "xAI";
+    readonly modelGroupLabel: "xAI (OAuth)";
 }];
 export type ProviderId = (typeof PROVIDERS)[number]['id'];
 export interface AccountView {
@@ -104,6 +124,8 @@ export type ServerMessage = {
     attemptId?: string;
     code: OAuthErrorCode;
     message: string;
+    /** Bounded, credential-redacted Host diagnostic for optional UI expansion. */
+    detail?: string;
 };
 export type CommandParseResult = {
     ok: true;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@edge-sky/dsh-oauth-adapter",
   "description": "Web OAuth account surface for official DSH authorization flows",
-  "version": "0.1.1-rc.9",
+  "version": "0.1.2-beta.1",
   "author": {
     "name": "edge-sky",
     "url": "https://github.com/edge-sky"
@@ -11,8 +11,9 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/edge-sky/dsh-oauth.git"
+    "url": "git+https://github.com/edge-sky/dsh-oauth-adapter.git"
   },
+  "packageManager": "pnpm@11.7.0",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
   },
@@ -44,6 +45,13 @@
     "lib/**/*.js",
     "lib/**/*.d.ts"
   ],
+  "scripts": {
+    "build": "tsdown && pnpm run build:host && pnpm run build:client:types",
+    "build:host": "tsc -p tsconfig.json",
+    "build:client:types": "tsc -p tsconfig.client.json",
+    "test": "pnpm run build && vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit"
+  },
   "license": "MIT",
   "dsh": {
     "bundle": {
@@ -60,16 +68,17 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": ">=4.0.1",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-runtime": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-credentials": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-invariants": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.2",
-    "@deepseek-ai/dsh-settings": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-authorization": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-runtime": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-credentials": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-invariants": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.2 <0.2.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.1.1-rc.2 <0.2.0-0",
     "react": ">=18.2.0"
   },
   "peerDependenciesMeta": {
@@ -111,12 +120,12 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/dsh-authorization": ">=0.1.1-rc.2",
     "@deepseek-ai/schemastery": "^3.18.1",
     "ws": "^8.18.3"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-authorization": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
@@ -136,12 +145,5 @@
     "tsdown": "^0.22.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
-  },
-  "scripts": {
-    "build": "tsdown && pnpm run build:host && pnpm run build:client:types",
-    "build:host": "tsc -p tsconfig.json",
-    "build:client:types": "tsc -p tsconfig.client.json",
-    "test": "pnpm run build && vitest run",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit"
   }
-}
+}