@edge-sky/dsh-oauth-adapter 0.1.2-dev.2 → 0.1.2-rc.0

package/README.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record: the git blob hash of each side as of the
 # last confirmed-consistent state. Both languages carry equal authority.
-README.md: fd0eef65a18d89c5e1dd49d9bc0fc89f9c2a770a
-README.zh.md: aeb4cf30a05c98c1b885c4c7eece00f3bb138c39
+README.md: 6e18cc90e25e581abecfbf502af2022922b408d8
+README.zh.md: 807ae07ac4b6d42bee91ceac3c874406ecc32ab0

package/README.md

@@ -2,84 +2,48 @@
 
 English | [中文](README.zh.md)
 
-OAuth sign-in and account model management for the DSH Web profile. The validation baseline is DSH `0.1.2-rc.1`, with an exact plugin dependency on pi-ai `0.84.4`. Synchronizing models never installs or upgrades packages.
+An OAuth account page for the DSH Web profile. It supports:
 
-## Install
-
-```sh
-dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
-dsh web
-```
-
-Use **Settings → OAuth Accounts** to connect or reconnect an account. Successful authorization automatically synchronizes its models. Authorization and synchronization have separate results: a discovery failure does not undo successful sign-in.
-
-Use the **OAuth models** area of **Settings → Models** to synchronize an existing connection, configure unmatched models, and add, edit or delete manual entries. This area occupies the public `settings.models.footer` slot. No additional model settings page is installed.
-
-| Provider | Model protocol |
+| Provider | pi-ai sign-in path |
 | --- | --- |
-| GitHub Copilot | Select Chat Completions, Responses or Anthropic Messages per model |
-| OpenRouter | Select Chat Completions or Anthropic Messages per model |
-| OpenAI Codex | Codex Responses |
-| xAI | OpenAI Responses |
-| Anthropic, Kimi Coding | Anthropic Messages |
-
-Model ID is required; a blank display name uses the ID. Fixed-protocol providers have no protocol selector and reject protocol overrides on the server. An unknown model receives the provider's configured default capacities, text input and no inferred reasoning capability. Saving permits an attempted request; it does not prove the model exists, that the account can call it, or that all capabilities are known.
-
-## Synchronization
+| OpenAI Codex | Browser callback or device code |
+| GitHub Copilot | GitHub or GitHub Enterprise device code |
+| Anthropic | Browser callback with manual code/redirect fallback |
+| Kimi For Coding | Device code |
+| OpenRouter | Browser PKCE callback |
+| xAI | Device code |
 
-Discovery uses each provider's authenticated endpoint, including Copilot's OAuth-resolved API host, Codex's account header, Anthropic cursor pagination and OpenRouter's account-filtered offset pagination. OpenRouter's public catalog is not used as a substitute. An unsupported endpoint or insufficient OAuth scope is reported and manual configuration remains available. Endpoint details and references are in [migration and operation](docs/oauth-models.md).
+Each account is shown only as available when the installed `@deepseek-ai/dsh-llm-pi-ai` actually registers its OAuth flow. This keeps older or differently bundled pi-ai versions fail-closed instead of exposing a login button that cannot work.
 
-Only exact IDs within the same provider inherit pi-ai's full model metadata. No display-name matching or undocumented alias inference selects a protocol. Unknown IDs remain **Needs configuration**. Successful synchronization replaces automatic entries with the complete remote result, including a genuinely empty result. Manual entries survive and merge by ID with explicit user fields winning. Errors retain the last successful result. Before any successful discovery, the previous configured or built-in list remains available and is labeled unverified. Reconnection to a different or unidentifiable account clears the old account's automatic results before discovery.
+The adapter has only been tested with DSH `0.1.1-rc.2`; compatibility with future versions is not guaranteed.
 
-The plugin stores model settings in `oauth-models`, including a version, migration backup, cached remote IDs and manual entries. Credentials remain exclusively at `llm-pi-ai/<provider>` through DSH's credentials service. Public pi-ai authentication handles token refresh; tokens never enter model settings or browser messages. A future plugin dependency upgrade rematches cached IDs against the newly loaded catalog.
-
-Existing provider IDs and session references remain unchanged. Simple profiles generated by earlier plugin versions migrate automatically; custom profiles require a preview in Models. API-key references, composition-owned profiles and competing adapters are not overwritten. See [migration and recovery](docs/oauth-models.md#migration-and-recovery) before upgrading a customized installation.
+## Install
 
-## Configuration
+```sh
+dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
+```
 
-The optional Host plugin configuration accepts:
+or
 
-| Field | Default | Meaning |
-| --- | --- | --- |
-| `debug` | `false` | Transport lifecycle diagnostics |
-| `modelSyncTimeoutMs` | `30000` | Discovery and route-release timeout |
-| `modelSyncMaxResponseBytes` | `4194304` | Maximum bytes per remote page |
-| `modelSyncMaxPages` | `100` | Maximum pages per synchronization |
-| `codexClientVersion` | `0.149.0` | Version sent to the Codex discovery endpoint |
+```sh
+npx @deepseek-ai/dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
+```
 
-## Development and verification
+Start DSH:
 
 ```sh
-pnpm install
-pnpm run typecheck
-pnpm test
+npx @deepseek-ai/dsh web
 ```
 
-Tests cover provider responses, matching, retained results, revisions, migration recovery, cancellation, actual rc adapter requests with network interception, and published rc model-page bundles in a DOM environment with replayable snapshots. WebSocket tests bind a loopback port. All test credentials are synthetic; these checks do not establish live-account discovery or inference success for any provider. DSH source changes are not required.
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/78a59190-8029-4c60-bc50-b763312540f7" />
 
-## Local package and installation verification
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/e0cc6591-73a4-4e87-9ef6-68950126b290" />
 
-`npm pack` and `npm publish` from the package directory run type checking, a fresh build, and tests through `prepack`; a failure stops packaging. Do not bypass this check with `--ignore-scripts`. Published versions cannot be overwritten, so a fixed release needs a new version number.
 
-A temporary `DSH_HOME` lets you test a local tarball without affecting existing accounts or profiles or changing DSH code:
+## How it works
 
-```sh
-pnpm install --frozen-lockfile
-artifact_dir=$(mktemp -d)
-npm pack --pack-destination "$artifact_dir"
-export DSH_HOME=$(mktemp -d)
-mkdir -p "$DSH_HOME/profiles/web"
-cat > "$DSH_HOME/profiles/web/pnpm-workspace.yaml" <<'YAML'
-packages:
-  - .
-nodeLinker: hoisted
-autoInstallPeers: false
-allowBuilds:
-  '@google/genai': false
-  protobufjs: false
-YAML
-npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add "$artifact_dir"/*.tgz
-npx @deepseek-ai/dsh@0.1.2-rc.1 web --no-open
-```
+DSH integrates pi-ai through the `@deepseek-ai/dsh-llm-pi-ai` adapter, but does not provide an OAuth entry point. `@edge-sky/dsh-oauth-adapter` exposes pi-ai's existing provider login flows through the DSH Authorization Service. Browser links, device codes, text and secret input, method selection, cancellation, and withdrawn prompts all use the same provider-neutral transport.
+
+Because DSH does not currently mount the `ctx.authorization` service, this plugin also mounts it manually.
 
-After stopping the server, run `unset DSH_HOME` to restore the default directory. The test profile explicitly skips installation scripts for these two dependencies; the plugin repository's policy does not propagate to consumers. New users still need to configure this policy in their own profiles. Successful startup verifies plugin loading; real-account login, model discovery, and inference need separate verification.
+The plugin itself does not manage OAuth credentials or maintain login state. Maybe DSH support this sign-in method in the future; but for now, this plugin lets you enjoy it.

package/README.zh.md

@@ -2,84 +2,48 @@
 
 [English](README.md) | 中文
 
-为 DSH Web profile 提供 OAuth 登录和账号模型管理。验证基线为 DSH `0.1.2-rc.1`，插件精确依赖 pi-ai `0.84.4`。同步模型不会安装或升级依赖。
+为 DSH Web profile 提供独立的 OAuth 账户页面。当前支持：
 
-## 安装
-
-```sh
-dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
-dsh web
-```
-
-在 **设置 → OAuth 账户** 连接或重新连接账号。授权成功后自动同步模型。授权和同步分别报告结果：发现失败不会撤销成功的登录。
-
-在 **设置 → 模型** 的 **OAuth 模型** 区域同步已连接账号、补充待配置模型，以及添加、编辑或删除手动模型。该区域使用公开的 `settings.models.footer` 插槽，不增加独立模型设置页面。
-
-| 供应商 | 模型协议 |
+| 提供商 | pi-ai 登录路径 |
 | --- | --- |
-| GitHub Copilot | 每个模型选择 Chat Completions、Responses 或 Anthropic Messages |
-| OpenRouter | 每个模型选择 Chat Completions 或 Anthropic Messages |
-| OpenAI Codex | Codex Responses |
-| xAI | OpenAI Responses |
-| Anthropic、Kimi Coding | Anthropic Messages |
-
-模型 ID 必填，显示名称留空时使用 ID。固定协议供应商不显示协议选择器，后端也拒绝协议覆盖。未知模型采用供应商配置的默认容量、文本输入，不根据名称推断思考能力。保存后可尝试发送请求，但不代表已验证模型存在、账号可调用或全部模型能力。
-
-## 同步行为
+| OpenAI Codex | 浏览器回调或设备码 |
+| GitHub Copilot | GitHub 或 GitHub Enterprise 设备码 |
+| Anthropic | 浏览器回调，并支持手工粘贴授权码/重定向地址 |
+| Kimi For Coding | 设备码 |
+| OpenRouter | 浏览器 PKCE 回调 |
+| xAI | 设备码 |
 
-发现使用各供应商的认证端点，包括 Copilot 经 OAuth 解析的 API 主机、Codex 账号请求头、Anthropic 游标分页及 OpenRouter 账号过滤列表的偏移分页。不会使用 OpenRouter 公开总目录代替账号列表。端点不支持或 OAuth 权限不足时明确报错，仍可手动配置。端点和依据见[迁移与运行说明](docs/oauth-models.zh.md)。
+只有当当前安装的 `@deepseek-ai/dsh-llm-pi-ai` 确实注册了对应 OAuth 流程时，账户才会显示为可用。这样旧版或采用不同 pi-ai bundle 的 DSH 会安全地禁用登录按钮，而不会暴露无法完成的流程。
 
-只有同一供应商内精确匹配的 ID 才继承 pi-ai 的完整模型描述。不通过显示名称或未经证实的别名推断调用协议。未知 ID 保持为**待配置**。成功同步使用完整远端结果替换自动项，包括真正的空列表；手动项始终保留，同 ID 合并，用户明确填写的字段优先。失败保留最近成功结果。首次成功发现前，保留原配置或内置列表并标明未经验证。重新连接至不同或无法识别的账号时，先清除旧账号的自动结果，再进行发现。
+当前仅对 DSH`0.1.1-rc.2`进行了测试，不保证未来版本的兼容性
 
-插件使用 `oauth-models` 保存版本、迁移备份、远端 ID 缓存和手动项。凭据始终通过 DSH credentials 服务保存在 `llm-pi-ai/<provider>`。公开 pi-ai 认证能力负责 token 刷新，token 不进入模型设置或浏览器消息。后续升级插件依赖时，已保存的远端 ID 会与新加载的目录重新匹配。
-
-既有供应商 ID 和会话引用保持不变。旧插件生成的简单配置自动迁移；自定义配置需要在模型页预览确认。API-key 引用、组合基础层配置和其他适配器占用的路由不会被覆盖。升级自定义安装前请阅读[迁移与恢复](docs/oauth-models.zh.md#迁移与恢复)。
+## 安装
 
-## 配置
+```sh
+dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
+```
 
-Host 插件接受以下可选配置：
+或
 
-| 字段 | 默认值 | 含义 |
-| --- | --- | --- |
-| `debug` | `false` | 连接生命周期诊断 |
-| `modelSyncTimeoutMs` | `30000` | 模型发现及旧路由释放的超时 |
-| `modelSyncMaxResponseBytes` | `4194304` | 每页远端响应的最大字节数 |
-| `modelSyncMaxPages` | `100` | 一次同步的最大页数 |
-| `codexClientVersion` | `0.149.0` | Codex 发现端点所接收的客户端版本 |
+```sh
+npx @deepseek-ai/dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
+```
 
-## 开发与验证
+启动 DSH：
 
 ```sh
-pnpm install
-pnpm run typecheck
-pnpm test
+npx @deepseek-ai/dsh web
 ```
 
-测试覆盖供应商响应、匹配、失败保留、revision 冲突、迁移恢复、取消、经过网络拦截的真实 rc 适配器请求，以及 DOM 环境中加载已发布 rc 模型页产物的可重放快照。WebSocket 测试需要绑定回环端口。测试凭据全部为合成数据，这些验证不代表任何供应商的真实账号发现或推理调用已经通过。无需修改 DSH 源码。
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/134ec856-e17b-4800-bb87-069851986d3e" />
 
-## 本地打包与安装验证
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/8007002a-a036-4cf4-b015-d4e50eff25d9" />
 
-`npm pack` 和从目录执行的 `npm publish` 通过 `prepack` 运行类型检查、重新构建和测试；任何一步失败都会终止打包。不要使用 `--ignore-scripts` 跳过该检查。已发布版本不能覆盖，修复后发布必须使用新版本号。
 
-使用临时 `DSH_HOME` 可以测试本地 tarball，不影响现有账号与 profile，也不需要修改 DSH 代码：
+## 工作原理
 
-```sh
-pnpm install --frozen-lockfile
-artifact_dir=$(mktemp -d)
-npm pack --pack-destination "$artifact_dir"
-export DSH_HOME=$(mktemp -d)
-mkdir -p "$DSH_HOME/profiles/web"
-cat > "$DSH_HOME/profiles/web/pnpm-workspace.yaml" <<'YAML'
-packages:
-  - .
-nodeLinker: hoisted
-autoInstallPeers: false
-allowBuilds:
-  '@google/genai': false
-  protobufjs: false
-YAML
-npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add "$artifact_dir"/*.tgz
-npx @deepseek-ai/dsh@0.1.2-rc.1 web --no-open
-```
+DSH 通过 `@deepseek-ai/dsh-llm-pi-ai` 适配器接入 pi-ai，但并没有提供 OAuth 的入口。`@edge-sky/dsh-oauth-adapter` 通过 DSH Authorization Service 暴露 pi-ai 已有的 provider 登录流程。浏览器链接、设备码、文本与密码输入、登录方式选择、取消和撤回提示均通过同一套 provider-neutral 传输完成。
+
+由于 DSH 目前并没有挂载`ctx.authorization`服务，因此该插件同时手动对其进行了挂载
 
-停止服务器后执行 `unset DSH_HOME` 恢复默认目录。测试 profile 的脚本策略显式跳过这两个依赖的安装脚本；插件仓库的策略不会传播到消费端。新用户仍需在自己的 profile 中配置该策略。启动成功只验证插件加载；真实账号登录、模型发现和推理需要单独验证。
+插件本身并不承担 OAuth 凭证管理与维持登录态的职责，或许将来 DSH 会官方支持这一登录方式，但至少现在你可以通过这个插件体验它