@edge-sky/dsh-oauth-adapter 0.1.2-dev.2 → 0.1.3-beta.3

package/README.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record: the git blob hash of each side as of the
 # last confirmed-consistent state. Both languages carry equal authority.
-README.md: fd0eef65a18d89c5e1dd49d9bc0fc89f9c2a770a
-README.zh.md: aeb4cf30a05c98c1b885c4c7eece00f3bb138c39
+README.md: 643064b672859791cce2551254d03f3154647f20
+README.zh.md: d1f28dc87675dd408f84eb495a67da58a7065b33

package/README.md

@@ -1,85 +1,60 @@
 # dsh-oauth-adapter
 
+[![npm version](https://img.shields.io/npm/v/@edge-sky/dsh-oauth-adapter)](https://www.npmjs.com/package/@edge-sky/dsh-oauth-adapter)
+[![npm downloads](https://img.shields.io/npm/dm/@edge-sky/dsh-oauth-adapter)](https://www.npmjs.com/package/@edge-sky/dsh-oauth-adapter)
+[![license](https://img.shields.io/npm/l/@edge-sky/dsh-oauth-adapter)](https://www.npmjs.com/package/@edge-sky/dsh-oauth-adapter)
+
 English | [中文](README.zh.md)
 
-OAuth sign-in and account model management for the DSH Web profile. The validation baseline is DSH `0.1.2-rc.1`, with an exact plugin dependency on pi-ai `0.84.4`. Synchronizing models never installs or upgrades packages.
+An OAuth account page for the DSH Web profile. It supports:
+
+| Provider | pi-ai sign-in path |
+| --- | --- |
+| OpenAI Codex | Browser callback or device code |
+| GitHub Copilot | GitHub or GitHub Enterprise device code |
+| Anthropic | Browser callback with manual code/redirect fallback |
+| Kimi For Coding | Device code |
+| OpenRouter | Browser PKCE callback |
+| xAI | Device code |
+
+This checkout targets DSH `0.2.0-rc.2`. Once an adapter release with the DSH 0.2 peer range is published, install that release. Earlier DSH releases require an earlier adapter release.
 
 ## Install
 
+For DSH `0.2.0-rc.2`, after the compatible adapter release is published:
+
 ```sh
 dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
-dsh web
 ```
 
-Use **Settings → OAuth Accounts** to connect or reconnect an account. Successful authorization automatically synchronizes its models. Authorization and synchronization have separate results: a discovery failure does not undo successful sign-in.
-
-Use the **OAuth models** area of **Settings → Models** to synchronize an existing connection, configure unmatched models, and add, edit or delete manual entries. This area occupies the public `settings.models.footer` slot. No additional model settings page is installed.
-
-| Provider | Model protocol |
-| --- | --- |
-| GitHub Copilot | Select Chat Completions, Responses or Anthropic Messages per model |
-| OpenRouter | Select Chat Completions or Anthropic Messages per model |
-| OpenAI Codex | Codex Responses |
-| xAI | OpenAI Responses |
-| Anthropic, Kimi Coding | Anthropic Messages |
+Or for the official desktop, use `@edge-sky/dsh-oauth-adapter`
 
-Model ID is required; a blank display name uses the ID. Fixed-protocol providers have no protocol selector and reject protocol overrides on the server. An unknown model receives the provider's configured default capacities, text input and no inferred reasoning capability. Saving permits an attempted request; it does not prove the model exists, that the account can call it, or that all capabilities are known.
+For DSH `0.1.2-rc.1` through `0.1.5-rc.1`, use an adapter release from the `0.1.3` series. For DSH `0.1.1-rc.2`, use `@edge-sky/dsh-oauth-adapter@0.1.2-rc.0`.
 
-## Synchronization
+Start DSH:
 
-Discovery uses each provider's authenticated endpoint, including Copilot's OAuth-resolved API host, Codex's account header, Anthropic cursor pagination and OpenRouter's account-filtered offset pagination. OpenRouter's public catalog is not used as a substitute. An unsupported endpoint or insufficient OAuth scope is reported and manual configuration remains available. Endpoint details and references are in [migration and operation](docs/oauth-models.md).
+```sh
+npx @deepseek-ai/dsh web
+```
 
-Only exact IDs within the same provider inherit pi-ai's full model metadata. No display-name matching or undocumented alias inference selects a protocol. Unknown IDs remain **Needs configuration**. Successful synchronization replaces automatic entries with the complete remote result, including a genuinely empty result. Manual entries survive and merge by ID with explicit user fields winning. Errors retain the last successful result. Before any successful discovery, the previous configured or built-in list remains available and is labeled unverified. Reconnection to a different or unidentifiable account clears the old account's automatic results before discovery.
+<img width="2940" height="1766" alt="image" src="https://github.com/user-attachments/assets/cbd98703-ee7a-491b-aa2f-02e42b99f6b9" />
 
-The plugin stores model settings in `oauth-models`, including a version, migration backup, cached remote IDs and manual entries. Credentials remain exclusively at `llm-pi-ai/<provider>` through DSH's credentials service. Public pi-ai authentication handles token refresh; tokens never enter model settings or browser messages. A future plugin dependency upgrade rematches cached IDs against the newly loaded catalog.
 
-Existing provider IDs and session references remain unchanged. Simple profiles generated by earlier plugin versions migrate automatically; custom profiles require a preview in Models. API-key references, composition-owned profiles and competing adapters are not overwritten. See [migration and recovery](docs/oauth-models.md#migration-and-recovery) before upgrading a customized installation.
 
-## Configuration
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/e0cc6591-73a4-4e87-9ef6-68950126b290" />
 
-The optional Host plugin configuration accepts:
+For models not explicitly listed as supported by the built-in pi-ai, you can add them manually (availability needs to be verified on your own).
 
-| Field | Default | Meaning |
-| --- | --- | --- |
-| `debug` | `false` | Transport lifecycle diagnostics |
-| `modelSyncTimeoutMs` | `30000` | Discovery and route-release timeout |
-| `modelSyncMaxResponseBytes` | `4194304` | Maximum bytes per remote page |
-| `modelSyncMaxPages` | `100` | Maximum pages per synchronization |
-| `codexClientVersion` | `0.149.0` | Version sent to the Codex discovery endpoint |
+<img width="774" height="724" alt="PixPin_2026-09-10_11-08-26" src="https://github.com/user-attachments/assets/e3adc9fc-36e6-414f-ae5b-1748ff5e8f70" />
 
-## Development and verification
 
-```sh
-pnpm install
-pnpm run typecheck
-pnpm test
-```
+## How it works
 
-Tests cover provider responses, matching, retained results, revisions, migration recovery, cancellation, actual rc adapter requests with network interception, and published rc model-page bundles in a DOM environment with replayable snapshots. WebSocket tests bind a loopback port. All test credentials are synthetic; these checks do not establish live-account discovery or inference success for any provider. DSH source changes are not required.
+DSH integrates pi-ai through the `@deepseek-ai/dsh-llm-pi-ai` adapter, but does not provide an OAuth entry point. `@edge-sky/dsh-oauth-adapter` exposes pi-ai's existing provider login flows through the DSH Authorization Service. Browser links, device codes, text and secret input, method selection, cancellation, and withdrawn prompts all use the same provider-neutral transport.
 
-## Local package and installation verification
+The profile patch mounts an authorization fallback when the host does not provide `ctx.authorization`.
 
-`npm pack` and `npm publish` from the package directory run type checking, a fresh build, and tests through `prepack`; a failure stops packaging. Do not bypass this check with `--ignore-scripts`. Published versions cannot be overwritten, so a fixed release needs a new version number.
+DSH owns OAuth credentials and login state. This adapter stores model configuration in `dsh-oauth-adapter.modelStore`; see [model migration and recovery](docs/oauth-models.md).
 
-A temporary `DSH_HOME` lets you test a local tarball without affecting existing accounts or profiles or changing DSH code:
-
-```sh
-pnpm install --frozen-lockfile
-artifact_dir=$(mktemp -d)
-npm pack --pack-destination "$artifact_dir"
-export DSH_HOME=$(mktemp -d)
-mkdir -p "$DSH_HOME/profiles/web"
-cat > "$DSH_HOME/profiles/web/pnpm-workspace.yaml" <<'YAML'
-packages:
-  - .
-nodeLinker: hoisted
-autoInstallPeers: false
-allowBuilds:
-  '@google/genai': false
-  protobufjs: false
-YAML
-npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add "$artifact_dir"/*.tgz
-npx @deepseek-ai/dsh@0.1.2-rc.1 web --no-open
-```
+If this plugins is has helped you, please give a star for me, or create issues if you have any suggestion~
 
-After stopping the server, run `unset DSH_HOME` to restore the default directory. The test profile explicitly skips installation scripts for these two dependencies; the plugin repository's policy does not propagate to consumers. New users still need to configure this policy in their own profiles. Successful startup verifies plugin loading; real-account login, model discovery, and inference need separate verification.

package/README.zh.md

@@ -1,85 +1,61 @@
 # dsh-oauth-adapter
 
+[![npm version](https://img.shields.io/npm/v/@edge-sky/dsh-oauth-adapter)](https://www.npmjs.com/package/@edge-sky/dsh-oauth-adapter)
+[![npm downloads](https://img.shields.io/npm/dm/@edge-sky/dsh-oauth-adapter)](https://www.npmjs.com/package/@edge-sky/dsh-oauth-adapter)
+[![license](https://img.shields.io/npm/l/@edge-sky/dsh-oauth-adapter)](https://www.npmjs.com/package/@edge-sky/dsh-oauth-adapter)
+
 [English](README.md) | 中文
 
-为 DSH Web profile 提供 OAuth 登录和账号模型管理。验证基线为 DSH `0.1.2-rc.1`，插件精确依赖 pi-ai `0.84.4`。同步模型不会安装或升级依赖。
+为 DSH Web profile 提供独立的 OAuth 账户页面。当前支持：
+
+| 提供商 | pi-ai 登录路径 |
+| --- | --- |
+| OpenAI Codex | 浏览器回调或设备码 |
+| GitHub Copilot | GitHub 或 GitHub Enterprise 设备码 |
+| Anthropic | 浏览器回调，并支持手工粘贴授权码/重定向地址 |
+| Kimi For Coding | 设备码 |
+| OpenRouter | 浏览器 PKCE 回调 |
+| xAI | 设备码 |
+
+当前源码面向 DSH `0.2.0-rc.2`。发布声明 DSH 0.2 peer 依赖范围的适配器版本后，请安装该版本。较早的 DSH 版本需使用对应的适配器旧版本。
 
 ## 安装
 
+对于 DSH `0.2.0-rc.2`：
+
 ```sh
 dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
-dsh web
 ```
 
-在 **设置 → OAuth 账户** 连接或重新连接账号。授权成功后自动同步模型。授权和同步分别报告结果：发现失败不会撤销成功的登录。
-
-在 **设置 → 模型** 的 **OAuth 模型** 区域同步已连接账号、补充待配置模型，以及添加、编辑或删除手动模型。该区域使用公开的 `settings.models.footer` 插槽，不增加独立模型设置页面。
-
-| 供应商 | 模型协议 |
-| --- | --- |
-| GitHub Copilot | 每个模型选择 Chat Completions、Responses 或 Anthropic Messages |
-| OpenRouter | 每个模型选择 Chat Completions 或 Anthropic Messages |
-| OpenAI Codex | Codex Responses |
-| xAI | OpenAI Responses |
-| Anthropic、Kimi Coding | Anthropic Messages |
+或使用于官方桌面端 `@edge-sky/dsh-oauth-adapter`
 
-模型 ID 必填，显示名称留空时使用 ID。固定协议供应商不显示协议选择器，后端也拒绝协议覆盖。未知模型采用供应商配置的默认容量、文本输入，不根据名称推断思考能力。保存后可尝试发送请求，但不代表已验证模型存在、账号可调用或全部模型能力。
 
-## 同步行为
+对于 DSH `0.1.2-rc.1` 至 `0.1.5-rc.1`，请使用适配器 `0.1.3` 系列；对于 DSH `0.1.1-rc.2`，请使用 `@edge-sky/dsh-oauth-adapter@0.1.2-rc.0`。
 
-发现使用各供应商的认证端点，包括 Copilot 经 OAuth 解析的 API 主机、Codex 账号请求头、Anthropic 游标分页及 OpenRouter 账号过滤列表的偏移分页。不会使用 OpenRouter 公开总目录代替账号列表。端点不支持或 OAuth 权限不足时明确报错，仍可手动配置。端点和依据见[迁移与运行说明](docs/oauth-models.zh.md)。
+启动 DSH：
 
-只有同一供应商内精确匹配的 ID 才继承 pi-ai 的完整模型描述。不通过显示名称或未经证实的别名推断调用协议。未知 ID 保持为**待配置**。成功同步使用完整远端结果替换自动项，包括真正的空列表；手动项始终保留，同 ID 合并，用户明确填写的字段优先。失败保留最近成功结果。首次成功发现前，保留原配置或内置列表并标明未经验证。重新连接至不同或无法识别的账号时，先清除旧账号的自动结果，再进行发现。
+```sh
+npx @deepseek-ai/dsh web
+```
 
-插件使用 `oauth-models` 保存版本、迁移备份、远端 ID 缓存和手动项。凭据始终通过 DSH credentials 服务保存在 `llm-pi-ai/<provider>`。公开 pi-ai 认证能力负责 token 刷新，token 不进入模型设置或浏览器消息。后续升级插件依赖时，已保存的远端 ID 会与新加载的目录重新匹配。
+<img width="2940" height="1766" alt="image" src="https://github.com/user-attachments/assets/7f1dc846-9cea-468c-8a1e-27f4fa34a4fe" />
 
-既有供应商 ID 和会话引用保持不变。旧插件生成的简单配置自动迁移；自定义配置需要在模型页预览确认。API-key 引用、组合基础层配置和其他适配器占用的路由不会被覆盖。升级自定义安装前请阅读[迁移与恢复](docs/oauth-models.zh.md#迁移与恢复)。
 
-## 配置
+<img width="2270" height="1524" alt="image" src="https://github.com/user-attachments/assets/8007002a-a036-4cf4-b015-d4e50eff25d9" />
 
-Host 插件接受以下可选配置：
 
-| 字段 | 默认值 | 含义 |
-| --- | --- | --- |
-| `debug` | `false` | 连接生命周期诊断 |
-| `modelSyncTimeoutMs` | `30000` | 模型发现及旧路由释放的超时 |
-| `modelSyncMaxResponseBytes` | `4194304` | 每页远端响应的最大字节数 |
-| `modelSyncMaxPages` | `100` | 一次同步的最大页数 |
-| `codexClientVersion` | `0.149.0` | Codex 发现端点所接收的客户端版本 |
+对于内置 pi-ai 未写明支持的模型，支持手动添加（可用性需自行验证）
 
-## 开发与验证
+<img width="778" height="723" alt="PixPin_2026-09-10_11-02-42" src="https://github.com/user-attachments/assets/e6b10f86-591d-4801-a758-c8b56c83a18d" />
 
-```sh
-pnpm install
-pnpm run typecheck
-pnpm test
-```
 
-测试覆盖供应商响应、匹配、失败保留、revision 冲突、迁移恢复、取消、经过网络拦截的真实 rc 适配器请求，以及 DOM 环境中加载已发布 rc 模型页产物的可重放快照。WebSocket 测试需要绑定回环端口。测试凭据全部为合成数据，这些验证不代表任何供应商的真实账号发现或推理调用已经通过。无需修改 DSH 源码。
 
-## 本地打包与安装验证
+## 工作原理
 
-`npm pack` 和从目录执行的 `npm publish` 通过 `prepack` 运行类型检查、重新构建和测试；任何一步失败都会终止打包。不要使用 `--ignore-scripts` 跳过该检查。已发布版本不能覆盖，修复后发布必须使用新版本号。
+DSH 通过 `@deepseek-ai/dsh-llm-pi-ai` 适配器接入 pi-ai，但并没有提供 OAuth 的入口。`@edge-sky/dsh-oauth-adapter` 通过 DSH Authorization Service 暴露 pi-ai 已有的 provider 登录流程。浏览器链接、设备码、文本与密码输入、登录方式选择、取消和撤回提示均通过同一套 provider-neutral 传输完成。
 
-使用临时 `DSH_HOME` 可以测试本地 tarball，不影响现有账号与 profile，也不需要修改 DSH 代码：
+当宿主未提供 `ctx.authorization` 时，profile patch 会挂载授权服务后备实现。
 
-```sh
-pnpm install --frozen-lockfile
-artifact_dir=$(mktemp -d)
-npm pack --pack-destination "$artifact_dir"
-export DSH_HOME=$(mktemp -d)
-mkdir -p "$DSH_HOME/profiles/web"
-cat > "$DSH_HOME/profiles/web/pnpm-workspace.yaml" <<'YAML'
-packages:
-  - .
-nodeLinker: hoisted
-autoInstallPeers: false
-allowBuilds:
-  '@google/genai': false
-  protobufjs: false
-YAML
-npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add "$artifact_dir"/*.tgz
-npx @deepseek-ai/dsh@0.1.2-rc.1 web --no-open
-```
+OAuth 凭据和登录状态由 DSH 管理。适配器将模型配置保存在 `dsh-oauth-adapter.modelStore`；参见[模型迁移与恢复](docs/oauth-models.zh.md)。
 
-停止服务器后执行 `unset DSH_HOME` 恢复默认目录。测试 profile 的脚本策略显式跳过这两个依赖的安装脚本；插件仓库的策略不会传播到消费端。新用户仍需在自己的 profile 中配置该策略。启动成功只验证插件加载；真实账号登录、模型发现和推理需要单独验证。
+如果这个插件帮到了你，还请留下你的小星星，如果有任何建议，欢迎 issues~