@hzxwonder/dsh-mcp 0.3.0 → 0.5.0

package/src/setup.js

@@ -1,15 +1,14 @@
 import { constants } from 'node:fs';
 import { chmod, lstat, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { parseArgs, parseEnv } from 'node:util';
-import { createInterface } from 'node:readline';
-import { Writable } from 'node:stream';
+import { isDeepStrictEqual, parseArgs, parseEnv } from 'node:util';
 import { randomUUID } from 'node:crypto';
 import { parse } from 'smol-toml';
-import { DEFAULT_BASE_URL, normalizeBaseUrl, parseProviderSettings } from './provider.js';
-import { createSetupForm, openSetupBrowser } from './setup-ui.js';
+import { parseProviderSettings, resolveProviderSettings } from './provider.js';
+import { runTerminalSetup } from './setup-terminal.js';
+import { inspectRegistration } from './doctor.js';
 
 const packageRoot = fileURLToPath(new URL('../', import.meta.url));
 const defaultHome = join(homedir(), '.dsh-mcp');
@@ -39,10 +38,13 @@ function managedBlock(text, begin, end, body) {
     throw new Error(`Repair the incomplete or duplicate managed block: ${begin}`);
   }
   const block = `${begin}\n${body.trimEnd()}\n${end}\n`;
-  if (!starts.length) return text + (text && !text.endsWith('\n') ? '\n' : '') + (text ? '\n' : '') + block;
+  if (!starts.length) {
+    return { text: text + (text && !text.endsWith('\n') ? '\n' : '') + (text ? '\n' : '') + block, previous: null };
+  }
+  const previous = text.slice(starts[0].index + starts[0][0].length, ends[0].index);
   let after = ends[0].index + ends[0][0].length;
   if (text[after] === '\n') after++;
-  return text.slice(0, starts[0].index) + block + text.slice(after);
+  return { text: text.slice(0, starts[0].index) + block + text.slice(after), previous };
 }
 
 function parseConfig(text) {
@@ -50,6 +52,51 @@ function parseConfig(text) {
   catch { throw new Error('Codex config.toml is not valid TOML. Repair this file before setup.'); }
 }
 
+function updateCredential(text, requestedKey) {
+  const before = parseEnv(text);
+  const key = (requestedKey ?? before.DEEPSEEK_API_KEY)?.trim();
+  if (!key || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(key)) {
+    throw new Error('API Key 必须是非空的单行文本。');
+  }
+  if (before.DEEPSEEK_API_KEY === key) return text;
+  if (/[\r\n]/.test(before.DEEPSEEK_API_KEY ?? '')) {
+    throw new Error('旧凭据格式无法安全更新。请先备份私有 .env 文件，现有内容未改变。');
+  }
+  let replaced = false;
+  let next = text.replace(/^[\uFEFF \t]*(?:export[ \t]+)?DEEPSEEK_API_KEY[ \t]*=.*(?:\r?\n|$)/gm, () => {
+    if (replaced) return '';
+    replaced = true;
+    return `DEEPSEEK_API_KEY=${JSON.stringify(key)}\n`;
+  });
+  if (!replaced) next += `${next && !next.endsWith('\n') ? '\n' : ''}DEEPSEEK_API_KEY=${JSON.stringify(key)}\n`;
+  if (!isDeepStrictEqual({ ...parseEnv(next) }, { ...before, DEEPSEEK_API_KEY: key })) {
+    throw new Error('无法在保留其他凭据配置的同时安全更新 API Key，现有内容未改变。');
+  }
+  return next;
+}
+
+async function matchesPreviousBundledSkill(server, skillText) {
+  const script = server?.args?.[0];
+  if (typeof script !== 'string' || !isAbsolute(script)) return false;
+  const previousRoot = dirname(dirname(script));
+  if (script !== join(previousRoot, 'src', 'server.js')) return false;
+  try {
+    const [currentPackage, previousPackage, previousSkill, scriptInfo] = await Promise.all([
+      readExisting(join(packageRoot, 'package.json')),
+      readExisting(join(previousRoot, 'package.json')),
+      readExisting(join(previousRoot, '.agents', 'skills', 'deepseek-worker', 'SKILL.md')),
+      inspect(script),
+    ]);
+    const name = JSON.parse(currentPackage.text).name;
+    return typeof name === 'string' && name.length > 0
+      && JSON.parse(previousPackage.text).name === name
+      && scriptInfo?.isFile() === true
+      && previousSkill.mode !== null && previousSkill.text === skillText;
+  } catch {
+    return false;
+  }
+}
+
 async function atomicWrite(path, text, mode) {
   const temp = join(dirname(path), `.dsh-mcp-${randomUUID()}.tmp`);
   try {
@@ -64,7 +111,7 @@ export async function installCodex({
   home = defaultHome,
   codexHome = process.env.CODEX_HOME || join(homedir(), '.codex'),
   skillsHome = join(homedir(), '.agents', 'skills'),
-  apiKey, baseUrl,
+  apiKey, baseUrl, protocol, model,
 }) {
   if (process.platform === 'win32') throw new Error('Setup requires macOS or Linux.');
   home = resolve(home);
@@ -82,30 +129,34 @@ export async function installCodex({
     readFile(join(packageRoot, '.agents', 'skills', 'deepseek-worker', 'SKILL.md'), 'utf8'),
   ]);
   const parsed = parseConfig(config.text);
-  if (parsed.mcp_servers?.dsh && !/^# BEGIN dsh-mcp\r?$/m.test(config.text)) {
-    throw new Error('Codex already defines mcp_servers.dsh. Preserve or rename that server before setup.');
-  }
-  if (skill.mode !== null && skill.text !== bundledSkill) {
-    throw new Error('A different deepseek-worker skill already exists. Preserve or rename that skill before setup.');
-  }
   const args = [join(packageRoot, 'src', 'server.js'), '--dsh-home', home];
   const entry = [
     '[mcp_servers.dsh]', `command = ${JSON.stringify(process.execPath)}`, `args = ${JSON.stringify(args)}`,
+    'enabled = true',
     'startup_timeout_sec = 20', 'tool_timeout_sec = 960',
   ].join('\n');
-  const nextConfig = managedBlock(config.text, '# BEGIN dsh-mcp', '# END dsh-mcp', entry);
+  const { text: nextConfig, previous } = managedBlock(config.text, '# BEGIN dsh-mcp', '# END dsh-mcp', entry);
+  const previousServer = previous === null ? undefined : parseConfig(previous).mcp_servers?.dsh;
+  const ownsServer = parsed.mcp_servers?.dsh && previousServer
+    && isDeepStrictEqual(parsed.mcp_servers.dsh, previousServer);
+  if (parsed.mcp_servers?.dsh && !ownsServer) {
+    throw new Error('Codex already defines mcp_servers.dsh outside this installer’s managed block. Preserve or rename that server before setup.');
+  }
+  if (skill.mode !== null && skill.text !== bundledSkill
+    && !(ownsServer && await matchesPreviousBundledSkill(previousServer, skill.text))) {
+    throw new Error('A different deepseek-worker skill already exists and cannot be safely upgraded. Back up or rename that skill before setup; existing files were not changed.');
+  }
   parseConfig(nextConfig);
-  const existingKey = parseEnv(credentials.text).DEEPSEEK_API_KEY;
   const providerSettings = parseProviderSettings(provider.text);
-  const providerUrl = normalizeBaseUrl(baseUrl ?? providerSettings.baseUrl ?? DEFAULT_BASE_URL);
-  const nextProvider = JSON.stringify({ ...providerSettings, baseUrl: providerUrl }, null, 2) + '\n';
-  let nextCredentials = credentials.text;
-  if (!existingKey) {
-    const key = apiKey?.trim();
-    if (!key || /[\r\n\0]/.test(key)) throw new Error('Provide one nonempty DeepSeek API key without line breaks.');
-    nextCredentials += `${nextCredentials && !nextCredentials.endsWith('\n') ? '\n' : ''}DEEPSEEK_API_KEY=${JSON.stringify(key)}\n`;
-    if (parseEnv(nextCredentials).DEEPSEEK_API_KEY !== key) throw new Error('The API key cannot be stored as a dotenv value.');
-  }
+  const previousProvider = resolveProviderSettings(providerSettings, { legacy: !providerSettings.protocol && typeof providerSettings.baseUrl === 'string' });
+  const selected = resolveProviderSettings({
+    ...previousProvider,
+    ...(protocol === undefined ? {} : { protocol }),
+    ...(baseUrl === undefined ? {} : { baseUrl }),
+    ...(model === undefined ? {} : { model }),
+  });
+  const nextProvider = JSON.stringify({ ...providerSettings, ...selected }, null, 2) + '\n';
+  const nextCredentials = updateCredential(credentials.text, apiKey);
 
   // Check all user-file conflicts before creating credentials or Codex files.
   for (const directory of directories) await mkdir(directory, { recursive: true, mode: 0o700 });
@@ -115,78 +166,56 @@ export async function installCodex({
   if (nextProvider !== provider.text) await atomicWrite(providerPath, nextProvider, 0o600);
   else await chmod(providerPath, 0o600);
   if (nextConfig !== config.text) await atomicWrite(configPath, nextConfig, config.mode ?? 0o644);
-  if (skill.mode === null) await atomicWrite(skillPath, bundledSkill, 0o644);
+  if (skill.text !== bundledSkill || skill.mode === null) await atomicWrite(skillPath, bundledSkill, skill.mode ?? 0o644);
   return { home, configPath, skillPath };
 }
 
-function question(prompt, hidden = false) {
-  if (!process.stdin.isTTY) throw new Error('Use a terminal for prompts, or supply DEEPSEEK_API_KEY in the environment.');
-  const output = hidden ? new Writable({ write(_chunk, _encoding, callback) { callback(); } }) : process.stdout;
-  const input = createInterface({ input: process.stdin, output, terminal: true, historySize: 0 });
-  if (hidden) process.stdout.write(prompt);
-  return new Promise((accept, reject) => {
-    input.once('SIGINT', () => { input.close(); reject(new Error('Setup cancelled.')); });
-    input.once('close', () => reject(new Error('Setup input closed.')));
-    input.question(hidden ? '' : prompt, (answer) => {
-      accept(answer);
-      input.close();
-      if (hidden) process.stdout.write('\n');
-    });
-  });
-}
-
 export async function runSetup() {
   const { values } = parseArgs({ options: {
     home: { type: 'string', default: defaultHome },
-    terminal: { type: 'boolean', default: false },
     help: { type: 'boolean', default: false },
   } });
   if (values.help) {
-    console.log('Usage: dsh-mcp setup [--home /private/dsh-home] [--terminal]');
-    console.log('Setup opens a local form for API Key and Base URL.');
-    console.log('Use --terminal for terminal prompts. Secrets never enter command arguments.');
-    console.log('Setup installs user-wide Codex MCP settings and a skill. Codex supplies each project path at call time.');
+    console.log('用法: dsh-mcp setup [--home /private/dsh-home]');
+    console.log('纯终端配置：协议 → Base URL → API Key → 探测并选择模型。');
+    console.log('再次运行可逐项修改现有配置；连接测试通过后才保存并注册 MCP。');
+    console.log('诊断 Codex 注册和工具握手: dsh-mcp doctor');
     return;
   }
+  if (!process.stdin.isTTY) throw new Error('配置向导需要交互式终端。请在终端运行 dsh-mcp setup。');
   const home = resolve(values.home);
   await checkDirectory(home);
   const credentials = await readExisting(join(home, '.env'));
-  const provider = parseProviderSettings((await readExisting(join(home, 'settings.json'))).text);
-  const stored = parseEnv(credentials.text);
-  let apiKey = process.env.DEEPSEEK_API_KEY;
-  let baseUrl = process.env.DEEPSEEK_BASE_URL ?? provider.baseUrl ?? DEFAULT_BASE_URL;
-  let result;
-  if (values.terminal) {
-    if (!stored.DEEPSEEK_API_KEY && !apiKey) apiKey = await question('DeepSeek API key (hidden): ', true);
-    if (process.stdin.isTTY && !process.env.DEEPSEEK_BASE_URL) {
-      baseUrl = (await question(`Base URL [${baseUrl}]: `)).trim() || baseUrl;
-    }
-    result = await installCodex({ home, apiKey, baseUrl });
-  } else {
-    const form = await createSetupForm({
-      baseUrl, hasSavedKey: Boolean(stored.DEEPSEEK_API_KEY || apiKey),
-      onSubmit: (input) => installCodex({ home, apiKey: apiKey || input.apiKey, baseUrl: input.baseUrl }),
-    });
-    const cancel = () => form.close();
-    process.once('SIGINT', cancel);
-    process.once('SIGTERM', cancel);
-    try {
-      console.log(`Setup form: ${form.url}`);
-      if (!await openSetupBrowser(form.url)) console.log('Open the local URL in your browser to continue.');
-      result = await form.completed;
-    } finally {
-      process.removeListener('SIGINT', cancel);
-      process.removeListener('SIGTERM', cancel);
-    }
+  const saved = await readExisting(join(home, 'settings.json'));
+  const rawSettings = parseProviderSettings(saved.text);
+  const existing = saved.mode !== null || Boolean(parseEnv(credentials.text).DEEPSEEK_API_KEY);
+  const initial = existing ? rawSettings : {
+    ...(process.env.DSH_MCP_PROTOCOL ? { protocol: process.env.DSH_MCP_PROTOCOL } : {}),
+    ...(process.env.DEEPSEEK_BASE_URL ? { baseUrl: process.env.DEEPSEEK_BASE_URL } : {}),
+    ...(process.env.DSH_MCP_MODEL ? { model: process.env.DSH_MCP_MODEL } : {}),
+  };
+  const settings = resolveProviderSettings(initial, { legacy: existing && !rawSettings.protocol && typeof rawSettings.baseUrl === 'string' });
+  const apiKey = parseEnv(credentials.text).DEEPSEEK_API_KEY || process.env.DEEPSEEK_API_KEY || '';
+  const chosen = await runTerminalSetup({ settings, apiKey, existing });
+  const result = await installCodex({ home, ...chosen.settings, apiKey: chosen.apiKey });
+  console.log(`Codex 配置: ${result.configPath}`);
+  console.log(`用户 skill: ${result.skillPath}`);
+  console.log(`私有 API Key 文件: ${join(result.home, '.env')}`);
+  console.log(`私有服务配置: ${join(result.home, 'settings.json')}`);
+  console.log('正在检查 MCP 注册和工具握手...');
+  const health = await inspectRegistration({ configPath: result.configPath });
+  if (!health.ok) {
+    console.error('API 连接通过，配置也已保存，但 MCP 加载检查失败。');
+    for (const hint of health.hints ?? []) console.error(hint);
+    if (health.error) console.error(health.error);
+    throw new Error('请运行 dsh-mcp doctor 查看注册路径和启动状态；不能据此认为 Codex 已显示该工具。');
   }
-  console.log(`MCP configuration: ${result.configPath}`);
-  console.log(`Skill: ${result.skillPath}`);
-  console.log(`Private API key file: ${join(result.home, '.env')}`);
-  console.log(`Private provider settings: ${join(result.home, 'settings.json')}`);
-  console.log('Start a new Codex session. Codex supplies the active project_root with every delegated task.');
-  console.log('Use normal task prompts. Codex can select eligible DeepSeek tasks without an explicit tool request.');
+  console.log(`MCP 握手成功，工具: ${health.tools.join(', ')}`);
+  console.log('如果已打开的 Codex 仍未显示，请完整退出并重新打开 Codex Desktop，而不只是新开标签。');
+  console.log('确认 Codex 与安装器使用同一主机、用户和 CODEX_HOME。Auth unsupported 对本地 stdio 是正常状态。');
 }
 
+
 if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
   runSetup().catch((error) => { console.error(`Setup failed: ${error.message}`); process.exitCode = 1; });
 }

package/src/worker.js

@@ -2,9 +2,12 @@ import { spawn, execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
 import { createReadStream } from 'node:fs';
-import { lstat, readlink, realpath, stat } from 'node:fs/promises';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { lstat, mkdtemp, readlink, realpath, rm, stat, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { readSessionOutput } from './session-output.js';
+import { buildProviderRuntime } from './provider.js';
 
 const exec = promisify(execFile);
 const dsh = fileURLToPath(new URL('./lib/bin.js', import.meta.resolve('@deepseek-ai/dsh/package.json')));
@@ -69,6 +72,7 @@ export function parseRun(stdout, exitCode) {
   let sessionId = null;
   let final = null;
   let error = null;
+  let turn = null;
   for (const line of stdout.split('\n')) {
     if (!line.trim()) continue;
     let event;
@@ -76,12 +80,13 @@ export function parseRun(stdout, exitCode) {
     catch { throw new Error('Invalid DSH NDJSON output; check the pinned Harness version'); }
     if (event?.type === 'session') sessionId = event.sessionId;
     if (event?.type === 'error') error = event;
+    if (event?.type === 'status' && event.phase === 'turn_start') turn = event.turn;
     if (event?.type === 'final') final = event;
   }
   return {
     status: exitCode === 0 && final?.reason?.kind === 'completed' ? 'completed' : 'failed',
     session_id: final?.sessionId ?? sessionId,
-    answer: typeof final?.text === 'string' ? final.text : '',
+    turn,
     reason: final?.reason ?? error ?? null,
   };
 }
@@ -119,13 +124,18 @@ async function gitSnapshot(cwd) {
   return { root, files };
 }
 
-export function createWorker({ home, command = [process.execPath, dsh] }) {
+export function createWorker({ home, command = [process.execPath, dsh], readSession = readSessionOutput, providerRuntime = buildProviderRuntime({}, process.env.DEEPSEEK_API_KEY) }) {
+  const allowedEfforts = new Set(providerRuntime.thinkingEfforts);
+  const secret = providerRuntime.env.DEEPSEEK_API_KEY;
+  const redact = (value) => typeof value === 'string' && secret ? value.replaceAll(secret, '[REDACTED]') : value;
+  const redactObject = (value) => JSON.parse(JSON.stringify(value, (_name, item) => redact(item)));
   let busy = false;
   return {
-    async delegate({ project_root, task, cwd = '.', permission_mode = 'read-only', session_id, timeout_seconds = 300 }, { signal } = {}) {
+    async delegate({ project_root, task, thinking_effort, cwd = '.', permission_mode = 'read-only', session_id, timeout_seconds = 300 }, { signal } = {}) {
       if (busy) throw new Error('DeepSeek worker is busy; serialize tasks across all projects');
       busy = true;
       let before;
+      let pluginDirectory;
       try {
         if (typeof project_root !== 'string' || !isAbsolute(project_root)) {
           throw new Error('project_root must be an absolute directory path');
@@ -138,8 +148,23 @@ export function createWorker({ home, command = [process.execPath, dsh] }) {
           throw new Error('cwd is outside project_root');
         }
         if (!(await stat(directory)).isDirectory()) throw new Error('cwd must be a directory');
+        if (!allowedEfforts.has(thinking_effort)) {
+          throw new Error(`thinking_effort is required and must be one of: ${providerRuntime.thinkingEfforts.join(', ')} for the selected model`);
+        }
         before = await gitSnapshot(directory);
-        const args = ['headless', '--patch', patch, '--json', '--permission-mode', permission_mode, '--approval-policy', 'never'];
+        const args = ['headless', '--patch', patch];
+        const plugin = providerRuntime.env.DSH_MCP_PI_PLUGIN;
+        if (plugin && plugin !== '@deepseek-ai/dsh-llm-pi-ai') {
+          pluginDirectory = await mkdtemp(join(tmpdir(), 'dsh-mcp-plugin-'));
+          const pluginPatch = join(pluginDirectory, 'provider.json');
+          // Cordis permits expressions in config, but plugin identities must be literal names.
+          await writeFile(pluginPatch, JSON.stringify([
+            { id: 'llm-pi-ai', disabled: true },
+            { insert: [{ id: 'dsh-mcp-off-only', name: plugin }] },
+          ]), { mode: 0o600 });
+          args.push('--patch', pluginPatch);
+        }
+        args.push('--json', '--permission-mode', permission_mode, '--approval-policy', 'never');
         if (session_id) args.push('--session-id', session_id);
         args.push('-');
         const prompt = [
@@ -154,12 +179,30 @@ export function createWorker({ home, command = [process.execPath, dsh] }) {
         ].join('\n');
         const result = await runProcess([...command, ...args], {
           cwd: directory,
-          env: { ...process.env, DSH_HOME: home, DSH_PERMISSION_MODE: permission_mode },
+          env: { ...process.env, ...providerRuntime.env, DSH_HOME: home, DSH_PERMISSION_MODE: permission_mode, DSH_MCP_THINKING_EFFORT: thinking_effort },
           input: prompt, timeoutMs: timeout_seconds * 1000, signal,
         });
+        if (pluginDirectory) {
+          await rm(pluginDirectory, { recursive: true, force: true });
+          pluginDirectory = undefined;
+        }
         let run;
         try { run = parseRun(result.stdout, result.exit_code); }
-        catch (error) { run = { status: 'failed', session_id: null, answer: '', reason: error.message }; }
+        catch (error) { run = { status: 'failed', session_id: null, turn: null, reason: error.message }; }
+        let output = null;
+        let sessionOutputError = null;
+        try {
+          if (!run.session_id) throw new Error('The run returned no session ID for its persisted output');
+          const persisted = await readSession({ home, sessionId: run.session_id, cwd: directory });
+          if (run.turn === null || persisted.turn !== run.turn) {
+            throw new Error('The persisted latest turn does not match this run; no current answer is available');
+          }
+          output = persisted;
+          if (run.status === 'completed' && output.terminal_reason?.kind !== 'completed') {
+            sessionOutputError = 'The session turn did not complete durably';
+          }
+        } catch (error) { sessionOutputError = error.message; }
+        if (sessionOutputError && run.status === 'completed') run.status = 'failed';
         let changedFiles = null;
         let changeWarning = before ? null : 'Not a Git repository; changed_files is unavailable.';
         try {
@@ -171,13 +214,24 @@ export function createWorker({ home, command = [process.execPath, dsh] }) {
         } catch (error) { changeWarning = `Cannot inspect changes: ${error.message}`; }
         return {
           ...run,
+          reason: run.reason == null ? run.reason : redactObject(run.reason),
           status: result.failure ?? run.status,
-          project_root: root, cwd: directory, model: 'deepseek-flash', permission_mode,
+          answer: output?.text ?? '',
+          output_source: output ? 'session' : null,
+          session_file: output?.session_file ?? null,
+          assistant_seq: output?.assistant_seq ?? null,
+          terminal_reason: output?.terminal_reason == null ? null : redactObject(output.terminal_reason),
+          session_output_error: redact(sessionOutputError),
+          thinking_effort,
+          project_root: root, cwd: directory, model: providerRuntime.model, protocol: providerRuntime.protocol, permission_mode,
           exit_code: result.exit_code, signal: result.signal,
           changed_files: changedFiles, git_root: before?.root ?? null,
-          change_warning: changeWarning, diagnostics: result.stderr,
+          change_warning: redact(changeWarning), diagnostics: redact(result.stderr),
         };
-      } finally { busy = false; }
+      } finally {
+        try { if (pluginDirectory) await rm(pluginDirectory, { recursive: true, force: true }); }
+        finally { busy = false; }
+      }
     },
   };
 }

package/src/setup-ui.js

@@ -1,112 +0,0 @@
-import { createServer } from 'node:http';
-import { randomBytes } from 'node:crypto';
-import { spawn } from 'node:child_process';
-
-const escape = (value) => String(value).replace(/[&<>"']/g, (character) => ({
-  '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-})[character]);
-
-function page({ baseUrl, hasSavedKey, csrf, error = '', saved = false }) {
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>DeepSeek MCP settings</title><style>
-body{font:16px/1.5 system-ui,sans-serif;background:#f4f6f8;color:#17212b;margin:0;padding:48px 20px}
-main{max-width:540px;margin:auto;background:white;padding:32px;border:1px solid #d9e0e7;border-radius:12px}
-h1{font-size:24px;margin-top:0}label{display:block;font-weight:600;margin-top:24px}
-input{box-sizing:border-box;width:100%;font:inherit;padding:10px;border:1px solid #9aa9b8;border-radius:6px;margin-top:6px}
-small{display:block;color:#4e6071;margin-top:6px}code{overflow-wrap:anywhere}button{font:inherit;background:#165bc4;color:white;border:0;padding:11px 18px;border-radius:6px;margin-top:28px;cursor:pointer}
-.error{color:#a21818}.scope{background:#f1f4f7;padding:12px;border-radius:6px}
-</style></head><body><main><h1>DeepSeek MCP settings</h1>
-${saved ? '<p>Settings saved. You can close this tab.</p><p>Start a new Codex session in any project.</p>' : `
-<p>These settings apply to the local DeepSeek Harness worker.</p>
-<p class="scope">Codex supplies the project directory for each task. Setup does not bind this server to a project.</p>
-${error ? `<p class="error" role="alert">${escape(error)}</p>` : ''}
-<form method="post" autocomplete="off">
-<input type="hidden" name="csrf" value="${csrf}">
-<label for="apiKey">API Key</label><input id="apiKey" name="apiKey" type="password" autocomplete="new-password" ${hasSavedKey ? 'disabled placeholder="An existing key will be used"' : 'required'}>
-<small>The key stays in your private settings file. Setup keeps an existing key unchanged.</small>
-<label for="baseUrl">Base URL (optional)</label><input id="baseUrl" name="baseUrl" type="url" value="${escape(baseUrl)}">
-<small>Use a Messages API root. Leave empty to use https://api.deepseek.com/anthropic.</small>
-<small>A custom endpoint receives your API key and task data.</small>
-<button type="submit">Save and configure Codex</button></form>`}
-</main></body></html>`;
-}
-
-export async function createSetupForm({ baseUrl, hasSavedKey = false, onSubmit }) {
-  const path = `/${randomBytes(32).toString('hex')}`;
-  const csrf = randomBytes(32).toString('hex');
-  let origin;
-  let submitting = false;
-  let closing = false;
-  let timer;
-  let accept;
-  let reject;
-  const completed = new Promise((resolve, fail) => { accept = resolve; reject = fail; });
-  const server = createServer(async (request, response) => {
-    response.setHeader('Cache-Control', 'no-store');
-    response.setHeader('Referrer-Policy', 'no-referrer');
-    response.setHeader('X-Content-Type-Options', 'nosniff');
-    response.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'");
-    if (request.headers.host !== new URL(origin).host || request.url !== path) {
-      response.writeHead(404).end('Not found.');
-      return;
-    }
-    const render = (options, status = 200) => {
-      response.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(page({ baseUrl, hasSavedKey, csrf, ...options }));
-    };
-    if (request.method === 'GET') { render({}); return; }
-    if (request.method !== 'POST') { response.writeHead(405).end('Use GET or POST.'); return; }
-    if (request.headers.origin && ![origin, 'null'].includes(request.headers.origin)) {
-      response.writeHead(403).end('Invalid origin.'); return;
-    }
-    if (request.headers['content-type']?.split(';')[0] !== 'application/x-www-form-urlencoded') {
-      response.writeHead(415).end('Use the setup form.'); return;
-    }
-    if (submitting || closing) { response.writeHead(409).end('Setup is already saving.'); return; }
-    try {
-      const chunks = [];
-      let bytes = 0;
-      for await (const chunk of request) {
-        bytes += chunk.length;
-        if (bytes > 16384) { response.writeHead(413).end('Settings are too large.'); return; }
-        chunks.push(chunk);
-      }
-      const fields = new URLSearchParams(Buffer.concat(chunks).toString('utf8'));
-      // A separate form token also protects webviews with a null or missing Origin.
-      if (fields.get('csrf') !== csrf) { response.writeHead(403).end('Invalid form token.'); return; }
-      submitting = true;
-      const result = await onSubmit({ apiKey: fields.get('apiKey')?.trim() || undefined, baseUrl: fields.get('baseUrl') });
-      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(page({ baseUrl, hasSavedKey, saved: true }), () => finish(null, result));
-    } catch (error) {
-      submitting = false;
-      render({ error: error.message }, 400);
-    }
-  });
-  server.requestTimeout = 30000;
-  server.headersTimeout = 10000;
-  await new Promise((resolve, fail) => {
-    server.once('error', fail);
-    server.listen(0, '127.0.0.1', resolve);
-  });
-  origin = `http://127.0.0.1:${server.address().port}`;
-  function finish(error, result) {
-    if (closing) return;
-    closing = true;
-    clearTimeout(timer);
-    server.close(() => error ? reject(error) : accept(result));
-    if (error) server.closeAllConnections();
-    else server.closeIdleConnections();
-  }
-  timer = setTimeout(() => finish(new Error('Setup form expired. Run setup again.')), 600000);
-  return { url: origin + path, completed, close: () => finish(new Error('Setup cancelled.')) };
-}
-
-export function openSetupBrowser(url) {
-  return new Promise((resolve) => {
-    const child = spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [url], { stdio: 'ignore', shell: false });
-    child.once('error', () => resolve(false));
-    child.once('exit', (code) => resolve(code === 0));
-  });
-}