@inventec/dsh-copilot-auth 1.0.2 → 1.1.1

package/README.md

@@ -19,9 +19,10 @@
 - 🔐 **设备码登录/注销**：网页 + user code，免 API Token；SSO 组织授权友好
 - 🧩 **预置提供方路由**：安装即出现在 Models 页，无需手动配置
 - 📦 **模型目录兜底填充**：登录成功时，若 GitHub Copilot 路由还没有模型目录，自动填入账号全部可用模型；你已精简/定制过的目录**永不覆盖**（重启、重新登录均不重置）
+- 🔄 **手动补充新模型目录条目**：GHC 设置页一键刷新——diff 预览 + 二次确认 + 数据级目录补丁（**pi-ai 版本不动**），新模型（如 gemini-3.8-flash）即可加入、失效模型镜像移除
 - 🌐 **中/英双语界面**：跟随 DSH 语言设置自动切换
 - 🔑 **凭据安全托管**：存入 DSH 内置凭据库（文件强制 0600 权限），Copilot 临时 token 到期自动刷新
-- 🧪 **测试与 CI**：15 条单元测试；GitHub Actions 构建测试 + tag 触发自动发布（provenance）
+- 🧪 **测试与 CI**：105 条单元测试；GitHub Actions 构建测试 + tag 触发自动发布（provenance）
 
 ## 前置要求
 
@@ -62,11 +63,22 @@ dsh plugin --profile web add @inventec/dsh-copilot-auth
 - 注销：设置页「注销」按钮（清除本机凭据记录）
 - 卸载：`dsh plugin --profile web remove @inventec/dsh-copilot-auth` 后重启 dsh web
 
+## 模型目录刷新
+
+pi-ai 的模型目录是打包时硬编码的 JSON：上游新增模型（如 gemini-3.8-flash）在本机无法解析、失效模型残留。「刷新可用模型目录」按钮（GHC 设置页，登录后可见）在不升级 pi-ai 的前提下解决这一问题。
+
+- **两阶段生效**：确认后先对本机 `github-copilot.json` 做原子数据级补丁（pi-ai 代码版本不变）；**重启 dsh web 后**插件再把 settings 模型目录镜像重建为「账号可用 ∩ 目录可解析」集合（目录在模块加载时读取，同 boot 内写完目录不会同步 settings）。
+- **diff 预览 + 二次确认**：弹窗展示新增（绿）/移除（红）/保留计数、被校验跳过的上游条目、以及**将被重置的定制名单**（字段微调与 modelOverrides）。确认前请核对三条风险：失效模型将消失、你的定制将被重置、需重启后才生效。
+- **激活边界**：插件首次安装/升级后处于未激活态，启动时不触碰 pi-ai 安装树；只有成功执行过一次手动刷新后才激活。DSH 升级冲掉补丁后，已激活实例启动时自愈重放**历史上实际应用过**的补丁条目（内置覆盖层仅作离线数据源，绝不自动应用）。
+- **数据源与回退**：账号可用模型现场拉取（失败回退凭证缓存）；目录数据从 npm 拉取最新 pi-ai tarball（强制 `dist.integrity` 校验、超时与大小上限、tar 严格解析），失败时可改用内置覆盖层（0.85.1 收割，integrity `sha512-+VgVIJDkDO2efYJKEEqvPTH4zmnIaXdAppGbO+vKFA9qy5PdhFiAenuFAkU+oiCSfOC4dMHDyrjdQeL4ZoC5CQ==`）出 diff。
+- **只增不更新**：合并只补充本机从未见过的模型条目；上游对已有 id 的元数据修正（api 归属、contextWindow 等）不会同步——这是「永不覆盖」语义的代价（ADR 0001）。
+- **digest 绑定**：preview 与 apply 之间以输入 digest（settings 完整配置 / 可用模型 / 本地目录 / 目录来源）绑定，任何漂移即 409 并要求重新预览确认。
+
 ## 工作原理
 
 - 通过 `cordis.patch.yml` 三段生效：
   1. 挂载 `@deepseek-ai/dsh-authorization` 服务（DSH 内置 bundle 未挂载，不挂则内置登录流不存在）
-  2. 注册本插件（host 侧在 webserver 上开 4 条本地路由：`/copilot-auth/start|state|status|logout`，跨站 Origin 拒绝）
+  2. 注册本插件（host 侧在 webserver 上开 6 条本地路由：`/copilot-auth/start|state|status|logout|refresh/preview|refresh/apply`，跨站 Origin 拒绝）
   3. 以 settings base 层预置 `github-copilot` 路由（用户 `settings.yaml` 可逐字段覆盖）
 - 登录走 GitHub 设备码流；凭据存 `~/.dsh/.credentials.yaml`（强制 600 权限）的 `llm-pi-ai/github-copilot` 记录，Copilot 临时 token 到期自动刷新
 - **模型目录兜底填充**：登录成功时，取「账号可用模型 ∩ pi-ai 内置目录」写入该路由的模型目录——仅当该路由尚未配置 `models` 且无 `modelOverrides` 时写入；目录已存在（含空列表）一律让路，插件启动/重启也绝不触碰用户 settings。同步失败经 `/copilot-auth/status` 的 `syncError` 字段暴露
@@ -75,7 +87,7 @@ dsh plugin --profile web add @inventec/dsh-copilot-auth
 
 ```bash
 npm install
-npm test        # node:test：patch 结构 + host 行为共 15 条
+npm test        # node:test：patch 结构 + host/目录/状态机/启动序列共 105 条
 npm run build   # esbuild 打包 client 到 lib/client.js（__ModuleLoader__ 信封）
 npm pack --dry-run
 ```
@@ -83,7 +95,7 @@ npm pack --dry-run
 | 路径 | 职责 |
 |---|---|
 | `cordis.patch.yml` | 三段 patch（authorization 挂载 / 本插件 entry / 预置路由） |
-| `src/host.mjs` · `src/shared.mjs` | host 半区：登录状态机、4 条本地路由、模型目录同步 |
+| `src/host.mjs` · `src/shared.mjs` | host 半区：登录状态机、6 条本地路由、模型目录同步、刷新 preview/apply 与启动序列 |
 | `src/client.jsx` | client 半区：settings.section 插槽 + 设备码交互 + 双语文案 |
 | `scripts/build-client.mjs` | client 打包（`__ModuleLoader__` CJS 工厂信封） |
 | `lib/client.js` | 构建产物（入库，使 git 安装免构建） |
@@ -102,8 +114,10 @@ npm pack --dry-run
 - `settings.yaml` 的 `llm-pi-ai:` 节只能稀疏覆盖字段，无法删除预置路由本身（移除须卸载本插件）
 - 路由前缀 `/copilot-auth` 两侧硬编码，不可配置
 - DSH rc 版本耦合：实测 `0.1.2-rc.1`，peer 仅 `@deepseek-ai/cordis@^4.0.2`
-- 模型目录只在「尚不存在」时由登录成功兜底填充一次，填充后归用户所有：账号新增的模型不会自动出现，需在 Models 页手动添加，或删掉 `settings.yaml` 里该路由的 `models` 列表后**重新登录**重新填充全量（插件启动不触发填充）
-- 模型目录只写入 pi-ai 内置目录已描述的模型：目录快照外的新模型暂不写入（catalog 路由的校验要求模型协议可解析），pi-ai 升级目录后重新登录即可纳入
+- 模型目录只在「尚不存在」时由登录成功兜底填充一次，填充后归用户所有：账号新增的模型不会自动出现——用 GHC 设置页的「**刷新可用模型目录**」同步（见上节），或在 Models 页手动添加
+- 模型目录只写入 pi-ai 内置目录已描述的模型：目录快照外的新模型需先经「刷新可用模型目录」补入目录条目（数据级补丁，pi-ai 版本不变）才会出现在可选列表
+- DSH 升级后自愈仅在 pi-ai 基线版本不变（0.84.4）时重放；跨版本且条目未原生存在时上报 `self-heal-incompatible`，不修改安装树（重新执行一次手动刷新即可在新基线上激活）
+- 并发保护为宿主单进程内 mutex，**不支持多实例/多进程并发刷新**
 
 ## 维护者发布
 

package/lib/client.js

@@ -31,6 +31,122 @@ __export(client_exports, {
 });
 module.exports = __toCommonJS(client_exports);
 var import_react = require("react");
+
+// src/shared.mjs
+var ROUTE_PREFIX = "/copilot-auth";
+var routes = () => ({
+  start: `${ROUTE_PREFIX}/start`,
+  state: `${ROUTE_PREFIX}/state`,
+  status: `${ROUTE_PREFIX}/status`,
+  logout: `${ROUTE_PREFIX}/logout`,
+  refreshPreview: `${ROUTE_PREFIX}/refresh/preview`,
+  refreshApply: `${ROUTE_PREFIX}/refresh/apply`
+});
+
+// src/refresh-flow.mjs
+var initial = Object.freeze({ name: "idle" });
+function reduce(state, event) {
+  switch (state.name) {
+    case "idle":
+    case "failed":
+    case "restartNeeded": {
+      if (event.type === "start") {
+        return [{ name: "previewing", mode: event.mode, stale: false }, { type: "preview", mode: event.mode }];
+      }
+      if (state.name === "failed" && event.type === "dismiss") return [initial, null];
+      if (state.name === "idle" && event.type === "init") return [state, { type: "status" }];
+      if (event.type === "hydrate") {
+        const refresh = event.status?.refresh;
+        if (!event.status) return [state, null];
+        if (refresh?.lastError === "state-corrupt") return [{ name: "failed", error: "state-corrupt" }, null];
+        if (refresh?.pendingRestart === true) return [{ name: "restartNeeded" }, null];
+        return state.name === "idle" ? [state, null] : [state, null];
+      }
+      return [state, null];
+    }
+    case "previewing": {
+      if (event.type === "preview-ok") {
+        return [{ name: "confirming", preview: event.preview, mode: state.mode, staleNotice: state.stale === true }, null];
+      }
+      if (event.type === "preview-fail") return [{ name: "failed", error: event.error }, null];
+      return [state, null];
+    }
+    case "confirming": {
+      if (event.type === "start") {
+        return [{ name: "previewing", mode: event.mode, stale: false }, { type: "preview", mode: event.mode }];
+      }
+      if (event.type === "confirm") {
+        return [
+          { name: "applying", mode: state.mode, digests: state.preview.digests },
+          { type: "apply", mode: state.mode, digests: state.preview.digests }
+        ];
+      }
+      if (event.type === "cancel") return [initial, null];
+      return [state, null];
+    }
+    case "applying": {
+      if (event.type === "apply-ok") return [{ name: "restartNeeded" }, null];
+      if (event.type === "apply-stale") {
+        return [{ name: "previewing", mode: state.mode, stale: true }, { type: "preview", mode: state.mode }];
+      }
+      if (event.type === "apply-fail") return [{ name: "failed", error: event.error }, null];
+      return [state, null];
+    }
+    default:
+      return [state, null];
+  }
+}
+async function runEffect(effect, fetchImpl) {
+  const r = routes();
+  const post = (url, body) => fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (effect.type === "preview") {
+    try {
+      const res = await post(r.refreshPreview, effect.mode ? { mode: effect.mode } : {});
+      const body = await res.json();
+      return res.status === 200 && body?.ok ? { type: "preview-ok", preview: body } : { type: "preview-fail", error: body?.error ?? `HTTP ${res.status}` };
+    } catch (err) {
+      return { type: "preview-fail", error: String(err?.message ?? err) };
+    }
+  }
+  if (effect.type === "apply") {
+    try {
+      const res = await post(r.refreshApply, {
+        digests: effect.digests,
+        ...effect.mode ? { mode: effect.mode } : {}
+      });
+      const body = await res.json().catch(() => null);
+      if (res.status === 409) return { type: "apply-stale" };
+      return res.status === 200 && body?.ok ? { type: "apply-ok" } : { type: "apply-fail", error: body?.error ?? `HTTP ${res.status}` };
+    } catch (err) {
+      return { type: "apply-fail", error: String(err?.message ?? err) };
+    }
+  }
+  if (effect.type === "status") {
+    try {
+      const res = await fetchImpl(r.status);
+      return { type: "hydrate", status: await res.json() };
+    } catch {
+      return { type: "hydrate", status: null };
+    }
+  }
+  throw new Error(`unknown effect: ${effect.type}`);
+}
+async function advance(state, event, fetchImpl, onState) {
+  let [s, fx] = reduce(state, event);
+  onState?.(s);
+  while (fx) {
+    const resultEvent = await runEffect(fx, fetchImpl);
+    [s, fx] = reduce(s, resultEvent);
+    onState?.(s);
+  }
+  return s;
+}
+
+// src/client.jsx
 var import_jsx_runtime = require("react/jsx-runtime");
 var name = "copilot-auth-ui";
 var inject = ["slots", "locale"];
@@ -49,7 +165,34 @@ var DICTS = {
     codeHint: "Open the link below and enter this code to finish signing in:",
     copy: "Copy",
     copied: "Copied \u2713",
-    unknown: "Unknown error"
+    unknown: "Unknown error",
+    refreshNow: "Refresh model catalog",
+    refreshTitle: "Refresh available model catalog",
+    refreshDesc: "This pulls your account's available models and the latest pi-ai catalog data, then applies a data-level, add-only patch to the local catalog (pi-ai version stays unchanged). Review the diff before confirming.",
+    riskRemoved: "Models no longer available to your account will DISAPPEAR from the model list after restart.",
+    riskReset: "Your customizations (trimmed model list, per-model field tweaks, modelOverrides) will be RESET to the mirrored set.",
+    riskRestart: "Takes effect only after a dsh web restart (two-phase: catalog patch now, settings sync on next boot).",
+    addedModels: "New models",
+    removedModels: "Removed (no longer available)",
+    keptModels: "Kept",
+    skippedModels: "Upstream entries skipped by validation",
+    customReset: "These customizations will be reset:",
+    customEntries: "field tweaks",
+    customOverrides: "modelOverrides",
+    confirmRefresh: "Confirm refresh",
+    cancel: "Cancel",
+    refreshing: "Fetching preview\u2026",
+    applying: "Applying\u2026",
+    restartNeeded: "Catalog patched. Restart dsh web to finish syncing the model list.",
+    stalePreview: "Inputs changed \u2014 review the new diff",
+    overlayBtn: "Preview with bundled overlay",
+    stateCorrupt: "State file was corrupted and quarantined; auto self-heal is disabled \u2014 run a refresh to re-activate.",
+    srcLive: "Account models: live fetch",
+    srcCache: "Account models: credential cache (live fetch failed)",
+    srcLatest: "Catalog source: latest pi-ai from npm",
+    srcLocal: "Catalog source: local only (npm fetch failed)",
+    srcOverlay: "Catalog source: bundled overlay (offline bootstrap)",
+    none: "(none)"
   },
   zh: {
     nav: "GHC\u8BBE\u7F6E",
@@ -65,7 +208,34 @@ var DICTS = {
     codeHint: "\u5728\u6D4F\u89C8\u5668\u6253\u5F00\u4E0B\u9762\u7684\u94FE\u63A5\uFF0C\u8F93\u5165\u8FD9\u4E32\u4EE3\u7801\u5B8C\u6210\u6388\u6743\uFF1A",
     copy: "\u590D\u5236",
     copied: "\u5DF2\u590D\u5236 \u2713",
-    unknown: "\u672A\u77E5\u9519\u8BEF"
+    unknown: "\u672A\u77E5\u9519\u8BEF",
+    refreshNow: "\u5237\u65B0\u53EF\u7528\u6A21\u578B\u76EE\u5F55",
+    refreshTitle: "\u5237\u65B0\u53EF\u7528\u6A21\u578B\u76EE\u5F55",
+    refreshDesc: "\u5C06\u73B0\u573A\u62C9\u53D6\u8D26\u53F7\u53EF\u7528\u6A21\u578B\u4E0E\u6700\u65B0 pi-ai \u76EE\u5F55\u6570\u636E\uFF0C\u5BF9\u672C\u673A\u76EE\u5F55\u505A\u6570\u636E\u7EA7\u53EA\u589E\u8865\u4E01\uFF08pi-ai \u7248\u672C\u4E0D\u53D8\uFF09\u3002\u786E\u8BA4\u524D\u8BF7\u6838\u5BF9\u4E0B\u65B9\u5DEE\u5F02\u3002",
+    riskRemoved: "\u5931\u6548\u6A21\u578B\uFF08\u8D26\u53F7\u5DF2\u4E0D\u518D\u53EF\u7528\u7684\u6A21\u578B\uFF09\u91CD\u542F\u540E\u5C06\u4ECE\u6A21\u578B\u5217\u8868\u6D88\u5931\u3002",
+    riskReset: "\u4F60\u7684\u5B9A\u5236\uFF08\u7CBE\u7B80\u88C1\u526A\u3001\u6761\u76EE\u5B57\u6BB5\u5FAE\u8C03\u3001modelOverrides\uFF09\u5C06\u88AB\u91CD\u7F6E\u4E3A\u955C\u50CF\u96C6\u5408\u3002",
+    riskRestart: "\u9700\u91CD\u542F dsh web \u540E\u751F\u6548\uFF08\u4E24\u9636\u6BB5\uFF1A\u73B0\u5728\u5199\u76EE\u5F55\u8865\u4E01\uFF0C\u4E0B\u4E2A boot \u540C\u6B65 settings\uFF09\u3002",
+    addedModels: "\u65B0\u589E\u6A21\u578B",
+    removedModels: "\u79FB\u9664\uFF08\u5DF2\u5931\u6548\uFF09",
+    keptModels: "\u4FDD\u7559",
+    skippedModels: "\u88AB\u6821\u9A8C\u8DF3\u8FC7\u7684\u4E0A\u6E38\u6761\u76EE",
+    customReset: "\u4EE5\u4E0B\u5B9A\u5236\u5C06\u88AB\u91CD\u7F6E\uFF1A",
+    customEntries: "\u5B57\u6BB5\u5FAE\u8C03",
+    customOverrides: "modelOverrides",
+    confirmRefresh: "\u786E\u8BA4\u5237\u65B0",
+    cancel: "\u53D6\u6D88",
+    refreshing: "\u62C9\u53D6\u9884\u89C8\u4E2D\u2026",
+    applying: "\u5E94\u7528\u4E2D\u2026",
+    restartNeeded: "\u76EE\u5F55\u8865\u4E01\u5DF2\u5199\u5165\u3002\u91CD\u542F dsh web \u540E\u5B8C\u6210\u6A21\u578B\u5217\u8868\u540C\u6B65\u3002",
+    stalePreview: "\u6570\u636E\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u786E\u8BA4\u5DEE\u5F02",
+    overlayBtn: "\u6539\u7528\u5185\u7F6E\u8986\u76D6\u5C42\u9884\u89C8",
+    stateCorrupt: "\u72B6\u6001\u6587\u4EF6\u5DF2\u635F\u574F\u5E76\u88AB\u9694\u79BB\uFF1B\u81EA\u52A8\u81EA\u6108\u5DF2\u505C\u7528\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C\u4E00\u6B21\u5237\u65B0\u4EE5\u6FC0\u6D3B\u3002",
+    srcLive: "\u8D26\u53F7\u6A21\u578B\uFF1A\u73B0\u573A\u62C9\u53D6",
+    srcCache: "\u8D26\u53F7\u6A21\u578B\uFF1A\u51ED\u8BC1\u7F13\u5B58\uFF08\u73B0\u573A\u62C9\u53D6\u5931\u8D25\uFF09",
+    srcLatest: "\u76EE\u5F55\u6765\u6E90\uFF1Anpm \u6700\u65B0 pi-ai",
+    srcLocal: "\u76EE\u5F55\u6765\u6E90\uFF1A\u4EC5\u672C\u5730\u76EE\u5F55\uFF08npm \u62C9\u53D6\u5931\u8D25\uFF09",
+    srcOverlay: "\u76EE\u5F55\u6765\u6E90\uFF1A\u5185\u7F6E\u8986\u76D6\u5C42\uFF08\u79BB\u7EBF bootstrap\uFF09",
+    none: "\uFF08\u65E0\uFF09"
   }
 };
 var NAV_TEXTS = Object.keys(DICTS).map((locale) => DICTS[locale].nav);
@@ -137,15 +307,146 @@ var styles = {
   codeRow: { display: "flex", alignItems: "center", gap: 10, flexWrap: "wrap" },
   code: { fontSize: 24, fontWeight: 700, letterSpacing: 2, fontVariantNumeric: "tabular-nums" },
   link: { fontSize: 13, color: "#4c6ef5" },
-  error: { margin: 0, fontSize: 13, lineHeight: "20px", color: "#e03131" }
+  error: { margin: 0, fontSize: 13, lineHeight: "20px", color: "#e03131" },
+  banner: { margin: 0, fontSize: 13, lineHeight: "20px", color: "#f59f00" },
+  modalMask: {
+    position: "fixed",
+    inset: 0,
+    background: "rgba(0,0,0,0.45)",
+    zIndex: 1e3,
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "center",
+    padding: 24
+  },
+  // 弹窗背景/文字由 sampleThemeSurface() 在渲染时采样覆盖（皮肤可能把 bg-base
+  // 做成半透明磨砂，弹窗必须不透明）；此处仅为兜底
+  modal: {
+    background: "var(--dsw-alias-bg-base, #fff)",
+    color: "var(--dsw-alias-label-primary, inherit)",
+    border: "1px solid rgba(128,128,128,0.35)",
+    borderRadius: 12,
+    maxWidth: 560,
+    width: "100%",
+    maxHeight: "80vh",
+    overflowY: "auto",
+    padding: "18px 20px",
+    display: "flex",
+    flexDirection: "column",
+    gap: 10,
+    boxShadow: "0 8px 32px rgba(0,0,0,0.35)"
+  },
+  modalTitle: { margin: 0, fontSize: 15, fontWeight: 600 },
+  modalText: { margin: 0, fontSize: 13, lineHeight: "20px", opacity: 0.85 },
+  diffList: { margin: 0, paddingLeft: 18, fontSize: 13, lineHeight: "20px" },
+  added: { color: "#37b24d" },
+  removed: { color: "#e03131" },
+  skipped: { color: "#f59f00" },
+  risk: { margin: 0, fontSize: 12, lineHeight: "18px", color: "#e8590c" },
+  modalActions: { display: "flex", gap: 10, justifyContent: "flex-end", marginTop: 4 },
+  mono: { fontFamily: "ui-monospace, monospace" }
 };
 var badgeColor = { idle: "#adb5bd", running: "#f59f00", authorized: "#37b24d", failed: "#e03131", loading: "#adb5bd" };
+function sampleThemeSurface() {
+  if (typeof document === "undefined") return { bg: "#fff", fg: "inherit" };
+  const cs = getComputedStyle(document.body);
+  const m = cs.backgroundColor.match(/rgba?\(([^)]+)\)/);
+  const bg = m ? `rgb(${m[1].split(",").slice(0, 3).join(",")})` : "#fff";
+  return { bg, fg: cs.color || "inherit" };
+}
+function RefreshModal({ t, flow, onConfirm, onCancel, onOverlay }) {
+  const p = flow.preview;
+  const surface = (0, import_react.useRef)(null);
+  if (!surface.current) surface.current = sampleThemeSurface();
+  const sourceKeys = [
+    p.source === "live" ? "srcLive" : "srcCache",
+    p.catalogSource === "latest" ? "srcLatest" : p.catalogSource === "overlay" ? "srcOverlay" : "srcLocal"
+  ];
+  const list = (ids, style) => ids.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: { opacity: 0.6 }, children: t("none") }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { style: styles.diffList, children: ids.map((id) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { style: { ...style, ...styles.mono }, children: id }, id)) });
+  const resets = [
+    ...p.customizationReset.modelEntryIds.map((id) => `${id} (${t("customEntries")})`),
+    ...p.customizationReset.modelOverrideIds.map((id) => `${id} (${t("customOverrides")})`)
+  ];
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: styles.modalMask, role: "dialog", "aria-modal": "true", children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { ...styles.modal, background: surface.current.bg, color: surface.current.fg }, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h4", { style: styles.modalTitle, children: t("refreshTitle") }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.modalText, children: t("refreshDesc") }),
+    flow.staleNotice && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
+      "\u26A0 ",
+      t("stalePreview")
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.modalText, children: sourceKeys.map((k) => t(k)).join(" \xB7 ") }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.modalText, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("addedModels") }),
+      "\uFF08",
+      p.added.length,
+      "\uFF09"
+    ] }),
+    list(p.added, styles.added),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.modalText, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("removedModels") }),
+      "\uFF08",
+      p.removed.length,
+      "\uFF09"
+    ] }),
+    list(p.removed, styles.removed),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.modalText, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("keptModels") }),
+      "\uFF08",
+      p.kept.length,
+      "\uFF09"
+    ] }),
+    p.skipped.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.modalText, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("skippedModels") }),
+        "\uFF08",
+        p.skipped.length,
+        "\uFF09"
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { style: styles.diffList, children: p.skipped.map((s) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { style: styles.skipped, children: [
+        s.id,
+        " \u2014 ",
+        s.reason
+      ] }, s.id)) })
+    ] }),
+    resets.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.modalText, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: t("customReset") }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { style: styles.diffList, children: resets.map((x) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { style: styles.skipped, children: x }, x)) })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.risk, children: [
+      "\u26A0 ",
+      t("riskRemoved")
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.risk, children: [
+      "\u26A0 ",
+      t("riskReset")
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.risk, children: [
+      "\u26A0 ",
+      t("riskRestart")
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.modalActions, children: [
+      p.catalogSource === "local" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary, marginRight: "auto" }, onClick: onOverlay, children: t("overlayBtn") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary }, onClick: onCancel, children: t("cancel") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.primary }, onClick: onConfirm, children: t("confirmRefresh") })
+    ] })
+  ] }) });
+}
 function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
   const [page, setPage] = (0, import_react.useState)("loading");
   const [notices, setNotices] = (0, import_react.useState)([]);
   const [error, setError] = (0, import_react.useState)(void 0);
   const [copied, setCopied] = (0, import_react.useState)(false);
   const timer = (0, import_react.useRef)(null);
+  const [flow, setFlow] = (0, import_react.useState)(initial);
+  const flowRef = (0, import_react.useRef)(flow);
+  const drive = (event) => advance(flowRef.current, event, fetch, (next) => {
+    flowRef.current = next;
+    setFlow(next);
+  }).catch(() => {
+  });
+  (0, import_react.useEffect)(() => {
+    drive({ type: "init" });
+  }, []);
   (0, import_react.useEffect)(() => {
     let alive = true;
     fetch("/copilot-auth/status").then((r) => r.json()).then((d) => {
@@ -244,7 +545,34 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
       codeNotice.url && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { style: styles.link, href: codeNotice.url, target: "_blank", rel: "noreferrer", children: codeNotice.url })
     ] }),
     page === "failed" && error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.error, children: error }),
-    page === "authorized" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary }, onClick: logout, children: t("logout") }) }),
+    page === "authorized" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 10, alignItems: "center", flexWrap: "wrap" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary }, onClick: logout, children: t("logout") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "button",
+        {
+          type: "button",
+          style: { ...styles.button, ...styles.primary },
+          disabled: flow.name === "previewing" || flow.name === "applying",
+          onClick: () => drive({ type: "start" }),
+          children: flow.name === "previewing" ? t("refreshing") : flow.name === "applying" ? t("applying") : t("refreshNow")
+        }
+      )
+    ] }),
+    page === "authorized" && flow.name === "restartNeeded" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
+      "\u26A0 ",
+      t("restartNeeded")
+    ] }),
+    page === "authorized" && flow.name === "failed" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.error, children: flow.error === "state-corrupt" ? t("stateCorrupt") : flow.error }),
+    flow.name === "confirming" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      RefreshModal,
+      {
+        t,
+        flow,
+        onConfirm: () => drive({ type: "confirm" }),
+        onCancel: () => drive({ type: "cancel" }),
+        onOverlay: () => drive({ type: "start", mode: "overlay" })
+      }
+    ),
     (page === "idle" || page === "failed") && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.primary }, onClick: login, children: t("login") }) })
   ] });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@inventec/dsh-copilot-auth",
-  "version": "1.0.2",
-  "description": "Device-code sign-in UI and preconfigured route for the built-in GitHub Copilot provider of DeepSeek Harness (DSH)",
+  "version": "1.1.1",
+  "description": "为内置 Copilot 提供方补设备码登录/注销设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。",
   "type": "module",
   "license": "MIT",
   "author": "iasi",
@@ -21,7 +21,14 @@
     "lib/client.js",
     "cordis.patch.yml",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "src/catalog.mjs",
+    "src/catalog-fetch.mjs",
+    "src/copilot-models.mjs",
+    "src/atomic-json.mjs",
+    "src/state.mjs",
+    "src/refresh-flow.mjs",
+    "src/catalog-overlay.json"
   ],
   "scripts": {
     "build": "node scripts/build-client.mjs",

package/src/atomic-json.mjs

@@ -0,0 +1,89 @@
+// atomic-json.mjs — 所有 JSON 写盘的唯一通道。
+// writeJsonAtomic: 同目录 temp（wx 排他创建）→ writeAll → fsyncFile → 重读 parse 校验
+// → rename → fsyncDirectory（仅此处失败降级 warn）。rename 前任何失败清理 temp 并抛错，
+// 原文件不动。第三参为语义 adapter 的部分覆盖（未覆盖键回落默认实现），供故障注入测试。
+import { randomUUID } from "node:crypto";
+import {
+  openSync, writeSync, fsyncSync, closeSync, renameSync, unlinkSync, readFileSync,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+export function readJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    if (err && err.code === "ENOENT") return undefined;
+    throw err;
+  }
+  return JSON.parse(raw);
+}
+
+// 短写循环补写；writeChunk 返回 <= 0 或非整数抛错防死循环（R4-2）。
+export function writeAll(fd, buffer, writeChunk = writeSync) {
+  let offset = 0;
+  while (offset < buffer.length) {
+    const written = writeChunk(fd, buffer, offset, buffer.length - offset);
+    if (!Number.isInteger(written) || written <= 0) {
+      throw new Error("write made no progress");
+    }
+    offset += written;
+  }
+}
+
+const defaultFs = {
+  openTemp: (path) => openSync(path, "wx"),
+  writeAll: (fd, buf) => writeAll(fd, buf),
+  fsyncFile: (fd) => fsyncSync(fd),
+  closeFd: (fd) => closeSync(fd),
+  rename: (from, to) => renameSync(from, to),
+  fsyncDirectory: (dir) => {
+    const fd = openSync(dir, "r");
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+  },
+  remove: (path) => unlinkSync(path),
+};
+
+export function writeJsonAtomic(path, obj, fs = {}) {
+  const a = { ...defaultFs, ...fs };
+  const dir = dirname(path);
+  const tempPath = join(dir, `.${basename(path)}.tmp-${randomUUID()}`);
+  const payload = Buffer.from(JSON.stringify(obj, null, 2) + "\n", "utf8");
+  let fd;
+  try {
+    fd = a.openTemp(tempPath);
+    a.writeAll(fd, payload);
+    a.fsyncFile(fd);
+    a.closeFd(fd);
+    fd = undefined;
+    JSON.parse(readFileSync(tempPath, "utf8")); // 提交前重读校验，坏内容不过 rename
+    a.rename(tempPath, path);
+  } catch (err) {
+    if (fd !== undefined) {
+      try { a.closeFd(fd); } catch { /* 清理失败不掩盖原始错误 */ }
+    }
+    try { a.remove(tempPath); } catch { /* temp 可能尚未创建 */ }
+    throw err;
+  }
+  try {
+    a.fsyncDirectory(dir);
+  } catch (err) {
+    // 目录项落盘失败仅降级告警：rename 已生效，语义如实成文（R3-7 ⑤）
+    console.warn(`[copilot-auth] fsyncDirectory failed for ${dir}: ${err}`);
+  }
+}
+
+// settled-tail mutex：回调拒绝后不中毒，后续任务仍串行执行（Y2-4）。
+// 仅提供宿主单进程内互斥，不支持多实例/多进程并发（见 README 已知边界）。
+export function createMutex() {
+  let tail = Promise.resolve();
+  return (fn) => {
+    const run = tail.then(fn, fn);
+    tail = run.catch(() => {});
+    return run;
+  };
+}

package/src/catalog-fetch.mjs

@@ -0,0 +1,98 @@
+// catalog-fetch.mjs — 最新 pi-ai 目录的受信获取通道。
+// 分层校验契约（Y2-7）：本层只管传输可信——integrity / 超时 / 流式大小上限 /
+// 包膜结构；逐条目合法性唯一归 mergeCatalog 的 validateCatalog，本层不拦。
+import { createHash } from "node:crypto";
+import { extractTgzEntry } from "./catalog.mjs";
+
+const PKG = "@earendil-works/pi-ai";
+const DEFAULT_CAPS = { metadata: 20_000_000, tarball: 30_000_000, decompressed: 100_000_000 };
+const MAX_REDIRECTS = 3;
+
+// 流式限额读取（Y3-1）：逐 chunk 累计，超限立即 cancel 并抛错——不得先无限缓冲再检查。
+async function readCapped(res, cap) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of res.body) {
+    total += chunk.length;
+    if (total > cap) {
+      try {
+        await res.body.cancel();
+      } catch { /* cancel 失败不掩盖超限错误 */ }
+      throw new Error(`response too large (cap ${cap} bytes)`);
+    }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+// URL 信任：仅 HTTPS，或与所配置 registry 同主机的 http（企业镜像例外）。
+function assertUrlAllowed(rawUrl, registryHost) {
+  const u = new URL(rawUrl);
+  if (u.protocol === "https:") return u;
+  if (u.protocol === "http:" && u.host === registryHost) return u;
+  throw new Error(`disallowed url: ${rawUrl}`);
+}
+
+// 一律 redirect:"manual"（Y3-2）：30x 逐跳校验 Location 的协议/host（同 tarball
+// 规则），相对 Location 以当前 URL 解析，最多 3 跳，回环（重复 URL）即抛错。
+async function fetchValidated(fetchImpl, url, registryHost) {
+  let current = url;
+  const seen = new Set([current]);
+  for (let redirects = 0; ; ) {
+    assertUrlAllowed(current, registryHost);
+    const res = await fetchImpl(current, { signal: AbortSignal.timeout(10_000), redirect: "manual" });
+    const location = res.headers?.get?.("location");
+    if (res.status >= 300 && res.status < 400 && location) {
+      redirects += 1;
+      if (redirects > MAX_REDIRECTS) throw new Error(`too many redirects (>${MAX_REDIRECTS}) from ${url}`);
+      const next = new URL(location, current).href;
+      if (seen.has(next)) throw new Error(`redirect loop detected: ${next}`);
+      seen.add(next);
+      try {
+        await res.body?.cancel?.();
+      } catch { /* redirect 响应体丢弃失败可忽略 */ }
+      current = next;
+      continue;
+    }
+    return res;
+  }
+}
+
+// fetchLatestCatalog({ registry, fetchImpl, caps? }) → { catalog, piAiVersion, integrity }
+// caps 为测试注入钩子（默认 20MB metadata / 30MB tgz 压缩 / 100MB 解压）。
+export async function fetchLatestCatalog({ registry, fetchImpl, caps = {} } = {}) {
+  if (typeof fetchImpl !== "function") throw new TypeError("fetchImpl required");
+  const limit = { ...DEFAULT_CAPS, ...caps };
+  const reg = (registry ?? process.env.npm_config_registry ?? "https://registry.npmjs.org").replace(/\/+$/, "");
+  const registryHost = new URL(reg).host;
+
+  const metaRes = await fetchValidated(fetchImpl, `${reg}/${PKG}`, registryHost);
+  if (!metaRes.ok) throw new Error(`npm metadata -> ${metaRes.status}`);
+  const metadata = JSON.parse((await readCapped(metaRes, limit.metadata)).toString("utf8"));
+  const version = metadata?.["dist-tags"]?.latest;
+  const dist = version ? metadata?.versions?.[version]?.dist : undefined;
+  if (!version || !dist?.tarball || !dist?.integrity) {
+    throw new Error("npm metadata missing dist-tags.latest/versions[latest].dist");
+  }
+
+  const tgzRes = await fetchValidated(fetchImpl, dist.tarball, registryHost);
+  if (!tgzRes.ok) throw new Error(`npm tarball -> ${tgzRes.status}`);
+  const tgz = await readCapped(tgzRes, limit.tarball);
+
+  const actual = "sha512-" + createHash("sha512").update(tgz).digest("base64");
+  if (actual !== dist.integrity) {
+    throw new Error(`integrity mismatch for ${PKG}@${version}`);
+  }
+
+  const catalog = JSON.parse(extractTgzEntry(tgz, { maxBytes: limit.decompressed }).toString("utf8"));
+  // 包膜结构校验（本层职责）：catalog 为对象且每个 section 为对象。
+  if (!catalog || typeof catalog !== "object" || Array.isArray(catalog)) {
+    throw new Error("catalog envelope invalid: root is not an object");
+  }
+  for (const [api, section] of Object.entries(catalog)) {
+    if (!section || typeof section !== "object" || Array.isArray(section)) {
+      throw new Error(`catalog envelope invalid: section ${api} is not an object`);
+    }
+  }
+  return { catalog, piAiVersion: version, integrity: dist.integrity };
+}