@mars-sea/dsh-commandcode-provider 0.7.1 → 0.8.0

package/lib/client.js

@@ -358,6 +358,14 @@ window.__ModuleLoader__.load({
 				this.failed = false;
 				this.publish();
 			}
+			/**
+			* Re-read the Host's credential facts without any staged edit. The browser
+			* login stores a key Host-side behind the page's back; the plugin entry
+			* calls this when a login lands so the configured/writable badges follow.
+			*/
+			refreshCredentials() {
+				this.describeAll();
+			}
 			/** Write every staged edit, then re-read the Host's accepted state. */
 			async save() {
 				const plan = this.plan();
@@ -749,36 +757,256 @@ window.__ModuleLoader__.load({
 			return new Date(ms).toLocaleString();
 		}
 		//#endregion
+		//#region src/client/login.ts
+		/** How often a live attempt is polled. */
+		const POLL_INTERVAL_MS = 1e3;
+		/**
+		* The login panel's fetch/poll lifecycle. One poll loop at a time; a fresh
+		* `begin()` supersedes any previous loop via a generation token.
+		*/
+		var CommandCodeLoginController = class {
+			remote;
+			listeners = /* @__PURE__ */ new Set();
+			pollMs;
+			/** Monotonic token; only the latest loop may publish polling results. */
+			generation = 0;
+			disposed = false;
+			phase = "idle";
+			authUrl;
+			userName;
+			keyName;
+			reason;
+			message;
+			constructor(remote, pollMs = POLL_INTERVAL_MS) {
+				this.remote = remote;
+				this.pollMs = pollMs;
+			}
+			/** Subscribe to state projections. @returns the disposer. */
+			subscribe(listener) {
+				this.listeners.add(listener);
+				return () => this.listeners.delete(listener);
+			}
+			/** Build the current panel state face. */
+			state() {
+				return {
+					phase: this.phase,
+					authUrl: this.authUrl,
+					userName: this.userName,
+					keyName: this.keyName,
+					reason: this.reason,
+					message: this.message
+				};
+			}
+			/** Start (or rejoin) a login attempt and begin polling its status. */
+			async begin() {
+				if (this.disposed || this.phase === "starting" || this.phase === "waiting") return;
+				const generation = ++this.generation;
+				this.set({
+					phase: "starting",
+					authUrl: void 0,
+					userName: void 0,
+					keyName: void 0,
+					reason: void 0,
+					message: void 0
+				});
+				const remote = this.remote();
+				if (remote === void 0) {
+					this.set({
+						phase: "unavailable",
+						authUrl: void 0,
+						userName: void 0,
+						keyName: void 0,
+						reason: void 0,
+						message: "login remote is not mounted"
+					});
+					return;
+				}
+				let result;
+				try {
+					result = await remote.loginBegin();
+				} catch (error) {
+					result = {
+						ok: false,
+						error: { message: error instanceof Error ? error.message : String(error) }
+					};
+				}
+				if (this.superseded(generation)) return;
+				if (!result.ok) {
+					this.set({
+						phase: "unavailable",
+						authUrl: void 0,
+						userName: void 0,
+						keyName: void 0,
+						reason: void 0,
+						message: result.error.message
+					});
+					return;
+				}
+				this.apply(result.value);
+				if (this.currentPhase === "waiting") this.poll(generation);
+			}
+			/** Cancel a waiting attempt. */
+			async cancel() {
+				if (this.disposed || this.phase !== "starting" && this.phase !== "waiting") return;
+				const generation = ++this.generation;
+				const remote = this.remote();
+				if (remote === void 0) return;
+				let result;
+				try {
+					result = await remote.loginCancel();
+				} catch {
+					this.set({
+						phase: "failed",
+						authUrl: void 0,
+						userName: void 0,
+						keyName: void 0,
+						reason: "cancelled",
+						message: void 0
+					});
+					return;
+				}
+				if (this.superseded(generation)) return;
+				if (result.ok) this.apply(result.value);
+				else this.set({
+					phase: "failed",
+					authUrl: void 0,
+					userName: void 0,
+					keyName: void 0,
+					reason: "cancelled",
+					message: void 0
+				});
+			}
+			/** Stop polling and release listeners. Idempotent. */
+			dispose() {
+				if (this.disposed) return;
+				this.disposed = true;
+				this.generation += 1;
+				this.listeners.clear();
+			}
+			/** Poll until the attempt leaves `waiting` or a newer loop supersedes us. */
+			async poll(generation) {
+				while (!this.disposed && !this.superseded(generation) && this.currentPhase === "waiting") {
+					await sleep(this.pollMs);
+					if (this.disposed || this.superseded(generation) || this.currentPhase !== "waiting") return;
+					const remote = this.remote();
+					if (remote === void 0) {
+						this.set({
+							phase: "unavailable",
+							authUrl: void 0,
+							userName: void 0,
+							keyName: void 0,
+							reason: void 0,
+							message: "login remote is not mounted"
+						});
+						return;
+					}
+					let result;
+					try {
+						result = await remote.loginStatus();
+					} catch {
+						continue;
+					}
+					if (this.superseded(generation) || this.currentPhase !== "waiting") return;
+					if (result.ok) this.apply(result.value);
+				}
+			}
+			get currentPhase() {
+				return this.phase;
+			}
+			/** Project one Host status onto the panel face. */
+			apply(status) {
+				const base = {
+					authUrl: void 0,
+					userName: void 0,
+					keyName: void 0,
+					reason: void 0,
+					message: void 0
+				};
+				if (status.state === "waiting") {
+					this.set({
+						...base,
+						phase: "waiting",
+						authUrl: status.authUrl
+					});
+					return;
+				}
+				if (status.state === "success") {
+					this.set({
+						...base,
+						phase: "success",
+						userName: status.userName,
+						keyName: status.keyName
+					});
+					return;
+				}
+				if (status.state === "failed") {
+					this.set({
+						...base,
+						phase: "failed",
+						reason: status.reason,
+						message: status.message
+					});
+					return;
+				}
+				this.set({
+					...base,
+					phase: "failed",
+					reason: "cancelled",
+					message: "the login attempt is no longer active"
+				});
+			}
+			/** Replace the whole state face and notify. Explicit over partial patches. */
+			set(state) {
+				this.phase = state.phase;
+				this.authUrl = state.authUrl;
+				this.userName = state.userName;
+				this.keyName = state.keyName;
+				this.reason = state.reason;
+				this.message = state.message;
+				this.publish();
+			}
+			superseded(generation) {
+				return this.disposed || generation !== this.generation;
+			}
+			publish() {
+				if (this.disposed) return;
+				for (const listener of [...this.listeners]) listener();
+			}
+		};
+		function sleep(ms) {
+			return new Promise((resolve) => setTimeout(resolve, ms));
+		}
+		//#endregion
 		//#region src/usage-wire.ts
 		/** The npm package identity both contribution registrations claim. */
 		const USAGE_REMOTE_PACKAGE = "@mars-sea/dsh-commandcode-provider";
 		/** Canonical `<namespace>/<method>` endpoint of the usage report Remote. */
 		const USAGE_REPORT_ENDPOINT = "commandcode/report";
 		/** Reject one boundary value with a field-naming error. */
-		function reject(field) {
+		function reject$1(field) {
 			throw new TypeError(`commandcode/report result: invalid ${field}`);
 		}
 		/** Read one required finite number field (`field` is the dotted error label). */
 		function numberField(source, key, field) {
 			const value = source[key];
-			if (typeof value !== "number" || !Number.isFinite(value)) reject(field);
+			if (typeof value !== "number" || !Number.isFinite(value)) reject$1(field);
 			return value;
 		}
 		/** Read one required string field (`field` is the dotted error label). */
 		function stringField(source, key, field) {
 			const value = source[key];
-			if (typeof value !== "string") reject(field);
+			if (typeof value !== "string") reject$1(field);
 			return value;
 		}
 		/** Read one required boolean field (`field` is the dotted error label). */
 		function booleanField(source, key, field) {
 			const value = source[key];
-			if (typeof value !== "boolean") reject(field);
+			if (typeof value !== "boolean") reject$1(field);
 			return value;
 		}
 		/** Narrow an unknown value to a plain record, or reject. */
 		function record(value, field) {
-			if (typeof value !== "object" || value === null || Array.isArray(value)) reject(field);
+			if (typeof value !== "object" || value === null || Array.isArray(value)) reject$1(field);
 			return value;
 		}
 		/** Validate one window-limit block (`fiveHour` / `weekly`). */
@@ -799,11 +1027,11 @@ window.__ModuleLoader__.load({
 		function parseUsageReport(value) {
 			const source = record(value, "report");
 			const failures = source.failures;
-			if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject("failures");
+			if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$1("failures");
 			const report = { failures };
 			if (source.blocked !== void 0) {
 				const blocked = source.blocked;
-				if (blocked !== "invalid-key" && blocked !== "service-unavailable" && blocked !== "network") reject("blocked");
+				if (blocked !== "invalid-key" && blocked !== "service-unavailable" && blocked !== "network") reject$1("blocked");
 				report.blocked = blocked;
 			}
 			if (source.account !== void 0) {
@@ -841,7 +1069,7 @@ window.__ModuleLoader__.load({
 			if (source.plan !== void 0) {
 				const plan = record(source.plan, "plan");
 				const monthly = plan.monthlyCredits;
-				if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject("plan.monthlyCredits");
+				if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$1("plan.monthlyCredits");
 				report.plan = {
 					planId: stringField(plan, "planId", "plan.planId"),
 					name: stringField(plan, "name", "plan.name"),
@@ -868,7 +1096,7 @@ window.__ModuleLoader__.load({
 		/** Parse the wire result into a {@link CommandCodeAccountsReport}. */
 		function parseAccountsReport(value) {
 			const accounts = record(value, "result").accounts;
-			if (!Array.isArray(accounts)) reject("accounts");
+			if (!Array.isArray(accounts)) reject$1("accounts");
 			return { accounts: accounts.map(parseAccountUsage) };
 		}
 		/** The Client-face contribution mounted on `ctx.remote`. */
@@ -889,6 +1117,92 @@ window.__ModuleLoader__.load({
 			}]
 		};
 		//#endregion
+		//#region src/login-wire.ts
+		/** The canonical endpoint paths of the three login Remotes. */
+		const LOGIN_BEGIN_ENDPOINT = "commandcode/loginBegin";
+		const LOGIN_STATUS_ENDPOINT = "commandcode/loginStatus";
+		const LOGIN_CANCEL_ENDPOINT = "commandcode/loginCancel";
+		const REASONS = [
+			"denied",
+			"timeout",
+			"invalid-key",
+			"network",
+			"unavailable",
+			"cancelled",
+			"error"
+		];
+		/** Reject one boundary value with a field-naming error. */
+		function reject(field) {
+			throw new TypeError(`commandcode/login result: invalid ${field}`);
+		}
+		/**
+		* Parse one untrusted boundary value into a {@link CommandCodeLoginStatus}.
+		* Every field is shape-checked so a malformed frame fails the boundary
+		* instead of leaking into the page.
+		*/
+		function parseLoginStatus(value) {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) reject("status");
+			const source = value;
+			const state = source.state;
+			if (state !== "idle" && state !== "waiting" && state !== "success" && state !== "failed") reject("state");
+			const status = { state };
+			if (source.authUrl !== void 0) {
+				if (typeof source.authUrl !== "string") reject("authUrl");
+				status.authUrl = source.authUrl;
+			}
+			if (source.userName !== void 0) {
+				if (typeof source.userName !== "string") reject("userName");
+				status.userName = source.userName;
+			}
+			if (source.keyName !== void 0) {
+				if (typeof source.keyName !== "string") reject("keyName");
+				status.keyName = source.keyName;
+			}
+			if (source.reason !== void 0) {
+				if (!REASONS.includes(source.reason)) reject("reason");
+				status.reason = source.reason;
+			}
+			if (source.message !== void 0) {
+				if (typeof source.message !== "string") reject("message");
+				status.message = source.message;
+			}
+			return status;
+		}
+		/** The strict result codec shared by all three login endpoints. */
+		const loginStatusSchema = { parse: parseLoginStatus };
+		/** Build one login invocation descriptor (uniform result, no parameters). */
+		function loginDescriptor(endpoint, method) {
+			return {
+				id: `${USAGE_REMOTE_PACKAGE}#${endpoint}`,
+				service: "commandcodeUsage",
+				namespace: "commandcode",
+				method,
+				invocation: { kind: "direct" },
+				parameters: [],
+				result: {
+					mode: "strict",
+					typeSymbol: `${USAGE_REMOTE_PACKAGE}#CommandCodeLoginStatus`,
+					schema: loginStatusSchema
+				}
+			};
+		}
+		/** The Client-face contribution fragment mounted on `ctx.remote`. */
+		const LOGIN_REMOTE_CONTRIBUTION = {
+			package: USAGE_REMOTE_PACKAGE,
+			descriptors: [
+				loginDescriptor(LOGIN_BEGIN_ENDPOINT, "loginBegin"),
+				loginDescriptor(LOGIN_STATUS_ENDPOINT, "loginStatus"),
+				loginDescriptor(LOGIN_CANCEL_ENDPOINT, "loginCancel")
+			]
+		};
+		//#endregion
+		//#region package.json
+		var version = "0.8.0";
+		var repository = {
+			"type": "git",
+			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
+		};
+		//#endregion
 		//#region src/client/version.ts
 		/**
 		* The plugin's own version, read from package.json at build time.
@@ -902,7 +1216,154 @@ window.__ModuleLoader__.load({
 		* @module dsh-commandcode-provider/client/version
 		*/
 		/** The published package version (e.g. `'0.6.0'`). */
-		const PLUGIN_VERSION = "0.7.1";
+		const PLUGIN_VERSION = version;
+		/**
+		* This package's GitHub releases page, derived from the repository field so
+		* the update hint's link target can never drift from the published home.
+		*/
+		const PLUGIN_RELEASES_URL = `${repository.url.replace(/^git\+/, "").replace(/\.git$/, "")}/releases`;
+		/** Abort a hung registry request rather than keep the footer waiting. */
+		const FETCH_TIMEOUT_MS = 5e3;
+		/**
+		* The npm registry document for this package's `latest` dist-tag. The scoped
+		* name is path-escaped (`%2F`) so no client normalizes the slash away.
+		*/
+		const NPM_LATEST_URL = "https://registry.npmjs.org/@mars-sea%2Fdsh-commandcode-provider/latest";
+		/**
+		* Compare two version strings (`major.minor.patch[-pre]`). Returns a negative
+		* number when `a` sorts before `b`, positive when after, zero when equal.
+		*
+		* Tolerant by design: a leading `v` is stripped, unparsable numeric parts
+		* count as `0`, and semver prerelease rules apply (release > prerelease;
+		* numeric identifiers compare numerically, everything else lexically, a
+		* shorter identifier list sorts first). Enough for release tags; not a full
+		* semver validator.
+		*/
+		function compareVersions(a, b) {
+			const left = splitVersion(a);
+			const right = splitVersion(b);
+			const depth = Math.max(left.core.length, right.core.length);
+			for (let index = 0; index < depth; index += 1) {
+				const delta = (left.core[index] ?? 0) - (right.core[index] ?? 0);
+				if (delta !== 0) return Math.sign(delta);
+			}
+			if (left.pre.length === 0 && right.pre.length === 0) return 0;
+			if (left.pre.length === 0) return 1;
+			if (right.pre.length === 0) return -1;
+			const width = Math.max(left.pre.length, right.pre.length);
+			for (let index = 0; index < width; index += 1) {
+				const l = left.pre[index];
+				const r = right.pre[index];
+				if (l === void 0) return -1;
+				if (r === void 0) return 1;
+				const lNumeric = /^\d+$/.test(l);
+				const rNumeric = /^\d+$/.test(r);
+				let delta;
+				if (lNumeric && rNumeric) delta = Number(l) - Number(r);
+				else if (lNumeric) delta = -1;
+				else if (rNumeric) delta = 1;
+				else delta = l < r ? -1 : l > r ? 1 : 0;
+				if (delta !== 0) return Math.sign(delta);
+			}
+			return 0;
+		}
+		/** True when `candidate` is strictly newer than `current`. */
+		function isNewerVersion(candidate, current) {
+			return compareVersions(candidate, current) > 0;
+		}
+		/** Split a tolerant version string into numeric core + prerelease ids. */
+		function splitVersion(value) {
+			const [coreText = "", preText] = value.trim().replace(/^v/i, "").split("-");
+			return {
+				core: coreText === "" ? [0] : coreText.split(".").map((part) => {
+					const parsed = Number.parseInt(part, 10);
+					return Number.isFinite(parsed) ? parsed : 0;
+				}),
+				pre: preText === void 0 ? [] : preText.split(".")
+			};
+		}
+		/**
+		* Extract the published version from the registry's `/latest` manifest
+		* (`{ name, version, … }`). Throws on anything unexpected so callers treat a
+		* shape change as a failed attempt, never as bogus data.
+		*/
+		function parseLatestVersion(payload) {
+			if (typeof payload !== "object" || payload === null) throw new Error("npm latest payload is not an object");
+			const version = payload.version;
+			if (typeof version !== "string" || !/^\d+\.\d+\./.test(version)) throw new Error("npm latest payload has no usable version");
+			return version;
+		}
+		/** Fetch and parse the published `latest` version. Rejects on any failure. */
+		async function fetchLatestVersion(fetchImpl = fetch) {
+			const controller = new AbortController();
+			const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+			try {
+				const response = await fetchImpl(NPM_LATEST_URL, { signal: controller.signal });
+				if (!response.ok) throw new Error(`registry responded ${response.status}`);
+				return parseLatestVersion(await response.json());
+			} finally {
+				clearTimeout(timer);
+			}
+		}
+		/** The `localStorage` key holding {@link UpdateCheckRecord}. */
+		const UPDATE_CHECK_CACHE_KEY = "@mars-sea/dsh-commandcode-provider/update-check";
+		/**
+		* A {@link UpdateCheckStore} backed by `localStorage`. Tolerates a missing or
+		* throwing storage (SSR-ish contexts, private modes): reads yield `undefined`,
+		* writes are dropped.
+		*/
+		function localStorageUpdateStore(storage = typeof localStorage === "undefined" ? void 0 : localStorage) {
+			return {
+				read() {
+					if (storage === void 0) return void 0;
+					try {
+						const raw = storage.getItem(UPDATE_CHECK_CACHE_KEY);
+						if (raw === null) return void 0;
+						const parsed = JSON.parse(raw);
+						if (typeof parsed !== "object" || parsed === null) return void 0;
+						const at = parsed.at;
+						if (typeof at !== "number" || !Number.isFinite(at)) return void 0;
+						const version = parsed.version;
+						return {
+							at,
+							version: typeof version === "string" && version !== "" ? version : void 0
+						};
+					} catch {
+						return;
+					}
+				},
+				write(record) {
+					if (storage === void 0) return;
+					try {
+						storage.setItem(UPDATE_CHECK_CACHE_KEY, JSON.stringify(record));
+					} catch {}
+				}
+			};
+		}
+		/**
+		* Run one throttled update check. Resolves with the newest published version
+		* when it is newer than `currentVersion`, otherwise `undefined`.
+		*
+		* Within the throttle window (or on failure) the cached version answers, so
+		* the hint keeps working offline; past the window the registry is consulted
+		* again and the attempt time is refreshed either way.
+		*/
+		async function checkForUpdate(options) {
+			const { currentVersion, now, store } = options;
+			const hintOf = (version) => version !== void 0 && isNewerVersion(version, currentVersion) ? version : void 0;
+			const cache = store.read();
+			if (cache !== void 0 && now - cache.at < 864e5) return hintOf(cache.version);
+			let learned;
+			try {
+				learned = await fetchLatestVersion(options.fetchImpl);
+			} catch {}
+			const version = learned ?? cache?.version;
+			store.write({
+				at: now,
+				version
+			});
+			return hintOf(version);
+		}
 		//#endregion
 		//#region src/client/section.tsx
 		/**
@@ -1074,6 +1535,82 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		/** The per-reason copy for a failed login attempt. */
+		function loginFailureCopy(reason, t) {
+			if (reason === "denied") return t("loginDenied");
+			if (reason === "timeout") return t("loginTimeout");
+			if (reason === "invalid-key") return t("loginInvalidKey");
+			if (reason === "network") return t("loginNetwork");
+			if (reason === "unavailable") return t("loginStoreFailed");
+			if (reason === "cancelled") return t("loginCancelled");
+			return t("loginFailedGeneric");
+		}
+		/**
+		* The sign-in alternative to pasting a key: one field row that starts the
+		* Host-side browser login, links to the Studio authorization page while the
+		* attempt is live, and reports the outcome. The key itself never crosses to
+		* the browser — only "who signed in" does.
+		*/
+		function LoginPanel({ state, disabled, t, onBegin, onCancel }) {
+			const busy = state.phase === "starting" || state.phase === "waiting";
+			let hint = t("loginHintIdle");
+			let hintTitle;
+			let hintClass = "cc-hint";
+			if (state.phase === "starting" || state.phase === "waiting") hint = t(state.phase === "starting" ? "loginStarting" : "loginWaiting");
+			else if (state.phase === "success") {
+				const keyName = state.keyName !== void 0 && state.keyName !== "" ? ` · ${state.keyName}` : "";
+				hint = `${t("loginSuccess")} ${state.userName ?? ""}${keyName}`.trim();
+				hintClass = "cc-loginDone";
+			} else if (state.phase === "failed") {
+				hint = loginFailureCopy(state.reason, t);
+				hintClass = "cc-loginError";
+				if (state.message !== void 0) hintTitle = state.message;
+			} else if (state.phase === "unavailable") {
+				hint = `${t("loginUnavailable")} ${state.message ?? ""}`.trim();
+				hintClass = "cc-loginError";
+			}
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "cc-field",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "cc-fieldHead",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+							className: "cc-label",
+							children: t("loginTitle")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "cc-badges",
+							children: busy ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "cc-reset",
+								onClick: onCancel,
+								children: t("loginCancel")
+							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "cc-reset",
+								disabled,
+								onClick: onBegin,
+								children: t("loginButton")
+							})
+						})]
+					}),
+					state.authUrl !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "cc-hint",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+							className: "cc-loginLink",
+							href: state.authUrl,
+							target: "_blank",
+							rel: "noreferrer",
+							children: t("loginOpenLink")
+						})
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: hintClass,
+						title: hintTitle,
+						children: hint
+					})
+				]
+			});
+		}
 		/** One stat tile in the account card's summary grid. */
 		function UsageStat({ label, value, sub }) {
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -1619,14 +2156,39 @@ window.__ModuleLoader__.load({
 			}, [tick]);
 			return visible;
 		}
+		/**
+		* The update hint: one throttled npm-registry check per page open (the
+		* throttle and all failure handling live in ./update.ts). Resolves to the
+		* newest published version when it is newer than this build, else undefined —
+		* every failure mode degrades to no hint at all.
+		*/
+		function usePluginUpdate() {
+			const [available, setAvailable] = (0, react.useState)(void 0);
+			(0, react.useEffect)(() => {
+				let cancelled = false;
+				checkForUpdate({
+					currentVersion: PLUGIN_VERSION,
+					now: Date.now(),
+					store: localStorageUpdateStore()
+				}).then((version) => {
+					if (!cancelled) setAvailable(version);
+				}, () => {});
+				return () => {
+					cancelled = true;
+				};
+			}, []);
+			return available;
+		}
 		/** The settings page body: connection facts for the Command Code provider. */
 		function CommandCodeSettingsPage(props) {
 			const { t } = props;
 			const state = props.useCommandCodeSettings((snapshot) => snapshot);
 			const usage = props.useCommandCodeUsage((snapshot) => snapshot);
+			const login = props.useCommandCodeLogin((snapshot) => snapshot);
 			const disabled = !state.writable;
 			const keyLocked = !state.apiKeyWritable;
 			const savedVisible = useSavedFlash(state.savedCount);
+			const updateVersion = usePluginUpdate();
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: "cc-section",
 				"aria-label": t("title"),
@@ -1686,6 +2248,13 @@ window.__ModuleLoader__.load({
 								onEdit: (text) => props.edit("apiKey", text),
 								onToggleClear: () => props.toggleKeyClear("default")
 							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(LoginPanel, {
+								state: login,
+								disabled: disabled || keyLocked,
+								t,
+								onBegin: props.beginLogin,
+								onCancel: props.cancelLogin
+							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
 								id: "cc-api-base",
 								label: t("apiBase"),
@@ -1773,7 +2342,23 @@ window.__ModuleLoader__.load({
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
 						className: "cc-version",
-						children: ["Command Code Provider v", PLUGIN_VERSION]
+						children: [
+							"Command Code Provider v",
+							PLUGIN_VERSION,
+							updateVersion !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" · ", /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("a", {
+								className: "cc-versionLink",
+								href: PLUGIN_RELEASES_URL,
+								target: "_blank",
+								rel: "noreferrer",
+								title: t("updateHint"),
+								children: [
+									"v",
+									updateVersion,
+									" ",
+									t("updateAvailable")
+								]
+							})] }) : null
+						]
 					})
 				]
 			});
@@ -1860,7 +2445,25 @@ window.__ModuleLoader__.load({
 			usageActive: "当前使用",
 			usageCooldown: "限额冷却中",
 			usageInvalidKey: "密钥无效",
-			usageUnconfigured: "该账户尚未配置 API 密钥。"
+			usageUnconfigured: "该账户尚未配置 API 密钥。",
+			updateAvailable: "可更新",
+			updateHint: "已发布新版本，点击查看发布说明；更新插件后刷新本页，提示会自动消失。",
+			loginTitle: "通过官方登录获取密钥",
+			loginHintIdle: "不想手动创建密钥？点击登录后浏览器会打开 commandcode.ai 授权页，完成后密钥自动写入本机凭据服务，下次请求即生效。",
+			loginButton: "登录 Command Code",
+			loginStarting: "正在启动本地回调服务…",
+			loginWaiting: "等待在浏览器中完成授权…",
+			loginOpenLink: "打开授权页面 ↗",
+			loginCancel: "取消登录",
+			loginSuccess: "已登录为",
+			loginUnavailable: "此环境暂不支持登录流程，请手动粘贴密钥。",
+			loginDenied: "授权被拒绝。可重试，或手动粘贴密钥。",
+			loginTimeout: "等待超时：未在窗口期内收到授权回调，请重试。",
+			loginInvalidKey: "获取到的密钥未通过校验（401），请重试或手动粘贴。",
+			loginNetwork: "无法连接 Command Code 服务校验密钥，请检查网络后重试。",
+			loginStoreFailed: "密钥无法写入本机凭据服务，请手动粘贴。",
+			loginCancelled: "登录已取消。",
+			loginFailedGeneric: "登录失败，请重试或手动粘贴密钥。"
 		};
 		const en = {
 			nav: "Command Code",
@@ -1942,7 +2545,25 @@ window.__ModuleLoader__.load({
 			usageActive: "Active",
 			usageCooldown: "Cooling down",
 			usageInvalidKey: "Invalid key",
-			usageUnconfigured: "No API key configured for this account yet."
+			usageUnconfigured: "No API key configured for this account yet.",
+			updateAvailable: "update available",
+			updateHint: "A newer version has been published; click for release notes. The notice disappears once the plugin is updated.",
+			loginTitle: "Sign in to fetch a key",
+			loginHintIdle: "Rather not create a key by hand? Sign in and your browser opens the commandcode.ai authorization page; the approved key is stored in the local credential service and applies to the next request.",
+			loginButton: "Sign in to Command Code",
+			loginStarting: "Starting the local callback server…",
+			loginWaiting: "Waiting for authorization in your browser…",
+			loginOpenLink: "Open the authorization page ↗",
+			loginCancel: "Cancel sign-in",
+			loginSuccess: "Signed in as",
+			loginUnavailable: "Sign-in is unavailable in this environment; paste the API key instead.",
+			loginDenied: "Authorization was denied. Try again or paste the key manually.",
+			loginTimeout: "Timed out waiting for the authorization callback; try again.",
+			loginInvalidKey: "The delivered key failed validation (401). Try again or paste it manually.",
+			loginNetwork: "Could not reach the Command Code service to validate the key; check your network and retry.",
+			loginStoreFailed: "The key could not be stored in the local credential service; paste it manually.",
+			loginCancelled: "Sign-in cancelled.",
+			loginFailedGeneric: "Sign-in failed; try again or paste the key manually."
 		};
 		//#endregion
 		//#region src/client/index.ts
@@ -2027,6 +2648,17 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 .cc-usageBlockedTitle{color:var(--dsw-alias-label-error);margin:0;font-size:13px;font-weight:600;line-height:1.5}
 .cc-usageBlockedHint{color:var(--dsw-alias-label-secondary);margin:0;font-size:12px;line-height:1.5}
 .cc-version{margin:4px 0 0;text-align:center;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}
+/* The update hint rides the footer version line: warning-tinted (with a
+ * muted fallback for themes without the alias), quiet until hovered. */
+.cc-versionLink{color:var(--dsw-alias-state-warning-primary,var(--dsw-alias-label-secondary));text-decoration:none}
+.cc-versionLink:hover{color:var(--dsw-alias-label-primary);text-decoration:underline;text-underline-position:under}
+/* The login panel rides the connection card as one more field row; the
+ * authorization link is the only branded element on it. */
+.cc-loginLink{color:var(--dsw-alias-brand-primary);text-decoration:none;font-size:12px;line-height:1.5}
+.cc-loginLink:hover{text-decoration:underline;text-underline-position:under}
+.cc-loginBusy{color:var(--dsw-alias-label-tertiary)}
+.cc-loginDone{color:var(--dsw-alias-state-success-primary,var(--dsw-alias-label-secondary))}
+.cc-loginError{color:var(--dsw-alias-label-error)}
 .cc-saved{color:var(--dsw-alias-state-success-primary,var(--dsw-alias-label-secondary));margin:0;font-size:12px;font-weight:500;line-height:1.5}
 .cc-badgeWarn{background:var(--dsw-alias-state-warning-secondary,var(--dsw-alias-bg-module-platform));color:var(--dsw-alias-state-warning-primary,var(--dsw-alias-label-secondary))}
 `;
@@ -2063,10 +2695,14 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			controller.subscribe(() => store.set(controller.state()));
 			let usageNamespace;
 			let usageMountError;
+			const contribution = {
+				package: USAGE_REMOTE_CONTRIBUTION.package,
+				descriptors: [...USAGE_REMOTE_CONTRIBUTION.descriptors, ...LOGIN_REMOTE_CONTRIBUTION.descriptors]
+			};
 			ctx.effect(() => {
 				let cancelled = false;
 				let unmount;
-				ctx.remote.$mount(USAGE_REMOTE_CONTRIBUTION).then((dispose) => {
+				ctx.remote.$mount(contribution).then((dispose) => {
 					if (cancelled) {
 						dispose();
 						return;
@@ -2098,10 +2734,47 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			ctx.effect(() => () => usageController.dispose(), "dsh-commandcode-provider: usage controller");
 			const usageStore = (0, _deepseek_ai_dsh_client_runtime_client.createSnapshotStore)(usageController.state());
 			usageController.subscribe(() => usageStore.set(usageController.state()));
+			const loginRemote = {
+				loginBegin: async () => {
+					if (usageNamespace === void 0) return {
+						ok: false,
+						error: { message: usageMountError ?? "commandcode remote is not mounted" }
+					};
+					return usageNamespace.loginBegin();
+				},
+				loginStatus: async () => {
+					if (usageNamespace === void 0) return {
+						ok: false,
+						error: { message: usageMountError ?? "commandcode remote is not mounted" }
+					};
+					return usageNamespace.loginStatus();
+				},
+				loginCancel: async () => {
+					if (usageNamespace === void 0) return {
+						ok: false,
+						error: { message: usageMountError ?? "commandcode remote is not mounted" }
+					};
+					return usageNamespace.loginCancel();
+				}
+			};
+			const loginController = new CommandCodeLoginController(() => loginRemote);
+			ctx.effect(() => () => loginController.dispose(), "dsh-commandcode-provider: login controller");
+			const loginStore = (0, _deepseek_ai_dsh_client_runtime_client.createSnapshotStore)(loginController.state());
+			let lastLoginPhase = loginController.state().phase;
+			loginController.subscribe(() => {
+				const phase = loginController.state().phase;
+				if (phase === "success" && lastLoginPhase !== "success") {
+					controller.refreshCredentials();
+					usageController.refresh();
+				}
+				lastLoginPhase = phase;
+				loginStore.set(loginController.state());
+			});
 			const injected = () => ({
 				hooks: {
 					commandCodeSettings: store,
-					commandCodeUsage: usageStore
+					commandCodeUsage: usageStore,
+					commandCodeLogin: loginStore
 				},
 				edit: (field, text) => controller.edit(field, text),
 				resetField: (field) => controller.resetField(field),
@@ -2111,6 +2784,8 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 				}),
 				discard: () => controller.discard(),
 				refreshUsage: () => void usageController.refresh(),
+				beginLogin: () => void loginController.begin(),
+				cancelLogin: () => void loginController.cancel(),
 				addAccount: () => controller.addAccount(),
 				removeAccount: (id) => controller.removeAccount(id),
 				editAccountLabel: (id, text) => controller.editAccountLabel(id, text),