@morehao/dsh-github-trending 0.7.10 → 0.8.0

package/lib/{chunk-YJ5GF3MW.js → chunk-6PVBPJXO.js}

@@ -205,8 +205,8 @@ function normalizeSettings(input) {
       labels: strArray(pr.labels, DEFAULT_SETTINGS.pr.labels)
     },
     github: {
-      // 旧版本可能存 'device'：它没有对应实现，统一迁移到真正可用的「本机 gh」。
-      authMode: authMode === "pat" ? "pat" : "gh",
+      // 白名单三值：'pat' / 'gh' / 'browser'；其余（含旧版 'device'）统一迁移到真正可用的「本机 gh」。
+      authMode: authMode === "pat" || authMode === "browser" ? authMode : "gh",
       tokenRef: str(github.tokenRef, DEFAULT_SETTINGS.github.tokenRef).trim() || DEFAULT_SETTINGS.github.tokenRef
     },
     trending: {
@@ -784,6 +784,11 @@ var PLUGIN_CODES = [
   "MODEL_NOT_FOUND",
   "MODEL_PROVIDER_UNSUPPORTED",
   "GITHUB_AUTH",
+  "GITHUB_AUTH_CANCELLED",
+  "GITHUB_AUTH_EXPIRED",
+  "GITHUB_AUTH_STATE",
+  "GITHUB_AUTH_EXCHANGE",
+  "GITHUB_AUTH_UNAVAILABLE",
   "PUSH_FAILED",
   "REPO_DIRTY",
   "SUBSCRIBE_FAILED"
@@ -819,6 +824,11 @@ var RETRIABLE = {
   MODEL_NOT_FOUND: false,
   MODEL_PROVIDER_UNSUPPORTED: false,
   GITHUB_AUTH: false,
+  GITHUB_AUTH_CANCELLED: false,
+  GITHUB_AUTH_EXPIRED: true,
+  GITHUB_AUTH_STATE: false,
+  GITHUB_AUTH_EXCHANGE: true,
+  GITHUB_AUTH_UNAVAILABLE: false,
   PUSH_FAILED: true,
   SUBSCRIBE_FAILED: true
 };
@@ -829,7 +839,7 @@ function areaOf(code) {
   if (code.startsWith("CORE_") || code === "IPC_INVALID") return "core";
   if (code.startsWith("MODEL_")) return "model";
   if (code.startsWith("REPO_") || code === "GIT_NOT_INSTALLED" || code === "GIT_OPERATION_FAILED") return "repo";
-  if (code === "GITHUB_AUTH") return "auth";
+  if (code === "GITHUB_AUTH" || code.startsWith("GITHUB_AUTH_")) return "auth";
   return "run";
 }
 function reasonOf(code, message, details) {
@@ -899,6 +909,16 @@ function hintOf(code, message, reason) {
       return "\u4ED3\u5E93\u6709\u672A\u63D0\u4EA4\u6539\u52A8\uFF1A\u63D2\u4EF6\u4E0D stash\u3001\u4E0D reset\uFF0C\u8BF7\u5148\u5904\u7406\u3002";
     case "GITHUB_AUTH":
       return "GitHub \u8BA4\u8BC1\u5931\u6548\uFF1A\u91CD\u65B0\u8FDE\u63A5\u6216\u66F4\u65B0 PAT\uFF1B\u672C\u5730 commit \u4F1A\u4FDD\u7559\uFF0C\u53EF\u76F4\u63A5\u91CD\u8BD5\u3002";
+    case "GITHUB_AUTH_CANCELLED":
+      return "\u5DF2\u53D6\u6D88 GitHub \u767B\u5F55\uFF1A\u9700\u8981\u65F6\u5728\u8BBE\u7F6E\u9875\u91CD\u65B0\u70B9\u300C\u7528 GitHub \u767B\u5F55\u300D\u3002";
+    case "GITHUB_AUTH_EXPIRED":
+      return "GitHub \u767B\u5F55\u8D85\u65F6\uFF1A\u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u5373\u53EF\uFF08\u672A\u5199\u5165\u4EFB\u4F55\u51ED\u636E\uFF09\u3002";
+    case "GITHUB_AUTH_STATE":
+      return "GitHub \u56DE\u8C03\u6821\u9A8C\u5931\u8D25\uFF08state \u4E0D\u5339\u914D\u6216\u91CD\u590D\u56DE\u8C03\uFF09\uFF1A\u8FD9\u662F\u4E00\u6B21\u5F02\u5E38\u56DE\u8C03\uFF0C\u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u3002";
+    case "GITHUB_AUTH_EXCHANGE":
+      return "\u7528\u6388\u6743\u7801\u6362\u53D6 GitHub token \u5931\u8D25\uFF1A\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5\uFF1B\u82E5\u6301\u7EED\u5931\u8D25\uFF0C\u786E\u8BA4 OAuth App \u7684 client_id \u4E0E\u56DE\u8C03\u5730\u5740\u914D\u7F6E\u4E00\u81F4\u3002";
+    case "GITHUB_AUTH_UNAVAILABLE":
+      return "\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u6D4F\u89C8\u5668\u767B\u5F55\uFF08\u7F3A\u5C11 authorization \u670D\u52A1\uFF09\uFF1A\u6539\u7528\u300C\u672C\u673A gh\u300D\u6216 PAT \u65B9\u5F0F\u3002";
     case "NOT_MERGEABLE":
       return "PR \u65E0\u6CD5\u81EA\u52A8\u5408\u5E76\uFF08\u5E38\u89C1\u4E8E\u5206\u652F\u4FDD\u62A4\uFF09\uFF1APR \u5DF2\u4FDD\u7559\uFF0C\u9700\u4EBA\u5DE5\u5904\u7406\u3002";
     case "PUSH_FAILED":
@@ -1911,11 +1931,13 @@ async function detectCoexistence(ownPath, options = {}) {
 // src/host/credentials.ts
 var credentials_exports = {};
 __export(credentials_exports, {
+  GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY,
   credentialServices: () => credentialServices,
   describeRef: () => describeRef,
   resolveGithubToken: () => resolveGithubToken,
   resolveRef: () => resolveRef
 });
+var GITHUB_RECORD_KEY = "github/default";
 function credentialServices(get) {
   const service = get("credentials");
   return service !== void 0 && typeof service?.resolve === "function" ? service : void 0;
@@ -1951,8 +1973,27 @@ async function resolveRef(services, ref, env = process.env) {
   const envValue = fromEnv(ref, env);
   return envValue === void 0 ? {} : { value: envValue, source: "env" };
 }
+async function readGithubRecord(services) {
+  if (typeof services?.readRecord !== "function") return void 0;
+  try {
+    return await services.readRecord(GITHUB_RECORD_KEY) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function grantToken(record) {
+  if (record === void 0 || record.kind !== "grant") return void 0;
+  const payload = record.payload;
+  const token = payload?.token;
+  return typeof token === "string" && token.trim() !== "" ? token : void 0;
+}
 async function resolveGithubToken(services, authMode, tokenRef, deps = {}) {
   const env = deps.env ?? process.env;
+  if (authMode === "browser") {
+    const record = await readGithubRecord(services);
+    const token = grantToken(record);
+    if (token !== void 0) return { token, source: "github-browser" };
+  }
   if (authMode === "gh") {
     const execGh = deps.execGh ?? (() => defaultGhToken(deps.freshGh === true));
     try {
@@ -3442,7 +3483,7 @@ async function probeGithubAuth(options) {
       ok: false,
       code: "GITHUB_AUTH",
       source: resolved.source,
-      message: options.authMode === "gh" ? "\u6CA1\u6709\u53D6\u5230\u672C\u673A gh \u7684\u767B\u5F55\u6001\uFF1A\u5148\u5728\u7EC8\u7AEF\u6267\u884C `gh auth login`\u3002" : `\u6CA1\u6709\u53D6\u5230\u51ED\u636E\u300C${options.tokenRef}\u300D\uFF1A\u8BF7\u5728\u73AF\u5883\u53D8\u91CF\u6216\u51ED\u636E\u91CC\u914D\u7F6E\u4E00\u4E2A Personal Access Token\u3002`
+      message: options.authMode === "gh" ? "\u6CA1\u6709\u53D6\u5230\u672C\u673A gh \u7684\u767B\u5F55\u6001\uFF1A\u5148\u5728\u7EC8\u7AEF\u6267\u884C `gh auth login`\u3002" : options.authMode === "browser" ? "\u8FD8\u6CA1\u6709\u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55 GitHub\uFF1A\u5728\u8BBE\u7F6E\u9875\u70B9\u300C\u7528 GitHub \u767B\u5F55\u300D\u5B8C\u6210\u6388\u6743\u3002" : `\u6CA1\u6709\u53D6\u5230\u51ED\u636E\u300C${options.tokenRef}\u300D\uFF1A\u8BF7\u5728\u73AF\u5883\u53D8\u91CF\u6216\u51ED\u636E\u91CC\u914D\u7F6E\u4E00\u4E2A Personal Access Token\u3002`
     };
   }
   const doFetch = options.fetchImpl ?? fetch;
@@ -3485,6 +3526,363 @@ async function probeGithubAuth(options) {
   }
 }
 
+// src/host/github-auth.ts
+var github_auth_exports = {};
+__export(github_auth_exports, {
+  CALLBACK_PATH: () => CALLBACK_PATH,
+  DEFAULT_SCOPE: () => DEFAULT_SCOPE,
+  GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY2,
+  attemptView: () => attemptView,
+  beginGithubSignIn: () => beginGithubSignIn,
+  buildAuthorizeUrl: () => buildAuthorizeUrl,
+  cancelGithubSignIn: () => cancelGithubSignIn,
+  createPkce: () => createPkce,
+  registerGithubFlow: () => registerGithubFlow,
+  resetAttemptForTest: () => resetAttemptForTest,
+  verifyState: () => verifyState
+});
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var GITHUB_RECORD_KEY2 = "github/default";
+var CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
+var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var GITHUB_USER_URL = "https://api.github.com/user";
+var DEFAULT_SCOPE = "repo";
+var DEFAULT_ATTEMPT_TIMEOUT_MS = 10 * 60 * 1e3;
+var current;
+function attemptView() {
+  if (current === void 0) return { phase: "idle" };
+  const { controller: _c, done: _d, ...view } = current;
+  return view;
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createPkce() {
+  const verifier = base64url(randomBytes2(32));
+  const challenge = base64url(createHash3("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function verifyState(received, expected) {
+  const a = Buffer.from(received);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual2(a, b);
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL(params.authorizeEndpoint);
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("code_challenge", params.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+async function exchangeCode(fetchImpl, endpoint, params, signal) {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: params.clientId,
+      code: params.code,
+      code_verifier: params.verifier,
+      redirect_uri: params.redirectUri
+    }).toString(),
+    signal
+  });
+  if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
+  const body = await response.json();
+  if (typeof body.access_token !== "string" || body.access_token === "") {
+    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${typeof body.error === "string" ? `\uFF08${body.error}\uFF09` : ""}`);
+  }
+  return {
+    token: body.access_token,
+    ...typeof body.token_type === "string" ? { tokenType: body.token_type } : {},
+    ...typeof body.scope === "string" ? { scope: body.scope } : {}
+  };
+}
+async function fetchLogin(fetchImpl, endpoint, token, signal) {
+  try {
+    const response = await fetchImpl(endpoint, {
+      headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "dsh-github-trending" },
+      signal
+    });
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    return typeof body.login === "string" ? body.login : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function runBrowser(deps, session) {
+  const webServer = deps.get("webServer");
+  if (webServer === void 0 || typeof webServer.register !== "function") {
+    throw new Error("webServer \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u6D4F\u89C8\u5668\u767B\u5F55\u9700\u8981\u5B83\u627F\u8F7D OAuth \u56DE\u8C03");
+  }
+  const clientId = deps.clientId;
+  if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const endpoints = normalizeEndpoints(deps.endpoints);
+  const scope = deps.scope ?? DEFAULT_SCOPE;
+  const state = base64url(randomBytes2(32));
+  const { verifier, challenge } = createPkce();
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  codePromise.catch(() => void 0);
+  const dispose = webServer.register({
+    kind: "exact",
+    path: CALLBACK_PATH,
+    handler: (req, res) => {
+      let url;
+      try {
+        url = new URL(req.url ?? "/", "http://127.0.0.1");
+      } catch {
+        res.writeHead(400, { "cache-control": "no-store" }).end();
+        return;
+      }
+      const code = url.searchParams.get("code") ?? "";
+      const gotState = url.searchParams.get("state") ?? "";
+      const single = url.searchParams.getAll("state").length === 1 && url.searchParams.getAll("code").length === 1;
+      const bad = req.method !== "GET" || url.pathname !== CALLBACK_PATH || !single || code === "" || !verifyState(gotState, state);
+      if (bad) {
+        res.writeHead(400, { "cache-control": "no-store" }).end();
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end('<!doctype html><meta charset="utf-8"><title>GitHub</title><p>\u5DF2\u5B8C\u6210\u767B\u5F55\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002</p>');
+      resolveCode(code);
+    }
+  });
+  try {
+    const origin = localOrigin(webServer);
+    const redirectUri = `${origin}${CALLBACK_PATH}`;
+    const authorizeUrl = buildAuthorizeUrl({
+      authorizeEndpoint: endpoints.authorize,
+      clientId,
+      redirectUri,
+      scope,
+      state,
+      challenge
+    });
+    updateCurrent({ phase: "waiting-browser", authorizeUrl, expiresAt: Date.now() + attemptTimeout(deps) });
+    session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
+    const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
+    updateCurrent({ phase: "exchanging" });
+    const exchanged = await exchangeCode(fetchImpl, endpoints.accessToken, { clientId, code, verifier, redirectUri }, session.signal);
+    const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
+    const payload = {
+      version: 1,
+      token: exchanged.token,
+      ...login === void 0 ? {} : { login },
+      tokenType: exchanged.tokenType ?? "bearer",
+      scope: exchanged.scope ?? scope
+    };
+    if (typeof session.commit === "function") await session.commit({ kind: "grant", payload });
+    updateCurrent({ phase: "done", ...login === void 0 ? {} : { login } });
+  } finally {
+    dispose();
+  }
+}
+async function runDevice(deps, session) {
+  const clientId = deps.clientId;
+  if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const endpoints = normalizeEndpoints(deps.endpoints);
+  const scope = deps.scope ?? DEFAULT_SCOPE;
+  const startResponse = await fetchImpl(endpoints.deviceCode, {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: clientId, scope }).toString(),
+    signal: session.signal
+  });
+  if (!startResponse.ok) throw new Error(`GitHub device/code HTTP ${startResponse.status}`);
+  const start = await startResponse.json();
+  if (typeof start.device_code !== "string" || typeof start.user_code !== "string" || typeof start.verification_uri !== "string") {
+    throw new Error("GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574");
+  }
+  const deviceCode = start.device_code;
+  const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
+  const expiresInSec = typeof start.expires_in === "number" && start.expires_in > 0 ? start.expires_in : 900;
+  const deadline = Date.now() + expiresInSec * 1e3;
+  updateCurrent({
+    phase: "waiting-device",
+    verificationUri: start.verification_uri,
+    userCode: start.user_code,
+    expiresAt: deadline
+  });
+  session.notify?.({
+    message: "Enter this code on the verification page to finish signing in.",
+    url: start.verification_uri,
+    code: start.user_code
+  });
+  let waitMs = intervalSec * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(waitMs, session.signal);
+    const pollResponse = await fetchImpl(endpoints.accessToken, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: clientId,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }).toString(),
+      signal: session.signal
+    });
+    if (!pollResponse.ok) throw new Error(`GitHub access_token HTTP ${pollResponse.status}`);
+    const poll = await pollResponse.json();
+    if (typeof poll.access_token === "string" && poll.access_token !== "") {
+      updateCurrent({ phase: "exchanging" });
+      const login = await fetchLogin(fetchImpl, endpoints.user, poll.access_token, session.signal);
+      const payload = {
+        version: 1,
+        token: poll.access_token,
+        ...login === void 0 ? {} : { login },
+        tokenType: typeof poll.token_type === "string" ? poll.token_type : "bearer",
+        scope: typeof poll.scope === "string" ? poll.scope : scope
+      };
+      if (typeof session.commit === "function") await session.commit({ kind: "grant", payload });
+      updateCurrent({ phase: "done", ...login === void 0 ? {} : { login } });
+      return;
+    }
+    if (poll.error === "authorization_pending") continue;
+    if (poll.error === "slow_down") {
+      waitMs += (typeof poll.interval === "number" && poll.interval > 0 ? poll.interval : 5) * 1e3;
+      continue;
+    }
+    throw new Error(`GitHub device flow \u7EC8\u6B62\uFF1A${typeof poll.error === "string" ? poll.error : "unknown"}`);
+  }
+  throw new Error("GitHub device flow \u8D85\u65F6");
+}
+function registerGithubFlow(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0 || typeof authorization.registerFlow !== "function") {
+    deps.logger?.("auth.flow.skipped", { reason: "no-authorization-service" });
+    return;
+  }
+  authorization.registerFlow({
+    key: GITHUB_RECORD_KEY2,
+    label: "GitHub",
+    methods: [
+      { id: "browser", label: "Sign in with GitHub" },
+      { id: "device", label: "Use a device code" }
+    ],
+    run: (session) => session.method === "device" ? runDevice(deps, session) : runBrowser(deps, session)
+  });
+  deps.logger?.("auth.flow.registered", { key: GITHUB_RECORD_KEY2 });
+}
+async function beginGithubSignIn(deps, method = "browser") {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0 || typeof authorization.begin !== "function") {
+    throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C\u6D4F\u89C8\u5668\u767B\u5F55");
+  }
+  if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
+    throw new Error("already-in-flight");
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
+  const attempt = { phase: "idle", controller, done: Promise.resolve() };
+  current = attempt;
+  attempt.done = authorization.begin({
+    key: GITHUB_RECORD_KEY2,
+    method,
+    signal: controller.signal,
+    // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
+    interaction: {
+      notify: (notice) => {
+        if (notice.code !== void 0 && notice.url !== void 0) {
+          updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
+        } else if (notice.url !== void 0) {
+          updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
+        }
+      },
+      prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
+    }
+  }).then((outcome) => {
+    if (outcome.status === "cancelled") updateCurrent({ phase: "idle" });
+  }).catch((error) => {
+    updateCurrent({ phase: "error", error: error instanceof Error ? error.message : String(error) });
+  }).finally(() => clearTimeout(timer));
+  await Promise.resolve();
+  return attemptView();
+}
+function cancelGithubSignIn(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization !== void 0 && typeof authorization.cancel === "function") {
+    authorization.cancel(GITHUB_RECORD_KEY2);
+  }
+  if (current !== void 0) current.controller.abort();
+}
+function resetAttemptForTest() {
+  current = void 0;
+}
+function normalizeEndpoints(endpoints = {}) {
+  return {
+    authorize: endpoints?.authorize ?? AUTHORIZE_URL,
+    accessToken: endpoints?.accessToken ?? ACCESS_TOKEN_URL,
+    deviceCode: endpoints?.deviceCode ?? DEVICE_CODE_URL,
+    user: endpoints?.user ?? GITHUB_USER_URL
+  };
+}
+function attemptTimeout(deps) {
+  return typeof deps.attemptTimeoutMs === "number" && deps.attemptTimeoutMs > 0 ? deps.attemptTimeoutMs : DEFAULT_ATTEMPT_TIMEOUT_MS;
+}
+function localOrigin(webServer) {
+  const port = webServer.port;
+  if (typeof port !== "number" || port <= 0) throw new Error("webServer \u5C1A\u672A\u76D1\u542C\uFF0C\u65E0\u6CD5\u786E\u5B9A\u56DE\u8C03\u5730\u5740");
+  const host = typeof webServer.host === "string" && webServer.host !== "" ? webServer.host : "127.0.0.1";
+  const loopback = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
+  return `http://${loopback}:${port}`;
+}
+function withAbort(promise, signal, onAbort) {
+  if (signal === void 0) return promise;
+  if (signal.aborted) {
+    onAbort();
+    return Promise.reject(new Error("authorization cancelled"));
+  }
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      onAbort();
+      reject(new Error("authorization cancelled"));
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", abort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", abort);
+        reject(error);
+      }
+    );
+  });
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted === true) {
+      reject(new Error("authorization cancelled"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    }, ms);
+    const abort = () => {
+      clearTimeout(timer);
+      reject(new Error("authorization cancelled"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+  });
+}
+function updateCurrent(patch) {
+  if (current === void 0) return;
+  Object.assign(current, patch);
+}
+
 // src/host/import-cli.ts
 var import_cli_exports = {};
 __export(import_cli_exports, {
@@ -3532,7 +3930,7 @@ function scalar(raw) {
 }
 function parseSimpleYaml(text) {
   const root = {};
-  let current;
+  let current2;
   let currentIndent = -1;
   for (const rawLine of text.split("\n")) {
     const line = rawLine.replace(/\r$/, "");
@@ -3546,21 +3944,21 @@ function parseSimpleYaml(text) {
     if (rest.trim() === "") {
       const child = {};
       root[key] = child;
-      current = child;
+      current2 = child;
       currentIndent = indent;
       continue;
     }
     if (indent === 0) {
       root[key] = scalar(rest);
-      current = void 0;
+      current2 = void 0;
       currentIndent = -1;
       continue;
     }
-    if (current === void 0 || indent <= currentIndent) {
+    if (current2 === void 0 || indent <= currentIndent) {
       root[key] = scalar(rest);
       continue;
     }
-    current[key] = scalar(rest);
+    current2[key] = scalar(rest);
   }
   return root;
 }
@@ -3983,15 +4381,23 @@ import { PluginUpdateError } from "@morehao/dsh-plugin-kit/update";
 var ROUTE_PREFIX = "/api/morehao/github-trending";
 var HEADER = "x-dsh-github-trending";
 var MAX_BODY2 = 512 * 1024;
+function githubAuthDeps(deps) {
+  return {
+    get: deps.get,
+    ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
+    ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
+    ...deps.logger === void 0 ? {} : { logger: deps.logger }
+  };
+}
 function createRoutes(deps) {
   const logger = deps.logger;
-  let current = { method: "GET", pathname: "/" };
+  let current2 = { method: "GET", pathname: "/" };
   const handler = createRouteHandler({
     prefix: ROUTE_PREFIX,
     header: HEADER,
     maxBodyBytes: MAX_BODY2,
     dispatch: async ({ method, pathname, url, body }) => {
-      current = { method, pathname };
+      current2 = { method, pathname };
       return dispatch(method, pathname, url, body, deps);
     },
     // 错误码翻译留在插件侧（dispatcher 不做映射）：保持与原实现的响应形状逐字一致。
@@ -4011,7 +4417,7 @@ function createRoutes(deps) {
       }
       const code = error instanceof IpcError ? error.code : "INTERNAL";
       const message = redact(error instanceof Error ? error.message : String(error));
-      logger?.("route.error", { pathname: current.pathname, method: current.method, code, message });
+      logger?.("route.error", { pathname: current2.pathname, method: current2.method, code, message });
       const status = code === "CONFIG_INVALID" ? (
         // 「已有一次运行在进行中」是并发冲突而非参数错误：用 409，前端据此禁用按钮并提示。
         message.includes("\u8FD0\u884C\u5728\u8FDB\u884C\u4E2D") ? 409 : 400
@@ -4165,6 +4571,26 @@ async function dispatch(method, pathname, url, body, deps) {
     });
     return { github: probe };
   }
+  if (method === "POST" && pathname === "/github/browser/begin") {
+    const method2 = body.method === "device" ? "device" : "browser";
+    try {
+      const view = await beginGithubSignIn(githubAuthDeps(deps), method2);
+      return { attempt: view };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message === "already-in-flight") {
+        return { attempt: attemptView(), alreadyInFlight: true };
+      }
+      throw new IpcError("GITHUB_AUTH_UNAVAILABLE", redact(message));
+    }
+  }
+  if (method === "GET" && pathname === "/github/browser/status") {
+    return { attempt: attemptView() };
+  }
+  if (method === "POST" && pathname === "/github/browser/cancel") {
+    cancelGithubSignIn(githubAuthDeps(deps));
+    return { attempt: attemptView() };
+  }
   if (method === "GET" && pathname === "/quickfill") {
     const candidates = await listProviderCandidates({
       llm: llmServices(deps.get),
@@ -4293,7 +4719,11 @@ async function statePayload(deps, settings) {
     github: {
       authMode: settings.github.authMode,
       configured: github.token !== void 0,
-      source: github.source
+      source: github.source,
+      /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
+      attempt: attemptView(),
+      /** 是否配置了 browser 模式的 client_id（未配置时前端禁用「用 GitHub 登录」并给提示）。 */
+      browserAvailable: deps.githubClientId !== void 0 && deps.githubClientId !== ""
     }
   };
 }
@@ -4572,6 +5002,8 @@ export {
   readPluginInfo,
   plugin_info_exports,
   github_exports,
+  registerGithubFlow,
+  github_auth_exports,
   import_cli_exports,
   pending_pr_exports,
   preflight_exports,

package/lib/index.d.ts

@@ -24,6 +24,7 @@ declare const VERSION: string;
 declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
+    githubClientId?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -7,8 +7,9 @@ import {
   createTrendingHistoryTool,
   createTrendingRunTool,
   createUpdateService,
-  readPluginInfo
-} from "./chunk-YJ5GF3MW.js";
+  readPluginInfo,
+  registerGithubFlow
+} from "./chunk-6PVBPJXO.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -63,6 +64,11 @@ function apply(ctx, config = {}) {
     onError: (error) => ctx.logger?.warn?.(`[dsh-github-trending] \u5B9A\u65F6\u8FD0\u884C\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`)
   });
   const pluginInfo = readPluginInfo();
+  registerGithubFlow({
+    get,
+    logger: log,
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
+  });
   const update = createUpdateService({
     get,
     env,
@@ -83,6 +89,7 @@ function apply(ctx, config = {}) {
     version: VERSION,
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
+    ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
     logger: log
   });
   const register = () => {