@morehao/dsh-github-trending 0.7.10 → 0.8.0

package/lib/internal.d.ts

@@ -17,7 +17,7 @@ import { Updater, PluginMeta, Logger } from '@morehao/dsh-plugin-kit/update';
  */
 
 /** 插件在核心之外新增的码。前缀统一避免与核心码冲突。 */
-declare const PLUGIN_CODES: readonly ["CORE_UNAVAILABLE", "CORE_INCOMPATIBLE", "CORE_SPAWN_FAILED", "CORE_TIMEOUT", "CORE_CANCELLED", "CORE_CONFIG_CHANNEL_FAILED", "CORE_NOT_DOWNLOADED", "CORE_CHECKSUM_MISMATCH", "IPC_INVALID", "MODEL_KEY_MISSING", "MODEL_NOT_FOUND", "MODEL_PROVIDER_UNSUPPORTED", "GITHUB_AUTH", "PUSH_FAILED", "REPO_DIRTY", "SUBSCRIBE_FAILED"];
+declare const PLUGIN_CODES: readonly ["CORE_UNAVAILABLE", "CORE_INCOMPATIBLE", "CORE_SPAWN_FAILED", "CORE_TIMEOUT", "CORE_CANCELLED", "CORE_CONFIG_CHANNEL_FAILED", "CORE_NOT_DOWNLOADED", "CORE_CHECKSUM_MISMATCH", "IPC_INVALID", "MODEL_KEY_MISSING", "MODEL_NOT_FOUND", "MODEL_PROVIDER_UNSUPPORTED", "GITHUB_AUTH", "GITHUB_AUTH_CANCELLED", "GITHUB_AUTH_EXPIRED", "GITHUB_AUTH_STATE", "GITHUB_AUTH_EXCHANGE", "GITHUB_AUTH_UNAVAILABLE", "PUSH_FAILED", "REPO_DIRTY", "SUBSCRIBE_FAILED"];
 type PluginCode = (typeof PLUGIN_CODES)[number];
 type AnyCode = ErrorCode | PluginCode;
 interface ClassifiedError {
@@ -211,8 +211,11 @@ declare namespace ipc {
 
 type Provider = string;
 type CommitMode = 'branch' | 'direct';
-/** 只保留两种真正可用的方式：本机 `gh` 登录态、手动 PAT。历史的 `device` 在归一化时迁移为 `gh`。 */
-type AuthMode = 'pat' | 'gh';
+/**
+ * 三种可用方式：本机 `gh` 登录态、手动 PAT、浏览器 GitHub 登录（读核心凭据记录）。
+ * 历史的 `device` 在归一化时迁移为 `gh`；`browser` 无记录时会降级到 ref/env 兜底。
+ */
+type AuthMode = 'pat' | 'gh' | 'browser';
 /**
  * 榜单周期（core 0.4.0 的 `--period` 三取值）。
  * `trending.since` 复用同一枚举：单次运行「抓取窗口 = 标注周期」由核心保证
@@ -1084,16 +1087,27 @@ interface ResolvedSecret {
     value?: string;
     source?: string;
 }
+interface CredentialRecord {
+    kind: string;
+    payload: unknown;
+}
 interface CredentialServices {
     describe?: (ref: string) => Promise<CredentialDescription> | CredentialDescription;
     resolve?: (ref: string) => Promise<ResolvedSecret | undefined | null> | ResolvedSecret | undefined | null;
     set?: (ref: string, value: string) => Promise<unknown> | unknown;
+    /**
+     * record 半边（`<scope>/<id>` 键）：只读，用于 `authMode=browser` 读 GitHub 登录记录。
+     * 由核心 `dsh-credentials-local` 的同一对象提供（与 ref 半边并存）；缺失时 browser 模式退回 ref/env。
+     */
+    readRecord?: (key: string) => Promise<CredentialRecord | undefined> | CredentialRecord | undefined;
 }
+/** 浏览器登录写入核心凭据记录的键（与核心 `@deepseek-ai/dsh-github-auth` 提案同名同构）。 */
+declare const GITHUB_RECORD_KEY$1 = "github/default";
 declare function credentialServices(get: (name: string) => unknown): CredentialServices | undefined;
 declare function describeRef(services: CredentialServices | undefined, ref: string, env?: NodeJS.ProcessEnv): Promise<CredentialDescription>;
 declare function resolveRef(services: CredentialServices | undefined, ref: string, env?: NodeJS.ProcessEnv): Promise<ResolvedSecret>;
-/** GitHub token：按 authMode 取，`gh` 模式读本机 gh 的登录态，`pat` 读凭据/环境变量。 */
-declare function resolveGithubToken(services: CredentialServices | undefined, authMode: 'pat' | 'gh', tokenRef: string, deps?: {
+/** GitHub token：按 authMode 取，`gh` 读本机 gh 登录态，`browser` 读核心凭据记录，`pat` 读 ref/env。 */
+declare function resolveGithubToken(services: CredentialServices | undefined, authMode: 'pat' | 'gh' | 'browser', tokenRef: string, deps?: {
     env?: NodeJS.ProcessEnv;
     execGh?: () => Promise<string | undefined>;
     freshGh?: boolean;
@@ -1103,6 +1117,7 @@ declare function resolveGithubToken(services: CredentialServices | undefined, au
 }>;
 
 type credentials_CredentialDescription = CredentialDescription;
+type credentials_CredentialRecord = CredentialRecord;
 type credentials_CredentialServices = CredentialServices;
 type credentials_ResolvedSecret = ResolvedSecret;
 declare const credentials_credentialServices: typeof credentialServices;
@@ -1110,7 +1125,7 @@ declare const credentials_describeRef: typeof describeRef;
 declare const credentials_resolveGithubToken: typeof resolveGithubToken;
 declare const credentials_resolveRef: typeof resolveRef;
 declare namespace credentials {
-  export { type credentials_CredentialDescription as CredentialDescription, type credentials_CredentialServices as CredentialServices, type credentials_ResolvedSecret as ResolvedSecret, credentials_credentialServices as credentialServices, credentials_describeRef as describeRef, credentials_resolveGithubToken as resolveGithubToken, credentials_resolveRef as resolveRef };
+  export { type credentials_CredentialDescription as CredentialDescription, type credentials_CredentialRecord as CredentialRecord, type credentials_CredentialServices as CredentialServices, GITHUB_RECORD_KEY$1 as GITHUB_RECORD_KEY, type credentials_ResolvedSecret as ResolvedSecret, credentials_credentialServices as credentialServices, credentials_describeRef as describeRef, credentials_resolveGithubToken as resolveGithubToken, credentials_resolveRef as resolveRef };
 }
 
 /**
@@ -1130,7 +1145,7 @@ interface GithubProbeResult {
 }
 declare function probeGithubAuth(options: {
     credentials: CredentialServices | undefined;
-    authMode: 'pat' | 'gh';
+    authMode: 'pat' | 'gh' | 'browser';
     tokenRef: string;
     env?: NodeJS.ProcessEnv;
     fetchImpl?: typeof fetch;
@@ -1142,6 +1157,140 @@ declare namespace github {
   export { type github_GithubProbeResult as GithubProbeResult, github_probeGithubAuth as probeGithubAuth };
 }
 
+/** 与核心 `@deepseek-ai/dsh-github-auth` 提案保持同 key；迁移时消费端无需改。 */
+declare const GITHUB_RECORD_KEY = "github/default";
+/** 本地回调路径（带集成前缀，避免多 provider 撞 webServer 的 `(kind,path)` 唯一约束）。 */
+declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
+/** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
+declare const DEFAULT_SCOPE = "repo";
+interface AuthorizationFlow {
+    key: string;
+    label: string;
+    methods: Array<{
+        id: string;
+        label: string;
+    }>;
+    run: (session: AuthorizationSessionLike) => Promise<void> | void;
+}
+interface AuthorizationSessionLike {
+    method?: string;
+    signal?: AbortSignal;
+    notify?: (notice: {
+        message: string;
+        url?: string;
+        code?: string;
+    }) => void;
+    prompt?: (prompt: unknown) => Promise<unknown>;
+    commit?: (record: {
+        kind: 'grant';
+        payload: unknown;
+    }) => Promise<unknown>;
+}
+interface AuthorizationLike {
+    registerFlow?: (flow: AuthorizationFlow) => unknown;
+    begin?: (request: unknown) => Promise<{
+        status: 'authorized' | 'cancelled';
+    }>;
+    cancel?: (key: string) => void;
+}
+interface WebServerLike {
+    register?: (route: {
+        kind: 'exact';
+        path: string;
+        handler: (req: any, res: any) => void;
+    }) => () => void;
+    port?: number;
+    host?: string;
+}
+type FetchLike = typeof fetch;
+interface GithubAuthDeps {
+    get: (name: string) => unknown;
+    fetchImpl?: FetchLike;
+    logger?: (event: string, data?: Record<string, unknown>) => void;
+    /** 覆盖端点（测试用）；生产留空走 GitHub 官方。 */
+    endpoints?: {
+        authorize?: string;
+        accessToken?: string;
+        deviceCode?: string;
+        user?: string;
+    };
+    /** GitHub OAuth App 的 public client_id（无需 secret）。 */
+    clientId?: string;
+    scope?: string;
+    attemptTimeoutMs?: number;
+}
+type GithubAttemptPhase = 'idle' | 'waiting-browser' | 'waiting-device' | 'exchanging' | 'done' | 'error';
+interface GithubAttemptView {
+    phase: GithubAttemptPhase;
+    authorizeUrl?: string;
+    verificationUri?: string;
+    userCode?: string;
+    expiresAt?: number;
+    login?: string;
+    error?: string;
+}
+declare function attemptView(): GithubAttemptView;
+/** PKCE：返回 verifier 与 S256 challenge。 */
+declare function createPkce(): {
+    verifier: string;
+    challenge: string;
+};
+/** 常量时间比较 state（长度不等直接 false，避免 timingSafeEqual 抛错）。 */
+declare function verifyState(received: string, expected: string): boolean;
+/** 拼授权页 URL。 */
+declare function buildAuthorizeUrl(params: {
+    authorizeEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    challenge: string;
+}): string;
+interface GithubGrantPayload {
+    version: 1;
+    token: string;
+    login?: string;
+    tokenType?: string;
+    scope?: string;
+}
+/**
+ * 向 `ctx.authorization` 注册 GitHub flow（若核心没有该服务则降级 no-op）。
+ * 在 `apply()` 里调用一次。
+ */
+declare function registerGithubFlow(deps: GithubAuthDeps): void;
+/**
+ * 启动一次浏览器登录 attempt（进程内 `authorization.begin`，不阻塞请求）。
+ * @returns 当前 attempt 视图（含 authorizeUrl，供前端打开）。二次调用在已有进行中时抛错。
+ */
+declare function beginGithubSignIn(deps: GithubAuthDeps, method?: 'browser' | 'device'): Promise<GithubAttemptView>;
+/** 取消进行中的 attempt。 */
+declare function cancelGithubSignIn(deps: GithubAuthDeps): void;
+/** 仅测试用：清空内存 attempt。 */
+declare function resetAttemptForTest(): void;
+
+type githubAuth_AuthorizationFlow = AuthorizationFlow;
+type githubAuth_AuthorizationLike = AuthorizationLike;
+type githubAuth_AuthorizationSessionLike = AuthorizationSessionLike;
+declare const githubAuth_CALLBACK_PATH: typeof CALLBACK_PATH;
+declare const githubAuth_DEFAULT_SCOPE: typeof DEFAULT_SCOPE;
+declare const githubAuth_GITHUB_RECORD_KEY: typeof GITHUB_RECORD_KEY;
+type githubAuth_GithubAttemptPhase = GithubAttemptPhase;
+type githubAuth_GithubAttemptView = GithubAttemptView;
+type githubAuth_GithubAuthDeps = GithubAuthDeps;
+type githubAuth_GithubGrantPayload = GithubGrantPayload;
+type githubAuth_WebServerLike = WebServerLike;
+declare const githubAuth_attemptView: typeof attemptView;
+declare const githubAuth_beginGithubSignIn: typeof beginGithubSignIn;
+declare const githubAuth_buildAuthorizeUrl: typeof buildAuthorizeUrl;
+declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
+declare const githubAuth_createPkce: typeof createPkce;
+declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
+declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
+declare const githubAuth_verifyState: typeof verifyState;
+declare namespace githubAuth {
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_verifyState as verifyState };
+}
+
 interface DefaultBranchResult {
     branch?: string;
     /** `origin-head` = 远端默认分支；`head` = 本地当前分支兜底；`none` = 读不到。 */
@@ -1823,6 +1972,8 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
+    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时按钮会提示未配置）。 */
+    githubClientId?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;
@@ -2145,4 +2296,4 @@ declare namespace tools {
   export { tools_createTrendingHistoryTool as createTrendingHistoryTool, tools_createTrendingRunTool as createTrendingRunTool };
 }
 
-export { channel, config, core, credentials, errors, github, handshake$1 as handshake, importCli, ipc, locate, paths, pendingPr, pluginInfo, preflight, proxy, quickfill, release, repo, routes, run, runner, schedule, state, subscribe, tools, update as updateService, version };
+export { channel, config, core, credentials, errors, github, githubAuth, handshake$1 as handshake, importCli, ipc, locate, paths, pendingPr, pluginInfo, preflight, proxy, quickfill, release, repo, routes, run, runner, schedule, state, subscribe, tools, update as updateService, version };

package/lib/internal.js

@@ -4,6 +4,7 @@ import {
   core_exports,
   credentials_exports,
   errors_exports,
+  github_auth_exports,
   github_exports,
   handshake_exports,
   import_cli_exports,
@@ -26,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-YJ5GF3MW.js";
+} from "./chunk-6PVBPJXO.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";
@@ -38,6 +39,7 @@ export {
   errors_exports as errors,
   exec,
   github_exports as github,
+  github_auth_exports as githubAuth,
   handshake_exports as handshake,
   import_cli_exports as importCli,
   ipc_exports as ipc,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.7.10",
+  "version": "0.8.0",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",
@@ -23,6 +23,7 @@
     "cordis.patch.yml",
     "icon.svg",
     "README.md",
+    "README.en.md",
     "CHANGELOG.md",
     "LICENSE"
   ],