@morehao/dsh-github-trending 0.7.11 → 0.8.1

package/README.md

@@ -55,6 +55,16 @@ GitHub 趋势榜的 **DeepSeek Harness 插件**：按日 / 周 / 月周期定时
 
 ![设置](docs/images/settings.png)
 
+### GitHub 认证
+
+认证分区支持三种方式（可随时切换）：
+
+- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token。走 OAuth PKCE + 本机回环回调（或设备码），token 由 DSH 凭据记录安全保存，不落 `settings.json`。插件内置了公开的 OAuth App client_id（client_id 属公开标识、非机密；纯 PKCE 不使用 client_secret），开箱即用。
+- **本机 gh**：复用你终端里 `gh auth login` 的登录态。
+- **PAT**：手工填 Personal Access Token（存到凭据引用 / 环境变量）。
+
+> 浏览器登录需要核心提供 `authorization` 服务；若当前核心版本不含该能力，「浏览器登录」会提示不可用并引导改用 gh / PAT。
+
 ### 订阅
 
 （可选）订阅一组仓库，每周把每个仓库当周新增的 Release 合成一段中文摘要，与榜单同分支、同 PR 一起提交；订阅列表随数据仓版本化，可审计、可复现。

package/client.js

@@ -123,7 +123,19 @@ var DICT = {
     "auth.mode": "方式",
     "auth.pat": "PAT",
     "auth.gh": "本机 gh",
+    "auth.browser": "浏览器登录",
     "auth.gh.hint": "使用本机 gh 登录态：终端执行 `gh auth login` 完成登录，再点「测试认证」。",
+    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。",
+    "auth.browser.signin": "用 GitHub 登录",
+    "auth.browser.waiting": "等待浏览器授权…",
+    "auth.browser.code": "在打开的页面输入验证码：",
+    "auth.browser.cancel": "取消",
+    "auth.browser.done": "已登录",
+    "auth.browser.device": "用设备码登录",
+    "auth.browser.unavailable": "当前环境未配置 GitHub OAuth client_id，浏览器登录不可用：请改用「本机 gh」或 PAT。",
+    "auth.browser.openHint": "若浏览器未自动打开，请手动打开发起授权，或复制链接：",
+    "auth.browser.copy": "复制链接",
+    "auth.browser.copied": "授权链接已复制",
     "auth.pat.hint": "在 GitHub → Settings → Developer settings 生成 Personal Access Token（勾选 public_repo），填到下方引用或环境变量。",
     "auth.tokenRef": "凭据引用",
     "auth.tokenRef.hint": "凭据引用名 / 环境变量名",
@@ -652,7 +664,19 @@ var DICT = {
     "auth.mode": "Mode",
     "auth.pat": "PAT",
     "auth.gh": "Local gh",
+    "auth.browser": "Browser login",
     "auth.gh.hint": "Uses your local gh login: run `gh auth login` in a terminal, then click Test authentication.",
+    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste.",
+    "auth.browser.signin": "Sign in with GitHub",
+    "auth.browser.waiting": "Waiting for browser authorization…",
+    "auth.browser.code": "Enter this code on the opened page:",
+    "auth.browser.cancel": "Cancel",
+    "auth.browser.done": "Signed in",
+    "auth.browser.device": "Use a device code",
+    "auth.browser.unavailable": "No GitHub OAuth client_id configured in this environment, so browser sign-in is unavailable: use Local gh or PAT instead.",
+    "auth.browser.openHint": "If the browser did not open, open the authorization page manually, or copy the link:",
+    "auth.browser.copy": "Copy link",
+    "auth.browser.copied": "Authorization link copied",
     "auth.pat.hint": "Create a Personal Access Token under GitHub → Settings → Developer settings (scope public_repo) and put it in the ref below or an env var.",
     "auth.tokenRef": "Credential ref",
     "auth.tokenRef.hint": "credential ref / env var name",
@@ -1851,6 +1875,23 @@ async function apiCall(method, path, body, options = {}) {
   }
   return json;
 }
+async function beginGithubSignIn(method = "browser") {
+  const payload = await apiCall("POST", "/github/browser/begin", { method });
+  return payload.attempt;
+}
+async function getGithubSignInStatus(signal) {
+  const payload = await apiCall(
+    "GET",
+    "/github/browser/status",
+    void 0,
+    signal === void 0 ? {} : { signal }
+  );
+  return payload.attempt;
+}
+async function cancelGithubSignIn() {
+  const payload = await apiCall("POST", "/github/browser/cancel", {});
+  return payload.attempt;
+}
 function releaseRunsOf(state) {
   if (state === null || state === void 0) return [];
   const root = Array.isArray(state.releaseRuns) ? state.releaseRuns : void 0;
@@ -2078,6 +2119,7 @@ function SettingsView(props) {
   const [branchLoading, setBranchLoading] = import_react.default.useState(false);
   const [testing, setTesting] = import_react.default.useState(false);
   const [githubTest, setGithubTest] = import_react.default.useState(null);
+  const [signIn, setSignIn] = import_react.default.useState({ phase: "idle" });
   const anyDirty = SECTIONS.some((id) => dirtySections[id]);
   const sectionEditable = section !== "source";
   import_react.default.useEffect(() => {
@@ -2205,6 +2247,52 @@ function SettingsView(props) {
       setTesting(false);
     }
   };
+  const startSignIn = async (method) => {
+    try {
+      const view = await beginGithubSignIn(method);
+      setSignIn(view);
+      if (view.phase === "waiting-browser" && view.authorizeUrl !== void 0) {
+        try {
+          window.open(view.authorizeUrl, "_blank", "noopener,noreferrer");
+        } catch {
+        }
+      }
+    } catch (error) {
+      notify("err", error instanceof Error ? error.message : String(error));
+    }
+  };
+  const cancelSignIn = async () => {
+    try {
+      setSignIn(await cancelGithubSignIn());
+    } catch (error) {
+      notify("err", error instanceof Error ? error.message : String(error));
+    }
+  };
+  const copyAuthorizeLink = () => {
+    if (signIn.authorizeUrl === void 0) return;
+    void navigator.clipboard?.writeText(signIn.authorizeUrl).then(() => notify("ok", t("auth.browser.copied")));
+  };
+  const signInActive = signIn.phase === "waiting-browser" || signIn.phase === "waiting-device" || signIn.phase === "exchanging";
+  import_react.default.useEffect(() => {
+    if (!signInActive) return void 0;
+    let alive = true;
+    const timer = setInterval(() => {
+      void getGithubSignInStatus().then((view) => {
+        if (!alive) return;
+        setSignIn(view);
+        if (view.phase === "done") {
+          setGithubTest(view.login === void 0 ? { ok: true } : { ok: true, login: view.login });
+          notify("ok", t("auth.browser.done"));
+          void store.refresh({ quiet: true });
+        }
+      }).catch(() => {
+      });
+    }, 1500);
+    return () => {
+      alive = false;
+      clearInterval(timer);
+    };
+  }, [signInActive]);
   const importCli = async () => {
     try {
       const result = await apiCall(
@@ -2243,6 +2331,8 @@ function SettingsView(props) {
   const branchText = branchLoading ? t("branch.loading") : branchInfo?.branch !== void 0 ? branchInfo.branch : draft.repo.baseBranch !== "" ? draft.repo.baseBranch : "—";
   const branchHint = branchInfo?.source === "origin-head" ? t("branch.fromOrigin") : branchInfo?.source === "head" ? t("branch.fromHead") : branchInfo?.message !== void 0 ? branchInfo.message : t("branch.readonlyHint");
   const isGh = draft.github.authMode === "gh";
+  const isBrowser = draft.github.authMode === "browser";
+  const browserAvailable = state.github.browserAvailable === true;
   const sections = [
     { id: "source", label: t("st.source") },
     { id: "model", label: t("st.model") },
@@ -2419,16 +2509,32 @@ function SettingsView(props) {
         value: draft.github.authMode,
         options: [
           { value: "gh", label: t("auth.gh") },
-          { value: "pat", label: t("auth.pat") }
+          { value: "pat", label: t("auth.pat") },
+          { value: "browser", label: t("auth.browser") }
         ],
         onChange: (value) => update((next) => {
-          next.github.authMode = value === "pat" ? "pat" : "gh";
+          next.github.authMode = value === "pat" ? "pat" : value === "browser" ? "browser" : "gh";
         })
       }),
       h(Pill, { kind: state.github.configured ? "ok" : "warn" }, state.github.configured ? `${t("auth.configured")} · ${state.github.source}` : t("auth.missing"))
     ),
-    h("p", { className: "dshgt-hint" }, isGh ? t("auth.gh.hint") : t("auth.pat.hint")),
-    isGh ? null : h(
+    h("p", { className: "dshgt-hint" }, isGh ? t("auth.gh.hint") : isBrowser ? t("auth.browser.hint") : t("auth.pat.hint")),
+    isGh ? null : isBrowser ? h(
+      Row,
+      { label: t("auth.status") },
+      browserAvailable ? h(
+        Btn,
+        {
+          small: true,
+          variant: "primary",
+          onClick: () => void startSignIn("browser"),
+          disabled: signInActive
+        },
+        signIn.phase === "done" && signIn.login !== void 0 ? `${t("auth.browser.done")} · @${signIn.login}` : signInActive ? t("auth.browser.waiting") : t("auth.browser.signin")
+      ) : h("span", { className: "dshgt-hint" }, t("auth.browser.unavailable")),
+      browserAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
+      signInActive ? h(Btn, { small: true, variant: "ghost", onClick: () => void cancelSignIn() }, t("auth.browser.cancel")) : null
+    ) : h(
       Row,
       { label: t("auth.tokenRef") },
       h(Input, { mono: true, width: 220, value: draft.github.tokenRef, placeholder: "GITHUB_TOKEN", onInput: (value) => update((next) => {
@@ -2436,6 +2542,19 @@ function SettingsView(props) {
       }) }),
       h("span", { className: "dshgt-hint" }, t("auth.tokenRef.hint"))
     ),
+    // 浏览器登录进行中的状态行：授权页链接（可复制）+ 设备码。
+    isBrowser && signIn.phase !== "idle" && signIn.phase !== "done" ? h(
+      "div",
+      { className: "dshgt-hint" },
+      signIn.authorizeUrl !== void 0 ? h(
+        "div",
+        { className: "dshgt-desc" },
+        h("span", null, t("auth.browser.openHint")),
+        " ",
+        h(Btn, { small: true, variant: "ghost", onClick: () => copyAuthorizeLink() }, t("auth.browser.copy"))
+      ) : null,
+      signIn.userCode !== void 0 ? h("div", { className: "dshgt-mono" }, `${t("auth.browser.code")} ${signIn.userCode}`) : null
+    ) : null,
     h(
       Row,
       { label: t("auth.test") },

package/lib/{chunk-YJ5GF3MW.js → chunk-LLTW4YHJ.js}

@@ -205,8 +205,8 @@ function normalizeSettings(input) {
       labels: strArray(pr.labels, DEFAULT_SETTINGS.pr.labels)
     },
     github: {
-      // 旧版本可能存 'device'：它没有对应实现，统一迁移到真正可用的「本机 gh」。
-      authMode: authMode === "pat" ? "pat" : "gh",
+      // 白名单三值：'pat' / 'gh' / 'browser'；其余（含旧版 'device'）统一迁移到真正可用的「本机 gh」。
+      authMode: authMode === "pat" || authMode === "browser" ? authMode : "gh",
       tokenRef: str(github.tokenRef, DEFAULT_SETTINGS.github.tokenRef).trim() || DEFAULT_SETTINGS.github.tokenRef
     },
     trending: {
@@ -784,6 +784,11 @@ var PLUGIN_CODES = [
   "MODEL_NOT_FOUND",
   "MODEL_PROVIDER_UNSUPPORTED",
   "GITHUB_AUTH",
+  "GITHUB_AUTH_CANCELLED",
+  "GITHUB_AUTH_EXPIRED",
+  "GITHUB_AUTH_STATE",
+  "GITHUB_AUTH_EXCHANGE",
+  "GITHUB_AUTH_UNAVAILABLE",
   "PUSH_FAILED",
   "REPO_DIRTY",
   "SUBSCRIBE_FAILED"
@@ -819,6 +824,11 @@ var RETRIABLE = {
   MODEL_NOT_FOUND: false,
   MODEL_PROVIDER_UNSUPPORTED: false,
   GITHUB_AUTH: false,
+  GITHUB_AUTH_CANCELLED: false,
+  GITHUB_AUTH_EXPIRED: true,
+  GITHUB_AUTH_STATE: false,
+  GITHUB_AUTH_EXCHANGE: true,
+  GITHUB_AUTH_UNAVAILABLE: false,
   PUSH_FAILED: true,
   SUBSCRIBE_FAILED: true
 };
@@ -829,7 +839,7 @@ function areaOf(code) {
   if (code.startsWith("CORE_") || code === "IPC_INVALID") return "core";
   if (code.startsWith("MODEL_")) return "model";
   if (code.startsWith("REPO_") || code === "GIT_NOT_INSTALLED" || code === "GIT_OPERATION_FAILED") return "repo";
-  if (code === "GITHUB_AUTH") return "auth";
+  if (code === "GITHUB_AUTH" || code.startsWith("GITHUB_AUTH_")) return "auth";
   return "run";
 }
 function reasonOf(code, message, details) {
@@ -899,6 +909,16 @@ function hintOf(code, message, reason) {
       return "\u4ED3\u5E93\u6709\u672A\u63D0\u4EA4\u6539\u52A8\uFF1A\u63D2\u4EF6\u4E0D stash\u3001\u4E0D reset\uFF0C\u8BF7\u5148\u5904\u7406\u3002";
     case "GITHUB_AUTH":
       return "GitHub \u8BA4\u8BC1\u5931\u6548\uFF1A\u91CD\u65B0\u8FDE\u63A5\u6216\u66F4\u65B0 PAT\uFF1B\u672C\u5730 commit \u4F1A\u4FDD\u7559\uFF0C\u53EF\u76F4\u63A5\u91CD\u8BD5\u3002";
+    case "GITHUB_AUTH_CANCELLED":
+      return "\u5DF2\u53D6\u6D88 GitHub \u767B\u5F55\uFF1A\u9700\u8981\u65F6\u5728\u8BBE\u7F6E\u9875\u91CD\u65B0\u70B9\u300C\u7528 GitHub \u767B\u5F55\u300D\u3002";
+    case "GITHUB_AUTH_EXPIRED":
+      return "GitHub \u767B\u5F55\u8D85\u65F6\uFF1A\u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u5373\u53EF\uFF08\u672A\u5199\u5165\u4EFB\u4F55\u51ED\u636E\uFF09\u3002";
+    case "GITHUB_AUTH_STATE":
+      return "GitHub \u56DE\u8C03\u6821\u9A8C\u5931\u8D25\uFF08state \u4E0D\u5339\u914D\u6216\u91CD\u590D\u56DE\u8C03\uFF09\uFF1A\u8FD9\u662F\u4E00\u6B21\u5F02\u5E38\u56DE\u8C03\uFF0C\u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u3002";
+    case "GITHUB_AUTH_EXCHANGE":
+      return "\u7528\u6388\u6743\u7801\u6362\u53D6 GitHub token \u5931\u8D25\uFF1A\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5\uFF1B\u82E5\u6301\u7EED\u5931\u8D25\uFF0C\u786E\u8BA4 OAuth App \u7684 client_id \u4E0E\u56DE\u8C03\u5730\u5740\u914D\u7F6E\u4E00\u81F4\u3002";
+    case "GITHUB_AUTH_UNAVAILABLE":
+      return "\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u6D4F\u89C8\u5668\u767B\u5F55\uFF08\u7F3A\u5C11 authorization \u670D\u52A1\uFF09\uFF1A\u6539\u7528\u300C\u672C\u673A gh\u300D\u6216 PAT \u65B9\u5F0F\u3002";
     case "NOT_MERGEABLE":
       return "PR \u65E0\u6CD5\u81EA\u52A8\u5408\u5E76\uFF08\u5E38\u89C1\u4E8E\u5206\u652F\u4FDD\u62A4\uFF09\uFF1APR \u5DF2\u4FDD\u7559\uFF0C\u9700\u4EBA\u5DE5\u5904\u7406\u3002";
     case "PUSH_FAILED":
@@ -1911,11 +1931,13 @@ async function detectCoexistence(ownPath, options = {}) {
 // src/host/credentials.ts
 var credentials_exports = {};
 __export(credentials_exports, {
+  GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY,
   credentialServices: () => credentialServices,
   describeRef: () => describeRef,
   resolveGithubToken: () => resolveGithubToken,
   resolveRef: () => resolveRef
 });
+var GITHUB_RECORD_KEY = "github/default";
 function credentialServices(get) {
   const service = get("credentials");
   return service !== void 0 && typeof service?.resolve === "function" ? service : void 0;
@@ -1951,8 +1973,27 @@ async function resolveRef(services, ref, env = process.env) {
   const envValue = fromEnv(ref, env);
   return envValue === void 0 ? {} : { value: envValue, source: "env" };
 }
+async function readGithubRecord(services) {
+  if (typeof services?.readRecord !== "function") return void 0;
+  try {
+    return await services.readRecord(GITHUB_RECORD_KEY) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function grantToken(record) {
+  if (record === void 0 || record.kind !== "grant") return void 0;
+  const payload = record.payload;
+  const token = payload?.token;
+  return typeof token === "string" && token.trim() !== "" ? token : void 0;
+}
 async function resolveGithubToken(services, authMode, tokenRef, deps = {}) {
   const env = deps.env ?? process.env;
+  if (authMode === "browser") {
+    const record = await readGithubRecord(services);
+    const token = grantToken(record);
+    if (token !== void 0) return { token, source: "github-browser" };
+  }
   if (authMode === "gh") {
     const execGh = deps.execGh ?? (() => defaultGhToken(deps.freshGh === true));
     try {
@@ -3442,7 +3483,7 @@ async function probeGithubAuth(options) {
       ok: false,
       code: "GITHUB_AUTH",
       source: resolved.source,
-      message: options.authMode === "gh" ? "\u6CA1\u6709\u53D6\u5230\u672C\u673A gh \u7684\u767B\u5F55\u6001\uFF1A\u5148\u5728\u7EC8\u7AEF\u6267\u884C `gh auth login`\u3002" : `\u6CA1\u6709\u53D6\u5230\u51ED\u636E\u300C${options.tokenRef}\u300D\uFF1A\u8BF7\u5728\u73AF\u5883\u53D8\u91CF\u6216\u51ED\u636E\u91CC\u914D\u7F6E\u4E00\u4E2A Personal Access Token\u3002`
+      message: options.authMode === "gh" ? "\u6CA1\u6709\u53D6\u5230\u672C\u673A gh \u7684\u767B\u5F55\u6001\uFF1A\u5148\u5728\u7EC8\u7AEF\u6267\u884C `gh auth login`\u3002" : options.authMode === "browser" ? "\u8FD8\u6CA1\u6709\u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55 GitHub\uFF1A\u5728\u8BBE\u7F6E\u9875\u70B9\u300C\u7528 GitHub \u767B\u5F55\u300D\u5B8C\u6210\u6388\u6743\u3002" : `\u6CA1\u6709\u53D6\u5230\u51ED\u636E\u300C${options.tokenRef}\u300D\uFF1A\u8BF7\u5728\u73AF\u5883\u53D8\u91CF\u6216\u51ED\u636E\u91CC\u914D\u7F6E\u4E00\u4E2A Personal Access Token\u3002`
     };
   }
   const doFetch = options.fetchImpl ?? fetch;
@@ -3485,6 +3526,370 @@ async function probeGithubAuth(options) {
   }
 }
 
+// src/host/github-auth.ts
+var github_auth_exports = {};
+__export(github_auth_exports, {
+  CALLBACK_PATH: () => CALLBACK_PATH,
+  DEFAULT_GITHUB_CLIENT_ID: () => DEFAULT_GITHUB_CLIENT_ID,
+  DEFAULT_SCOPE: () => DEFAULT_SCOPE,
+  GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY2,
+  attemptView: () => attemptView,
+  beginGithubSignIn: () => beginGithubSignIn,
+  buildAuthorizeUrl: () => buildAuthorizeUrl,
+  cancelGithubSignIn: () => cancelGithubSignIn,
+  createPkce: () => createPkce,
+  registerGithubFlow: () => registerGithubFlow,
+  resetAttemptForTest: () => resetAttemptForTest,
+  resolveClientId: () => resolveClientId,
+  verifyState: () => verifyState
+});
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var GITHUB_RECORD_KEY2 = "github/default";
+var CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
+var DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
+function resolveClientId(deps) {
+  const fromConfig = deps.clientId;
+  return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
+}
+var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var GITHUB_USER_URL = "https://api.github.com/user";
+var DEFAULT_SCOPE = "repo";
+var DEFAULT_ATTEMPT_TIMEOUT_MS = 10 * 60 * 1e3;
+var current;
+function attemptView() {
+  if (current === void 0) return { phase: "idle" };
+  const { controller: _c, done: _d, ...view } = current;
+  return view;
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createPkce() {
+  const verifier = base64url(randomBytes2(32));
+  const challenge = base64url(createHash3("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function verifyState(received, expected) {
+  const a = Buffer.from(received);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual2(a, b);
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL(params.authorizeEndpoint);
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("code_challenge", params.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+async function exchangeCode(fetchImpl, endpoint, params, signal) {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: params.clientId,
+      code: params.code,
+      code_verifier: params.verifier,
+      redirect_uri: params.redirectUri
+    }).toString(),
+    signal
+  });
+  if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
+  const body = await response.json();
+  if (typeof body.access_token !== "string" || body.access_token === "") {
+    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${typeof body.error === "string" ? `\uFF08${body.error}\uFF09` : ""}`);
+  }
+  return {
+    token: body.access_token,
+    ...typeof body.token_type === "string" ? { tokenType: body.token_type } : {},
+    ...typeof body.scope === "string" ? { scope: body.scope } : {}
+  };
+}
+async function fetchLogin(fetchImpl, endpoint, token, signal) {
+  try {
+    const response = await fetchImpl(endpoint, {
+      headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "dsh-github-trending" },
+      signal
+    });
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    return typeof body.login === "string" ? body.login : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function runBrowser(deps, session) {
+  const webServer = deps.get("webServer");
+  if (webServer === void 0 || typeof webServer.register !== "function") {
+    throw new Error("webServer \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u6D4F\u89C8\u5668\u767B\u5F55\u9700\u8981\u5B83\u627F\u8F7D OAuth \u56DE\u8C03");
+  }
+  const clientId = resolveClientId(deps);
+  if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const endpoints = normalizeEndpoints(deps.endpoints);
+  const scope = deps.scope ?? DEFAULT_SCOPE;
+  const state = base64url(randomBytes2(32));
+  const { verifier, challenge } = createPkce();
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  codePromise.catch(() => void 0);
+  const dispose = webServer.register({
+    kind: "exact",
+    path: CALLBACK_PATH,
+    handler: (req, res) => {
+      let url;
+      try {
+        url = new URL(req.url ?? "/", "http://127.0.0.1");
+      } catch {
+        res.writeHead(400, { "cache-control": "no-store" }).end();
+        return;
+      }
+      const code = url.searchParams.get("code") ?? "";
+      const gotState = url.searchParams.get("state") ?? "";
+      const single = url.searchParams.getAll("state").length === 1 && url.searchParams.getAll("code").length === 1;
+      const bad = req.method !== "GET" || url.pathname !== CALLBACK_PATH || !single || code === "" || !verifyState(gotState, state);
+      if (bad) {
+        res.writeHead(400, { "cache-control": "no-store" }).end();
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end('<!doctype html><meta charset="utf-8"><title>GitHub</title><p>\u5DF2\u5B8C\u6210\u767B\u5F55\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002</p>');
+      resolveCode(code);
+    }
+  });
+  try {
+    const origin = localOrigin(webServer);
+    const redirectUri = `${origin}${CALLBACK_PATH}`;
+    const authorizeUrl = buildAuthorizeUrl({
+      authorizeEndpoint: endpoints.authorize,
+      clientId,
+      redirectUri,
+      scope,
+      state,
+      challenge
+    });
+    updateCurrent({ phase: "waiting-browser", authorizeUrl, expiresAt: Date.now() + attemptTimeout(deps) });
+    session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
+    const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
+    updateCurrent({ phase: "exchanging" });
+    const exchanged = await exchangeCode(fetchImpl, endpoints.accessToken, { clientId, code, verifier, redirectUri }, session.signal);
+    const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
+    const payload = {
+      version: 1,
+      token: exchanged.token,
+      ...login === void 0 ? {} : { login },
+      tokenType: exchanged.tokenType ?? "bearer",
+      scope: exchanged.scope ?? scope
+    };
+    if (typeof session.commit === "function") await session.commit({ kind: "grant", payload });
+    updateCurrent({ phase: "done", ...login === void 0 ? {} : { login } });
+  } finally {
+    dispose();
+  }
+}
+async function runDevice(deps, session) {
+  const clientId = resolveClientId(deps);
+  if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const endpoints = normalizeEndpoints(deps.endpoints);
+  const scope = deps.scope ?? DEFAULT_SCOPE;
+  const startResponse = await fetchImpl(endpoints.deviceCode, {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: clientId, scope }).toString(),
+    signal: session.signal
+  });
+  if (!startResponse.ok) throw new Error(`GitHub device/code HTTP ${startResponse.status}`);
+  const start = await startResponse.json();
+  if (typeof start.device_code !== "string" || typeof start.user_code !== "string" || typeof start.verification_uri !== "string") {
+    throw new Error("GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574");
+  }
+  const deviceCode = start.device_code;
+  const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
+  const expiresInSec = typeof start.expires_in === "number" && start.expires_in > 0 ? start.expires_in : 900;
+  const deadline = Date.now() + expiresInSec * 1e3;
+  updateCurrent({
+    phase: "waiting-device",
+    verificationUri: start.verification_uri,
+    userCode: start.user_code,
+    expiresAt: deadline
+  });
+  session.notify?.({
+    message: "Enter this code on the verification page to finish signing in.",
+    url: start.verification_uri,
+    code: start.user_code
+  });
+  let waitMs = intervalSec * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(waitMs, session.signal);
+    const pollResponse = await fetchImpl(endpoints.accessToken, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: clientId,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }).toString(),
+      signal: session.signal
+    });
+    if (!pollResponse.ok) throw new Error(`GitHub access_token HTTP ${pollResponse.status}`);
+    const poll = await pollResponse.json();
+    if (typeof poll.access_token === "string" && poll.access_token !== "") {
+      updateCurrent({ phase: "exchanging" });
+      const login = await fetchLogin(fetchImpl, endpoints.user, poll.access_token, session.signal);
+      const payload = {
+        version: 1,
+        token: poll.access_token,
+        ...login === void 0 ? {} : { login },
+        tokenType: typeof poll.token_type === "string" ? poll.token_type : "bearer",
+        scope: typeof poll.scope === "string" ? poll.scope : scope
+      };
+      if (typeof session.commit === "function") await session.commit({ kind: "grant", payload });
+      updateCurrent({ phase: "done", ...login === void 0 ? {} : { login } });
+      return;
+    }
+    if (poll.error === "authorization_pending") continue;
+    if (poll.error === "slow_down") {
+      waitMs += (typeof poll.interval === "number" && poll.interval > 0 ? poll.interval : 5) * 1e3;
+      continue;
+    }
+    throw new Error(`GitHub device flow \u7EC8\u6B62\uFF1A${typeof poll.error === "string" ? poll.error : "unknown"}`);
+  }
+  throw new Error("GitHub device flow \u8D85\u65F6");
+}
+function registerGithubFlow(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0 || typeof authorization.registerFlow !== "function") {
+    deps.logger?.("auth.flow.skipped", { reason: "no-authorization-service" });
+    return;
+  }
+  authorization.registerFlow({
+    key: GITHUB_RECORD_KEY2,
+    label: "GitHub",
+    methods: [
+      { id: "browser", label: "Sign in with GitHub" },
+      { id: "device", label: "Use a device code" }
+    ],
+    run: (session) => session.method === "device" ? runDevice(deps, session) : runBrowser(deps, session)
+  });
+  deps.logger?.("auth.flow.registered", { key: GITHUB_RECORD_KEY2 });
+}
+async function beginGithubSignIn(deps, method = "browser") {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0 || typeof authorization.begin !== "function") {
+    throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C\u6D4F\u89C8\u5668\u767B\u5F55");
+  }
+  if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
+    throw new Error("already-in-flight");
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
+  const attempt = { phase: "idle", controller, done: Promise.resolve() };
+  current = attempt;
+  attempt.done = authorization.begin({
+    key: GITHUB_RECORD_KEY2,
+    method,
+    signal: controller.signal,
+    // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
+    interaction: {
+      notify: (notice) => {
+        if (notice.code !== void 0 && notice.url !== void 0) {
+          updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
+        } else if (notice.url !== void 0) {
+          updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
+        }
+      },
+      prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
+    }
+  }).then((outcome) => {
+    if (outcome.status === "cancelled") updateCurrent({ phase: "idle" });
+  }).catch((error) => {
+    updateCurrent({ phase: "error", error: error instanceof Error ? error.message : String(error) });
+  }).finally(() => clearTimeout(timer));
+  await Promise.resolve();
+  return attemptView();
+}
+function cancelGithubSignIn(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization !== void 0 && typeof authorization.cancel === "function") {
+    authorization.cancel(GITHUB_RECORD_KEY2);
+  }
+  if (current !== void 0) current.controller.abort();
+}
+function resetAttemptForTest() {
+  current = void 0;
+}
+function normalizeEndpoints(endpoints = {}) {
+  return {
+    authorize: endpoints?.authorize ?? AUTHORIZE_URL,
+    accessToken: endpoints?.accessToken ?? ACCESS_TOKEN_URL,
+    deviceCode: endpoints?.deviceCode ?? DEVICE_CODE_URL,
+    user: endpoints?.user ?? GITHUB_USER_URL
+  };
+}
+function attemptTimeout(deps) {
+  return typeof deps.attemptTimeoutMs === "number" && deps.attemptTimeoutMs > 0 ? deps.attemptTimeoutMs : DEFAULT_ATTEMPT_TIMEOUT_MS;
+}
+function localOrigin(webServer) {
+  const port = webServer.port;
+  if (typeof port !== "number" || port <= 0) throw new Error("webServer \u5C1A\u672A\u76D1\u542C\uFF0C\u65E0\u6CD5\u786E\u5B9A\u56DE\u8C03\u5730\u5740");
+  const host = typeof webServer.host === "string" && webServer.host !== "" ? webServer.host : "127.0.0.1";
+  const loopback = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
+  return `http://${loopback}:${port}`;
+}
+function withAbort(promise, signal, onAbort) {
+  if (signal === void 0) return promise;
+  if (signal.aborted) {
+    onAbort();
+    return Promise.reject(new Error("authorization cancelled"));
+  }
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      onAbort();
+      reject(new Error("authorization cancelled"));
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", abort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", abort);
+        reject(error);
+      }
+    );
+  });
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted === true) {
+      reject(new Error("authorization cancelled"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    }, ms);
+    const abort = () => {
+      clearTimeout(timer);
+      reject(new Error("authorization cancelled"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+  });
+}
+function updateCurrent(patch) {
+  if (current === void 0) return;
+  Object.assign(current, patch);
+}
+
 // src/host/import-cli.ts
 var import_cli_exports = {};
 __export(import_cli_exports, {
@@ -3532,7 +3937,7 @@ function scalar(raw) {
 }
 function parseSimpleYaml(text) {
   const root = {};
-  let current;
+  let current2;
   let currentIndent = -1;
   for (const rawLine of text.split("\n")) {
     const line = rawLine.replace(/\r$/, "");
@@ -3546,21 +3951,21 @@ function parseSimpleYaml(text) {
     if (rest.trim() === "") {
       const child = {};
       root[key] = child;
-      current = child;
+      current2 = child;
       currentIndent = indent;
       continue;
     }
     if (indent === 0) {
       root[key] = scalar(rest);
-      current = void 0;
+      current2 = void 0;
       currentIndent = -1;
       continue;
     }
-    if (current === void 0 || indent <= currentIndent) {
+    if (current2 === void 0 || indent <= currentIndent) {
       root[key] = scalar(rest);
       continue;
     }
-    current[key] = scalar(rest);
+    current2[key] = scalar(rest);
   }
   return root;
 }
@@ -3983,15 +4388,27 @@ import { PluginUpdateError } from "@morehao/dsh-plugin-kit/update";
 var ROUTE_PREFIX = "/api/morehao/github-trending";
 var HEADER = "x-dsh-github-trending";
 var MAX_BODY2 = 512 * 1024;
+function isAuthorizationAvailable(get) {
+  const authorization = get("authorization");
+  return authorization !== void 0 && typeof authorization.begin === "function";
+}
+function githubAuthDeps(deps) {
+  return {
+    get: deps.get,
+    ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
+    ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
+    ...deps.logger === void 0 ? {} : { logger: deps.logger }
+  };
+}
 function createRoutes(deps) {
   const logger = deps.logger;
-  let current = { method: "GET", pathname: "/" };
+  let current2 = { method: "GET", pathname: "/" };
   const handler = createRouteHandler({
     prefix: ROUTE_PREFIX,
     header: HEADER,
     maxBodyBytes: MAX_BODY2,
     dispatch: async ({ method, pathname, url, body }) => {
-      current = { method, pathname };
+      current2 = { method, pathname };
       return dispatch(method, pathname, url, body, deps);
     },
     // 错误码翻译留在插件侧（dispatcher 不做映射）：保持与原实现的响应形状逐字一致。
@@ -4011,7 +4428,7 @@ function createRoutes(deps) {
       }
       const code = error instanceof IpcError ? error.code : "INTERNAL";
       const message = redact(error instanceof Error ? error.message : String(error));
-      logger?.("route.error", { pathname: current.pathname, method: current.method, code, message });
+      logger?.("route.error", { pathname: current2.pathname, method: current2.method, code, message });
       const status = code === "CONFIG_INVALID" ? (
         // 「已有一次运行在进行中」是并发冲突而非参数错误：用 409，前端据此禁用按钮并提示。
         message.includes("\u8FD0\u884C\u5728\u8FDB\u884C\u4E2D") ? 409 : 400
@@ -4165,6 +4582,26 @@ async function dispatch(method, pathname, url, body, deps) {
     });
     return { github: probe };
   }
+  if (method === "POST" && pathname === "/github/browser/begin") {
+    const method2 = body.method === "device" ? "device" : "browser";
+    try {
+      const view = await beginGithubSignIn(githubAuthDeps(deps), method2);
+      return { attempt: view };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message === "already-in-flight") {
+        return { attempt: attemptView(), alreadyInFlight: true };
+      }
+      throw new IpcError("GITHUB_AUTH_UNAVAILABLE", redact(message));
+    }
+  }
+  if (method === "GET" && pathname === "/github/browser/status") {
+    return { attempt: attemptView() };
+  }
+  if (method === "POST" && pathname === "/github/browser/cancel") {
+    cancelGithubSignIn(githubAuthDeps(deps));
+    return { attempt: attemptView() };
+  }
   if (method === "GET" && pathname === "/quickfill") {
     const candidates = await listProviderCandidates({
       llm: llmServices(deps.get),
@@ -4293,7 +4730,11 @@ async function statePayload(deps, settings) {
     github: {
       authMode: settings.github.authMode,
       configured: github.token !== void 0,
-      source: github.source
+      source: github.source,
+      /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
+      attempt: attemptView(),
+      /** 浏览器登录是否可用：核心提供了 authorization 服务即可（client_id 有内置默认）。 */
+      browserAvailable: isAuthorizationAvailable(deps.get)
     }
   };
 }
@@ -4572,6 +5013,8 @@ export {
   readPluginInfo,
   plugin_info_exports,
   github_exports,
+  registerGithubFlow,
+  github_auth_exports,
   import_cli_exports,
   pending_pr_exports,
   preflight_exports,

package/lib/index.d.ts

@@ -24,6 +24,7 @@ declare const VERSION: string;
 declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
+    githubClientId?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -7,8 +7,9 @@ import {
   createTrendingHistoryTool,
   createTrendingRunTool,
   createUpdateService,
-  readPluginInfo
-} from "./chunk-YJ5GF3MW.js";
+  readPluginInfo,
+  registerGithubFlow
+} from "./chunk-LLTW4YHJ.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -63,6 +64,11 @@ function apply(ctx, config = {}) {
     onError: (error) => ctx.logger?.warn?.(`[dsh-github-trending] \u5B9A\u65F6\u8FD0\u884C\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`)
   });
   const pluginInfo = readPluginInfo();
+  registerGithubFlow({
+    get,
+    logger: log,
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
+  });
   const update = createUpdateService({
     get,
     env,
@@ -83,6 +89,7 @@ function apply(ctx, config = {}) {
     version: VERSION,
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
+    ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
     logger: log
   });
   const register = () => {

package/lib/internal.d.ts

@@ -17,7 +17,7 @@ import { Updater, PluginMeta, Logger } from '@morehao/dsh-plugin-kit/update';
  */
 
 /** 插件在核心之外新增的码。前缀统一避免与核心码冲突。 */
-declare const PLUGIN_CODES: readonly ["CORE_UNAVAILABLE", "CORE_INCOMPATIBLE", "CORE_SPAWN_FAILED", "CORE_TIMEOUT", "CORE_CANCELLED", "CORE_CONFIG_CHANNEL_FAILED", "CORE_NOT_DOWNLOADED", "CORE_CHECKSUM_MISMATCH", "IPC_INVALID", "MODEL_KEY_MISSING", "MODEL_NOT_FOUND", "MODEL_PROVIDER_UNSUPPORTED", "GITHUB_AUTH", "PUSH_FAILED", "REPO_DIRTY", "SUBSCRIBE_FAILED"];
+declare const PLUGIN_CODES: readonly ["CORE_UNAVAILABLE", "CORE_INCOMPATIBLE", "CORE_SPAWN_FAILED", "CORE_TIMEOUT", "CORE_CANCELLED", "CORE_CONFIG_CHANNEL_FAILED", "CORE_NOT_DOWNLOADED", "CORE_CHECKSUM_MISMATCH", "IPC_INVALID", "MODEL_KEY_MISSING", "MODEL_NOT_FOUND", "MODEL_PROVIDER_UNSUPPORTED", "GITHUB_AUTH", "GITHUB_AUTH_CANCELLED", "GITHUB_AUTH_EXPIRED", "GITHUB_AUTH_STATE", "GITHUB_AUTH_EXCHANGE", "GITHUB_AUTH_UNAVAILABLE", "PUSH_FAILED", "REPO_DIRTY", "SUBSCRIBE_FAILED"];
 type PluginCode = (typeof PLUGIN_CODES)[number];
 type AnyCode = ErrorCode | PluginCode;
 interface ClassifiedError {
@@ -211,8 +211,11 @@ declare namespace ipc {
 
 type Provider = string;
 type CommitMode = 'branch' | 'direct';
-/** 只保留两种真正可用的方式：本机 `gh` 登录态、手动 PAT。历史的 `device` 在归一化时迁移为 `gh`。 */
-type AuthMode = 'pat' | 'gh';
+/**
+ * 三种可用方式：本机 `gh` 登录态、手动 PAT、浏览器 GitHub 登录（读核心凭据记录）。
+ * 历史的 `device` 在归一化时迁移为 `gh`；`browser` 无记录时会降级到 ref/env 兜底。
+ */
+type AuthMode = 'pat' | 'gh' | 'browser';
 /**
  * 榜单周期（core 0.4.0 的 `--period` 三取值）。
  * `trending.since` 复用同一枚举：单次运行「抓取窗口 = 标注周期」由核心保证
@@ -1084,16 +1087,27 @@ interface ResolvedSecret {
     value?: string;
     source?: string;
 }
+interface CredentialRecord {
+    kind: string;
+    payload: unknown;
+}
 interface CredentialServices {
     describe?: (ref: string) => Promise<CredentialDescription> | CredentialDescription;
     resolve?: (ref: string) => Promise<ResolvedSecret | undefined | null> | ResolvedSecret | undefined | null;
     set?: (ref: string, value: string) => Promise<unknown> | unknown;
+    /**
+     * record 半边（`<scope>/<id>` 键）：只读，用于 `authMode=browser` 读 GitHub 登录记录。
+     * 由核心 `dsh-credentials-local` 的同一对象提供（与 ref 半边并存）；缺失时 browser 模式退回 ref/env。
+     */
+    readRecord?: (key: string) => Promise<CredentialRecord | undefined> | CredentialRecord | undefined;
 }
+/** 浏览器登录写入核心凭据记录的键（与核心 `@deepseek-ai/dsh-github-auth` 提案同名同构）。 */
+declare const GITHUB_RECORD_KEY$1 = "github/default";
 declare function credentialServices(get: (name: string) => unknown): CredentialServices | undefined;
 declare function describeRef(services: CredentialServices | undefined, ref: string, env?: NodeJS.ProcessEnv): Promise<CredentialDescription>;
 declare function resolveRef(services: CredentialServices | undefined, ref: string, env?: NodeJS.ProcessEnv): Promise<ResolvedSecret>;
-/** GitHub token：按 authMode 取，`gh` 模式读本机 gh 的登录态，`pat` 读凭据/环境变量。 */
-declare function resolveGithubToken(services: CredentialServices | undefined, authMode: 'pat' | 'gh', tokenRef: string, deps?: {
+/** GitHub token：按 authMode 取，`gh` 读本机 gh 登录态，`browser` 读核心凭据记录，`pat` 读 ref/env。 */
+declare function resolveGithubToken(services: CredentialServices | undefined, authMode: 'pat' | 'gh' | 'browser', tokenRef: string, deps?: {
     env?: NodeJS.ProcessEnv;
     execGh?: () => Promise<string | undefined>;
     freshGh?: boolean;
@@ -1103,6 +1117,7 @@ declare function resolveGithubToken(services: CredentialServices | undefined, au
 }>;
 
 type credentials_CredentialDescription = CredentialDescription;
+type credentials_CredentialRecord = CredentialRecord;
 type credentials_CredentialServices = CredentialServices;
 type credentials_ResolvedSecret = ResolvedSecret;
 declare const credentials_credentialServices: typeof credentialServices;
@@ -1110,7 +1125,7 @@ declare const credentials_describeRef: typeof describeRef;
 declare const credentials_resolveGithubToken: typeof resolveGithubToken;
 declare const credentials_resolveRef: typeof resolveRef;
 declare namespace credentials {
-  export { type credentials_CredentialDescription as CredentialDescription, type credentials_CredentialServices as CredentialServices, type credentials_ResolvedSecret as ResolvedSecret, credentials_credentialServices as credentialServices, credentials_describeRef as describeRef, credentials_resolveGithubToken as resolveGithubToken, credentials_resolveRef as resolveRef };
+  export { type credentials_CredentialDescription as CredentialDescription, type credentials_CredentialRecord as CredentialRecord, type credentials_CredentialServices as CredentialServices, GITHUB_RECORD_KEY$1 as GITHUB_RECORD_KEY, type credentials_ResolvedSecret as ResolvedSecret, credentials_credentialServices as credentialServices, credentials_describeRef as describeRef, credentials_resolveGithubToken as resolveGithubToken, credentials_resolveRef as resolveRef };
 }
 
 /**
@@ -1130,7 +1145,7 @@ interface GithubProbeResult {
 }
 declare function probeGithubAuth(options: {
     credentials: CredentialServices | undefined;
-    authMode: 'pat' | 'gh';
+    authMode: 'pat' | 'gh' | 'browser';
     tokenRef: string;
     env?: NodeJS.ProcessEnv;
     fetchImpl?: typeof fetch;
@@ -1142,6 +1157,153 @@ declare namespace github {
   export { type github_GithubProbeResult as GithubProbeResult, github_probeGithubAuth as probeGithubAuth };
 }
 
+/** 与核心 `@deepseek-ai/dsh-github-auth` 提案保持同 key；迁移时消费端无需改。 */
+declare const GITHUB_RECORD_KEY = "github/default";
+/** 本地回调路径（带集成前缀，避免多 provider 撞 webServer 的 `(kind,path)` 唯一约束）。 */
+declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
+/**
+ * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
+ * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
+ * 纯 PKCE public client，无需 client_secret。用户/部署可在 `apply(config.githubClientId)` 覆盖。
+ *
+ * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
+ * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
+ */
+declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
+/** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
+declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
+/** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
+declare const DEFAULT_SCOPE = "repo";
+interface AuthorizationFlow {
+    key: string;
+    label: string;
+    methods: Array<{
+        id: string;
+        label: string;
+    }>;
+    run: (session: AuthorizationSessionLike) => Promise<void> | void;
+}
+interface AuthorizationSessionLike {
+    method?: string;
+    signal?: AbortSignal;
+    notify?: (notice: {
+        message: string;
+        url?: string;
+        code?: string;
+    }) => void;
+    prompt?: (prompt: unknown) => Promise<unknown>;
+    commit?: (record: {
+        kind: 'grant';
+        payload: unknown;
+    }) => Promise<unknown>;
+}
+interface AuthorizationLike {
+    registerFlow?: (flow: AuthorizationFlow) => unknown;
+    begin?: (request: unknown) => Promise<{
+        status: 'authorized' | 'cancelled';
+    }>;
+    cancel?: (key: string) => void;
+}
+interface WebServerLike {
+    register?: (route: {
+        kind: 'exact';
+        path: string;
+        handler: (req: any, res: any) => void;
+    }) => () => void;
+    port?: number;
+    host?: string;
+}
+type FetchLike = typeof fetch;
+interface GithubAuthDeps {
+    get: (name: string) => unknown;
+    fetchImpl?: FetchLike;
+    logger?: (event: string, data?: Record<string, unknown>) => void;
+    /** 覆盖端点（测试用）；生产留空走 GitHub 官方。 */
+    endpoints?: {
+        authorize?: string;
+        accessToken?: string;
+        deviceCode?: string;
+        user?: string;
+    };
+    /** GitHub OAuth App 的 public client_id（无需 secret）。 */
+    clientId?: string;
+    scope?: string;
+    attemptTimeoutMs?: number;
+}
+type GithubAttemptPhase = 'idle' | 'waiting-browser' | 'waiting-device' | 'exchanging' | 'done' | 'error';
+interface GithubAttemptView {
+    phase: GithubAttemptPhase;
+    authorizeUrl?: string;
+    verificationUri?: string;
+    userCode?: string;
+    expiresAt?: number;
+    login?: string;
+    error?: string;
+}
+declare function attemptView(): GithubAttemptView;
+/** PKCE：返回 verifier 与 S256 challenge。 */
+declare function createPkce(): {
+    verifier: string;
+    challenge: string;
+};
+/** 常量时间比较 state（长度不等直接 false，避免 timingSafeEqual 抛错）。 */
+declare function verifyState(received: string, expected: string): boolean;
+/** 拼授权页 URL。 */
+declare function buildAuthorizeUrl(params: {
+    authorizeEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    challenge: string;
+}): string;
+interface GithubGrantPayload {
+    version: 1;
+    token: string;
+    login?: string;
+    tokenType?: string;
+    scope?: string;
+}
+/**
+ * 向 `ctx.authorization` 注册 GitHub flow（若核心没有该服务则降级 no-op）。
+ * 在 `apply()` 里调用一次。
+ */
+declare function registerGithubFlow(deps: GithubAuthDeps): void;
+/**
+ * 启动一次浏览器登录 attempt（进程内 `authorization.begin`，不阻塞请求）。
+ * @returns 当前 attempt 视图（含 authorizeUrl，供前端打开）。二次调用在已有进行中时抛错。
+ */
+declare function beginGithubSignIn(deps: GithubAuthDeps, method?: 'browser' | 'device'): Promise<GithubAttemptView>;
+/** 取消进行中的 attempt。 */
+declare function cancelGithubSignIn(deps: GithubAuthDeps): void;
+/** 仅测试用：清空内存 attempt。 */
+declare function resetAttemptForTest(): void;
+
+type githubAuth_AuthorizationFlow = AuthorizationFlow;
+type githubAuth_AuthorizationLike = AuthorizationLike;
+type githubAuth_AuthorizationSessionLike = AuthorizationSessionLike;
+declare const githubAuth_CALLBACK_PATH: typeof CALLBACK_PATH;
+declare const githubAuth_DEFAULT_GITHUB_CLIENT_ID: typeof DEFAULT_GITHUB_CLIENT_ID;
+declare const githubAuth_DEFAULT_SCOPE: typeof DEFAULT_SCOPE;
+declare const githubAuth_GITHUB_RECORD_KEY: typeof GITHUB_RECORD_KEY;
+type githubAuth_GithubAttemptPhase = GithubAttemptPhase;
+type githubAuth_GithubAttemptView = GithubAttemptView;
+type githubAuth_GithubAuthDeps = GithubAuthDeps;
+type githubAuth_GithubGrantPayload = GithubGrantPayload;
+type githubAuth_WebServerLike = WebServerLike;
+declare const githubAuth_attemptView: typeof attemptView;
+declare const githubAuth_beginGithubSignIn: typeof beginGithubSignIn;
+declare const githubAuth_buildAuthorizeUrl: typeof buildAuthorizeUrl;
+declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
+declare const githubAuth_createPkce: typeof createPkce;
+declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
+declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
+declare const githubAuth_resolveClientId: typeof resolveClientId;
+declare const githubAuth_verifyState: typeof verifyState;
+declare namespace githubAuth {
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_verifyState as verifyState };
+}
+
 interface DefaultBranchResult {
     branch?: string;
     /** `origin-head` = 远端默认分支；`head` = 本地当前分支兜底；`none` = 读不到。 */
@@ -1823,6 +1985,8 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
+    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时按钮会提示未配置）。 */
+    githubClientId?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;
@@ -2145,4 +2309,4 @@ declare namespace tools {
   export { tools_createTrendingHistoryTool as createTrendingHistoryTool, tools_createTrendingRunTool as createTrendingRunTool };
 }
 
-export { channel, config, core, credentials, errors, github, handshake$1 as handshake, importCli, ipc, locate, paths, pendingPr, pluginInfo, preflight, proxy, quickfill, release, repo, routes, run, runner, schedule, state, subscribe, tools, update as updateService, version };
+export { channel, config, core, credentials, errors, github, githubAuth, handshake$1 as handshake, importCli, ipc, locate, paths, pendingPr, pluginInfo, preflight, proxy, quickfill, release, repo, routes, run, runner, schedule, state, subscribe, tools, update as updateService, version };

package/lib/internal.js

@@ -4,6 +4,7 @@ import {
   core_exports,
   credentials_exports,
   errors_exports,
+  github_auth_exports,
   github_exports,
   handshake_exports,
   import_cli_exports,
@@ -26,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-YJ5GF3MW.js";
+} from "./chunk-LLTW4YHJ.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";
@@ -38,6 +39,7 @@ export {
   errors_exports as errors,
   exec,
   github_exports as github,
+  github_auth_exports as githubAuth,
   handshake_exports as handshake,
   import_cli_exports as importCli,
   ipc_exports as ipc,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.7.11",
+  "version": "0.8.1",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",