@morehao/dsh-github-trending 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [v0.8.2] - 2026-11-02
+
+### Fixes
+
+- **auth**: register github flow after service is ready (#72)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.1...v0.8.2
+
 ## [v0.7.11] - 2026-11-01
 
 ### Refactors

package/README.md

@@ -55,6 +55,18 @@ GitHub 趋势榜的 **DeepSeek Harness 插件**：按日 / 周 / 月周期定时
 
 ![设置](docs/images/settings.png)
 
+### GitHub 认证
+
+认证分区支持三种方式（可随时切换）：
+
+- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token。走 OAuth PKCE + 本机回环回调（或设备码），token 由 DSH 凭据记录安全保存，不落 `settings.json`。插件内置了公开的 OAuth App client_id（client_id 属公开标识、非机密；纯 PKCE 不使用 client_secret），开箱即用。
+- **本机 gh**：复用你终端里 `gh auth login` 的登录态。
+- **PAT**：手工填 Personal Access Token（存到凭据引用 / 环境变量）。
+
+> 浏览器登录需要核心提供 `authorization` 服务，并且 GitHub flow 注册成功才算可用；两者任一不满足时，设置页直接提示不可用并引导改用 gh / PAT，而不是给一个点了没反应的按钮。宿主启动时服务可能晚于插件就绪，插件会等服务就绪再注册，并在读状态时再兜底一次。
+>
+> 授权页默认尝试自动打开；若被浏览器的弹窗拦截，状态行里始终有可点的「打开授权页」链接与「复制链接」。
+
 ### 订阅
 
 （可选）订阅一组仓库，每周把每个仓库当周新增的 Release 合成一段中文摘要，与榜单同分支、同 PR 一起提交；订阅列表随数据仓版本化，可审计、可复现。

package/client.js

@@ -132,10 +132,14 @@ var DICT = {
     "auth.browser.cancel": "取消",
     "auth.browser.done": "已登录",
     "auth.browser.device": "用设备码登录",
-    "auth.browser.unavailable": "当前环境未配置 GitHub OAuth client_id，浏览器登录不可用：请改用「本机 gh」或 PAT。",
-    "auth.browser.openHint": "若浏览器未自动打开，请手动打开发起授权，或复制链接：",
+    "auth.browser.unavailable": "宿主的 authorization 服务不可用（或 GitHub 授权流程没注册成功）：请重试一次；仍不行就改用「本机 gh」或 PAT。",
+    "auth.browser.openHint": "若浏览器没有自动打开，点下面的链接完成授权，或复制链接：",
+    "auth.browser.open": "打开授权页",
     "auth.browser.copy": "复制链接",
     "auth.browser.copied": "授权链接已复制",
+    "auth.browser.failed": "登录失败",
+    "auth.browser.failed.detail": "登录失败：{message}",
+    "auth.browser.failed.hint": "宿主没有完成 GitHub 授权流程的注册，请重试；仍失败请改用「本机 gh」或 PAT。",
     "auth.pat.hint": "在 GitHub → Settings → Developer settings 生成 Personal Access Token（勾选 public_repo），填到下方引用或环境变量。",
     "auth.tokenRef": "凭据引用",
     "auth.tokenRef.hint": "凭据引用名 / 环境变量名",
@@ -673,10 +677,14 @@ var DICT = {
     "auth.browser.cancel": "Cancel",
     "auth.browser.done": "Signed in",
     "auth.browser.device": "Use a device code",
-    "auth.browser.unavailable": "No GitHub OAuth client_id configured in this environment, so browser sign-in is unavailable: use Local gh or PAT instead.",
-    "auth.browser.openHint": "If the browser did not open, open the authorization page manually, or copy the link:",
+    "auth.browser.unavailable": "The host authorization service is unavailable (or the GitHub flow did not register): retry once, then fall back to Local gh or a PAT.",
+    "auth.browser.openHint": "If the browser did not open, use the link below to finish signing in, or copy the link:",
+    "auth.browser.open": "Open authorization page",
     "auth.browser.copy": "Copy link",
     "auth.browser.copied": "Authorization link copied",
+    "auth.browser.failed": "Sign-in failed",
+    "auth.browser.failed.detail": "Sign-in failed: {message}",
+    "auth.browser.failed.hint": "The host did not register the GitHub authorization flow. Retry, or use Local gh / a PAT instead.",
     "auth.pat.hint": "Create a Personal Access Token under GitHub → Settings → Developer settings (scope public_repo) and put it in the ref below or an env var.",
     "auth.tokenRef": "Credential ref",
     "auth.tokenRef.hint": "credential ref / env var name",
@@ -1340,6 +1348,8 @@ var CSS = `
 .dshgt-ready-extra{color:var(--gt-muted);font-size:12px;margin-left:7px;}
 .dshgt-linkbtn{border:0;background:none;color:var(--gt-accent);font-family:inherit;font-size:12.5px;padding:6px 2px;border-radius:4px;cursor:pointer;}
 .dshgt-linkbtn:hover{text-decoration:underline;}
+.dshgt-link{color:var(--gt-accent);text-decoration:none;font-size:12.5px;word-break:break-all;}
+.dshgt-link:hover{text-decoration:underline;}
 .dshgt-week{display:flex;gap:6px;align-items:stretch;}
 .dshgt-day{flex:1;min-width:0;border:1px solid var(--gt-border);border-radius:8px;padding:8px;background:var(--gt-card);display:flex;flex-direction:column;gap:5px;text-align:left;font-family:inherit;color:inherit;}
 .dshgt-day-clickable{cursor:pointer;}
@@ -2249,8 +2259,13 @@ function SettingsView(props) {
   };
   const startSignIn = async (method) => {
     try {
-      const view = await beginGithubSignIn(method);
+      let view = await beginGithubSignIn(method);
+      if (view.phase === "idle") view = await getGithubSignInStatus();
       setSignIn(view);
+      if (view.phase === "error") {
+        notify("err", t("auth.browser.failed.detail", { message: view.error ?? "" }));
+        return;
+      }
       if (view.phase === "waiting-browser" && view.authorizeUrl !== void 0) {
         try {
           window.open(view.authorizeUrl, "_blank", "noopener,noreferrer");
@@ -2542,8 +2557,10 @@ function SettingsView(props) {
       }) }),
       h("span", { className: "dshgt-hint" }, t("auth.tokenRef.hint"))
     ),
-    // 浏览器登录进行中的状态行：授权页链接（可复制）+ 设备码。
-    isBrowser && signIn.phase !== "idle" && signIn.phase !== "done" ? h(
+    // 浏览器登录失败：必须显式说出来，否则「点了没反应」又回来了。
+    isBrowser && signIn.phase === "error" ? h(Alert, { kind: "err", title: t("auth.browser.failed") }, signIn.error ?? t("auth.browser.failed.hint")) : null,
+    // 浏览器登录进行中的状态行：可点的授权页链接 + 复制兜底 + 设备码。
+    isBrowser && (signIn.phase === "waiting-browser" || signIn.phase === "waiting-device" || signIn.phase === "exchanging") ? h(
       "div",
       { className: "dshgt-hint" },
       signIn.authorizeUrl !== void 0 ? h(
@@ -2551,8 +2568,19 @@ function SettingsView(props) {
         { className: "dshgt-desc" },
         h("span", null, t("auth.browser.openHint")),
         " ",
+        h(
+          "a",
+          { className: "dshgt-link", href: signIn.authorizeUrl, target: "_blank", rel: "noreferrer" },
+          t("auth.browser.open")
+        ),
+        " ",
         h(Btn, { small: true, variant: "ghost", onClick: () => copyAuthorizeLink() }, t("auth.browser.copy"))
       ) : null,
+      signIn.verificationUri !== void 0 ? h(
+        "div",
+        { className: "dshgt-desc" },
+        h("a", { className: "dshgt-link", href: signIn.verificationUri, target: "_blank", rel: "noreferrer" }, signIn.verificationUri)
+      ) : null,
       signIn.userCode !== void 0 ? h("div", { className: "dshgt-mono" }, `${t("auth.browser.code")} ${signIn.userCode}`) : null
     ) : null,
     h(

package/lib/{chunk-6PVBPJXO.js → chunk-5D2VRWPJ.js}

@@ -3530,6 +3530,7 @@ async function probeGithubAuth(options) {
 var github_auth_exports = {};
 __export(github_auth_exports, {
   CALLBACK_PATH: () => CALLBACK_PATH,
+  DEFAULT_GITHUB_CLIENT_ID: () => DEFAULT_GITHUB_CLIENT_ID,
   DEFAULT_SCOPE: () => DEFAULT_SCOPE,
   GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY2,
   attemptView: () => attemptView,
@@ -3537,13 +3538,21 @@ __export(github_auth_exports, {
   buildAuthorizeUrl: () => buildAuthorizeUrl,
   cancelGithubSignIn: () => cancelGithubSignIn,
   createPkce: () => createPkce,
+  ensureGithubFlow: () => ensureGithubFlow,
+  isGithubFlowRegistered: () => isGithubFlowRegistered,
   registerGithubFlow: () => registerGithubFlow,
   resetAttemptForTest: () => resetAttemptForTest,
+  resolveClientId: () => resolveClientId,
   verifyState: () => verifyState
 });
 import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var GITHUB_RECORD_KEY2 = "github/default";
 var CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
+var DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
+function resolveClientId(deps) {
+  const fromConfig = deps.clientId;
+  return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
+}
 var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
 var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -3620,7 +3629,7 @@ async function runBrowser(deps, session) {
   if (webServer === void 0 || typeof webServer.register !== "function") {
     throw new Error("webServer \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u6D4F\u89C8\u5668\u767B\u5F55\u9700\u8981\u5B83\u627F\u8F7D OAuth \u56DE\u8C03");
   }
-  const clientId = deps.clientId;
+  const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
   const fetchImpl = deps.fetchImpl ?? fetch;
   const endpoints = normalizeEndpoints(deps.endpoints);
@@ -3688,7 +3697,7 @@ async function runBrowser(deps, session) {
   }
 }
 async function runDevice(deps, session) {
-  const clientId = deps.clientId;
+  const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
   const fetchImpl = deps.fetchImpl ?? fetch;
   const endpoints = normalizeEndpoints(deps.endpoints);
@@ -3757,13 +3766,8 @@ async function runDevice(deps, session) {
   }
   throw new Error("GitHub device flow \u8D85\u65F6");
 }
-function registerGithubFlow(deps) {
-  const authorization = deps.get("authorization");
-  if (authorization === void 0 || typeof authorization.registerFlow !== "function") {
-    deps.logger?.("auth.flow.skipped", { reason: "no-authorization-service" });
-    return;
-  }
-  authorization.registerFlow({
+function flowDefinition(deps) {
+  return {
     key: GITHUB_RECORD_KEY2,
     label: "GitHub",
     methods: [
@@ -3771,14 +3775,57 @@ function registerGithubFlow(deps) {
       { id: "device", label: "Use a device code" }
     ],
     run: (session) => session.method === "device" ? runDevice(deps, session) : runBrowser(deps, session)
-  });
+  };
+}
+var registeredOn = /* @__PURE__ */ new WeakSet();
+var failedOn = /* @__PURE__ */ new WeakSet();
+function isGithubFlowRegistered(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0) return false;
+  if (typeof authorization.describe === "function") {
+    try {
+      return authorization.describe(GITHUB_RECORD_KEY2) !== void 0;
+    } catch {
+      return registeredOn.has(authorization);
+    }
+  }
+  return registeredOn.has(authorization);
+}
+function ensureGithubFlow(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0 || typeof authorization.registerFlow !== "function") return false;
+  if (isGithubFlowRegistered(deps)) {
+    registeredOn.add(authorization);
+    return true;
+  }
+  if (failedOn.has(authorization)) return false;
+  try {
+    authorization.registerFlow(flowDefinition(deps));
+  } catch (error) {
+    failedOn.add(authorization);
+    deps.logger?.("auth.flow.failed", {
+      key: GITHUB_RECORD_KEY2,
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return isGithubFlowRegistered(deps);
+  }
+  registeredOn.add(authorization);
   deps.logger?.("auth.flow.registered", { key: GITHUB_RECORD_KEY2 });
+  return true;
+}
+function registerGithubFlow(deps) {
+  if (!ensureGithubFlow(deps)) deps.logger?.("auth.flow.skipped", { reason: "no-authorization-service" });
 }
+var START_TIMEOUT_MS = 1500;
+var START_POLL_MS = 10;
 async function beginGithubSignIn(deps, method = "browser") {
   const authorization = deps.get("authorization");
   if (authorization === void 0 || typeof authorization.begin !== "function") {
     throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C\u6D4F\u89C8\u5668\u767B\u5F55");
   }
+  if (!ensureGithubFlow(deps)) {
+    throw new Error("authorization \u670D\u52A1\u5C1A\u672A\u5C31\u7EEA\uFF0CGitHub \u6388\u6743\u6D41\u7A0B\u6CA1\u6709\u6CE8\u518C\u6210\u529F\uFF1A\u8BF7\u7A0D\u540E\u91CD\u8BD5");
+  }
   if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
     throw new Error("already-in-flight");
   }
@@ -3786,29 +3833,43 @@ async function beginGithubSignIn(deps, method = "browser") {
   const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
   const attempt = { phase: "idle", controller, done: Promise.resolve() };
   current = attempt;
-  attempt.done = authorization.begin({
-    key: GITHUB_RECORD_KEY2,
-    method,
-    signal: controller.signal,
-    // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
-    interaction: {
-      notify: (notice) => {
-        if (notice.code !== void 0 && notice.url !== void 0) {
-          updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
-        } else if (notice.url !== void 0) {
-          updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
-        }
-      },
-      prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
-    }
-  }).then((outcome) => {
+  let started;
+  try {
+    started = authorization.begin({
+      key: GITHUB_RECORD_KEY2,
+      method,
+      signal: controller.signal,
+      // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
+      interaction: {
+        notify: (notice) => {
+          if (notice.code !== void 0 && notice.url !== void 0) {
+            updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
+          } else if (notice.url !== void 0) {
+            updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
+          }
+        },
+        prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
+      }
+    });
+  } catch (error) {
+    clearTimeout(timer);
+    updateCurrent({ phase: "error", error: error instanceof Error ? error.message : String(error) });
+    return attemptView();
+  }
+  attempt.done = started.then((outcome) => {
     if (outcome.status === "cancelled") updateCurrent({ phase: "idle" });
   }).catch((error) => {
     updateCurrent({ phase: "error", error: error instanceof Error ? error.message : String(error) });
   }).finally(() => clearTimeout(timer));
-  await Promise.resolve();
+  await waitForStart(attempt);
   return attemptView();
 }
+async function waitForStart(attempt, timeoutMs = START_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  while (attempt.phase === "idle" && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, START_POLL_MS));
+  }
+}
 function cancelGithubSignIn(deps) {
   const authorization = deps.get("authorization");
   if (authorization !== void 0 && typeof authorization.cancel === "function") {
@@ -4381,6 +4442,14 @@ import { PluginUpdateError } from "@morehao/dsh-plugin-kit/update";
 var ROUTE_PREFIX = "/api/morehao/github-trending";
 var HEADER = "x-dsh-github-trending";
 var MAX_BODY2 = 512 * 1024;
+function isAuthorizationAvailable(get) {
+  const authorization = get("authorization");
+  return authorization !== void 0 && typeof authorization.begin === "function";
+}
+function browserSignInAvailable(deps) {
+  if (!isAuthorizationAvailable(deps.get)) return false;
+  return ensureGithubFlow(githubAuthDeps(deps));
+}
 function githubAuthDeps(deps) {
   return {
     get: deps.get,
@@ -4575,8 +4644,10 @@ async function dispatch(method, pathname, url, body, deps) {
     const method2 = body.method === "device" ? "device" : "browser";
     try {
       const view = await beginGithubSignIn(githubAuthDeps(deps), method2);
+      if (view.phase === "error") throw new IpcError("GITHUB_AUTH_UNAVAILABLE", redact(view.error ?? "GitHub \u767B\u5F55\u5931\u8D25"));
       return { attempt: view };
     } catch (error) {
+      if (error instanceof IpcError) throw error;
       const message = error instanceof Error ? error.message : String(error);
       if (message === "already-in-flight") {
         return { attempt: attemptView(), alreadyInFlight: true };
@@ -4722,8 +4793,8 @@ async function statePayload(deps, settings) {
       source: github.source,
       /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
       attempt: attemptView(),
-      /** 是否配置了 browser 模式的 client_id（未配置时前端禁用「用 GitHub 登录」并给提示）。 */
-      browserAvailable: deps.githubClientId !== void 0 && deps.githubClientId !== ""
+      /** 浏览器登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
+      browserAvailable: browserSignInAvailable(deps)
     }
   };
 }
@@ -5002,7 +5073,7 @@ export {
   readPluginInfo,
   plugin_info_exports,
   github_exports,
-  registerGithubFlow,
+  ensureGithubFlow,
   github_auth_exports,
   import_cli_exports,
   pending_pr_exports,

package/lib/index.d.ts

@@ -10,6 +10,8 @@ interface PluginLogger {
 interface PluginContext {
     get?: (name: string) => unknown;
     effect?: (factory: () => unknown, label?: string) => unknown;
+    /** cordis 的服务就绪钩子：依赖被提供（或重提供）时回调，用于「晚到的服务」注册。 */
+    inject?: (deps: string[], callback: (scope: PluginContext) => unknown) => unknown;
     logger?: PluginLogger;
     webServer?: {
         register: (options: {

package/lib/index.js

@@ -7,9 +7,9 @@ import {
   createTrendingHistoryTool,
   createTrendingRunTool,
   createUpdateService,
-  readPluginInfo,
-  registerGithubFlow
-} from "./chunk-6PVBPJXO.js";
+  ensureGithubFlow,
+  readPluginInfo
+} from "./chunk-5D2VRWPJ.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -64,11 +64,21 @@ function apply(ctx, config = {}) {
     onError: (error) => ctx.logger?.warn?.(`[dsh-github-trending] \u5B9A\u65F6\u8FD0\u884C\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`)
   });
   const pluginInfo = readPluginInfo();
-  registerGithubFlow({
-    get,
+  const githubAuth = (resolve) => ({
+    get: resolve,
     logger: log,
     ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
   });
+  const registerAuth = (resolve) => {
+    if (!ensureGithubFlow(githubAuth(resolve ?? get))) log("auth.flow.deferred", { reason: "authorization-not-ready" });
+  };
+  if (typeof ctx.inject === "function") {
+    ctx.inject(["authorization"], (scope) => {
+      registerAuth((name2) => typeof scope.get === "function" ? scope.get(name2) : void 0);
+    });
+  } else {
+    registerAuth();
+  }
   const update = createUpdateService({
     get,
     env,

package/lib/internal.d.ts

@@ -1161,6 +1161,17 @@ declare namespace github {
 declare const GITHUB_RECORD_KEY = "github/default";
 /** 本地回调路径（带集成前缀，避免多 provider 撞 webServer 的 `(kind,path)` 唯一约束）。 */
 declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
+/**
+ * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
+ * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
+ * 纯 PKCE public client，无需 client_secret。用户/部署可在 `apply(config.githubClientId)` 覆盖。
+ *
+ * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
+ * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
+ */
+declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
+/** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
+declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
 /** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
 declare const DEFAULT_SCOPE = "repo";
 interface AuthorizationFlow {
@@ -1192,6 +1203,8 @@ interface AuthorizationLike {
         status: 'authorized' | 'cancelled';
     }>;
     cancel?: (key: string) => void;
+    /** 核心 0.2.x 有：按 key 查已注册的 flow；判定「真的注册上了」靠它。 */
+    describe?: (key: string) => unknown;
 }
 interface WebServerLike {
     register?: (route: {
@@ -1253,14 +1266,35 @@ interface GithubGrantPayload {
     tokenType?: string;
     scope?: string;
 }
+/** 这个 key 现在是否**真的**有 flow 在注册表里。 */
+declare function isGithubFlowRegistered(deps: GithubAuthDeps): boolean;
+/**
+ * 幂等注册 GitHub flow；`authorization` 还没就绪时返回 false，调用方可稍后重试。
+ *
+ * 为什么不能只在 `apply()` 里试一次：宿主按「服务可用性」激活插件，本插件只
+ * `inject: ['webServer']`，apply 完全可能早于 `authorization`——后者要等
+ * `credentials` 的异步 `[Service.init]`（启动时读 `.credentials.yaml`）走完才
+ * 可见，而 `ctx.get()` 对未 active 的 provider 返回 undefined。那一刻若放弃注册，
+ * 就永久没有 flow；而可用性又是按请求现算的，于是出现「按钮亮着、点了必然
+ * NO_FLOW、界面毫无反馈」。所以注册做成可重入的自愈入口：apply 用
+ * `ctx.inject(['authorization'])` 等服务就绪，HTTP 面每次读状态再兜底一次。
+ *
+ * @returns 注册后是否可用（服务缺失 / 注册失败时为 false）。
+ */
+declare function ensureGithubFlow(deps: GithubAuthDeps): boolean;
 /**
  * 向 `ctx.authorization` 注册 GitHub flow（若核心没有该服务则降级 no-op）。
- * 在 `apply()` 里调用一次。
+ * 等价于 {@link ensureGithubFlow}，保留旧名字给 `apply()` 与测试用。
  */
 declare function registerGithubFlow(deps: GithubAuthDeps): void;
 /**
  * 启动一次浏览器登录 attempt（进程内 `authorization.begin`，不阻塞请求）。
- * @returns 当前 attempt 视图（含 authorizeUrl，供前端打开）。二次调用在已有进行中时抛错。
+ *
+ * 返回的视图保证**不是 `idle`**：要么已经进入 waiting-*，要么已经落成 `error`
+ * （供路由转成 HTTP 错误）。`idle` 只可能来自「flow 没注册」这类抢跑，前端拿到
+ * 它就会以为什么都没发生——那正是「点了没反应」的形态，所以这里把它堵掉。
+ *
+ * @throws 服务不可用、flow 未注册、已有 attempt 在飞时抛错。
  */
 declare function beginGithubSignIn(deps: GithubAuthDeps, method?: 'browser' | 'device'): Promise<GithubAttemptView>;
 /** 取消进行中的 attempt。 */
@@ -1272,6 +1306,7 @@ type githubAuth_AuthorizationFlow = AuthorizationFlow;
 type githubAuth_AuthorizationLike = AuthorizationLike;
 type githubAuth_AuthorizationSessionLike = AuthorizationSessionLike;
 declare const githubAuth_CALLBACK_PATH: typeof CALLBACK_PATH;
+declare const githubAuth_DEFAULT_GITHUB_CLIENT_ID: typeof DEFAULT_GITHUB_CLIENT_ID;
 declare const githubAuth_DEFAULT_SCOPE: typeof DEFAULT_SCOPE;
 declare const githubAuth_GITHUB_RECORD_KEY: typeof GITHUB_RECORD_KEY;
 type githubAuth_GithubAttemptPhase = GithubAttemptPhase;
@@ -1284,11 +1319,14 @@ declare const githubAuth_beginGithubSignIn: typeof beginGithubSignIn;
 declare const githubAuth_buildAuthorizeUrl: typeof buildAuthorizeUrl;
 declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
 declare const githubAuth_createPkce: typeof createPkce;
+declare const githubAuth_ensureGithubFlow: typeof ensureGithubFlow;
+declare const githubAuth_isGithubFlowRegistered: typeof isGithubFlowRegistered;
 declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
 declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
+declare const githubAuth_resolveClientId: typeof resolveClientId;
 declare const githubAuth_verifyState: typeof verifyState;
 declare namespace githubAuth {
-  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_verifyState as verifyState };
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_verifyState as verifyState };
 }
 
 interface DefaultBranchResult {

package/lib/internal.js

@@ -27,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-6PVBPJXO.js";
+} from "./chunk-5D2VRWPJ.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",