@morehao/dsh-github-trending 0.8.1 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [v0.8.3] - 2026-11-02
+
+### Fixes
+
+- **auth**: fall back to device flow when client_secret is missing (#75)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.2...v0.8.3
+
+## [v0.8.2] - 2026-11-02
+
+### Fixes
+
+- **auth**: register github flow after service is ready (#72)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.1...v0.8.2
+
 ## [v0.7.11] - 2026-11-01
 
 ### Refactors

package/README.md

@@ -59,11 +59,13 @@ GitHub 趋势榜的 **DeepSeek Harness 插件**：按日 / 周 / 月周期定时
 
 认证分区支持三种方式（可随时切换）：
 
-- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token。走 OAuth PKCE + 本机回环回调（或设备码），token 由 DSH 凭据记录安全保存，不落 `settings.json`。插件内置了公开的 OAuth App client_id（client_id 属公开标识、非机密；纯 PKCE 不使用 client_secret），开箱即用。
+- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token，token 由 DSH 凭据记录安全保存、不落 `settings.json`。插件内置了公开的 OAuth App client_id，开箱即用；GitHub 的 web flow 换 token 仍然**必须带 client_secret**（PKCE 只是叠加保护），而客户端不能内置机密，所以默认走**设备码**：点一下后在打开的 GitHub 页面输入验证码即可。若你自带 OAuth App，可在插件配置里同时给 `githubClientId` + `githubClientSecret`，就会改用本机回环回调（不用手输验证码）。
 - **本机 gh**：复用你终端里 `gh auth login` 的登录态。
 - **PAT**：手工填 Personal Access Token（存到凭据引用 / 环境变量）。
 
-> 浏览器登录需要核心提供 `authorization` 服务；若当前核心版本不含该能力，「浏览器登录」会提示不可用并引导改用 gh / PAT。
+> 浏览器登录需要核心提供 `authorization` 服务，并且 GitHub flow 注册成功才算可用；两者任一不满足时，设置页直接提示不可用并引导改用 gh / PAT，而不是给一个点了没反应的按钮。宿主启动时服务可能晚于插件就绪，插件会等服务就绪再注册，并在读状态时再兜底一次。
+>
+> 设备码 / 授权页默认尝试自动打开；若被浏览器的弹窗拦截，状态行里始终有可点的「打开授权页」链接、验证码与「复制链接」。
 
 ### 订阅
 

package/client.js

@@ -125,17 +125,21 @@ var DICT = {
     "auth.gh": "本机 gh",
     "auth.browser": "浏览器登录",
     "auth.gh.hint": "使用本机 gh 登录态：终端执行 `gh auth login` 完成登录，再点「测试认证」。",
-    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。",
+    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。默认走设备码：点一下后按提示输入验证码。",
     "auth.browser.signin": "用 GitHub 登录",
     "auth.browser.waiting": "等待浏览器授权…",
     "auth.browser.code": "在打开的页面输入验证码：",
     "auth.browser.cancel": "取消",
     "auth.browser.done": "已登录",
     "auth.browser.device": "用设备码登录",
-    "auth.browser.unavailable": "当前环境未配置 GitHub OAuth client_id，浏览器登录不可用：请改用「本机 gh」或 PAT。",
-    "auth.browser.openHint": "若浏览器未自动打开，请手动打开发起授权，或复制链接：",
+    "auth.browser.unavailable": "宿主的 authorization 服务不可用（或 GitHub 授权流程没注册成功）：请重试一次；仍不行就改用「本机 gh」或 PAT。",
+    "auth.browser.openHint": "若浏览器没有自动打开，点下面的链接完成授权，或复制链接：",
+    "auth.browser.open": "打开授权页",
     "auth.browser.copy": "复制链接",
     "auth.browser.copied": "授权链接已复制",
+    "auth.browser.failed": "登录失败",
+    "auth.browser.failed.detail": "登录失败：{message}",
+    "auth.browser.failed.hint": "请重试一次；仍失败可改用「本机 gh」或 PAT。",
     "auth.pat.hint": "在 GitHub → Settings → Developer settings 生成 Personal Access Token（勾选 public_repo），填到下方引用或环境变量。",
     "auth.tokenRef": "凭据引用",
     "auth.tokenRef.hint": "凭据引用名 / 环境变量名",
@@ -666,17 +670,21 @@ var DICT = {
     "auth.gh": "Local gh",
     "auth.browser": "Browser login",
     "auth.gh.hint": "Uses your local gh login: run `gh auth login` in a terminal, then click Test authentication.",
-    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste.",
+    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste. Uses a device code by default: enter the code on the GitHub page after clicking.",
     "auth.browser.signin": "Sign in with GitHub",
     "auth.browser.waiting": "Waiting for browser authorization…",
     "auth.browser.code": "Enter this code on the opened page:",
     "auth.browser.cancel": "Cancel",
     "auth.browser.done": "Signed in",
     "auth.browser.device": "Use a device code",
-    "auth.browser.unavailable": "No GitHub OAuth client_id configured in this environment, so browser sign-in is unavailable: use Local gh or PAT instead.",
-    "auth.browser.openHint": "If the browser did not open, open the authorization page manually, or copy the link:",
+    "auth.browser.unavailable": "The host authorization service is unavailable (or the GitHub flow did not register): retry once, then fall back to Local gh or a PAT.",
+    "auth.browser.openHint": "If the browser did not open, use the link below to finish signing in, or copy the link:",
+    "auth.browser.open": "Open authorization page",
     "auth.browser.copy": "Copy link",
     "auth.browser.copied": "Authorization link copied",
+    "auth.browser.failed": "Sign-in failed",
+    "auth.browser.failed.detail": "Sign-in failed: {message}",
+    "auth.browser.failed.hint": "Retry once; if it keeps failing, use Local gh or a PAT instead.",
     "auth.pat.hint": "Create a Personal Access Token under GitHub → Settings → Developer settings (scope public_repo) and put it in the ref below or an env var.",
     "auth.tokenRef": "Credential ref",
     "auth.tokenRef.hint": "credential ref / env var name",
@@ -1340,6 +1348,8 @@ var CSS = `
 .dshgt-ready-extra{color:var(--gt-muted);font-size:12px;margin-left:7px;}
 .dshgt-linkbtn{border:0;background:none;color:var(--gt-accent);font-family:inherit;font-size:12.5px;padding:6px 2px;border-radius:4px;cursor:pointer;}
 .dshgt-linkbtn:hover{text-decoration:underline;}
+.dshgt-link{color:var(--gt-accent);text-decoration:none;font-size:12.5px;word-break:break-all;}
+.dshgt-link:hover{text-decoration:underline;}
 .dshgt-week{display:flex;gap:6px;align-items:stretch;}
 .dshgt-day{flex:1;min-width:0;border:1px solid var(--gt-border);border-radius:8px;padding:8px;background:var(--gt-card);display:flex;flex-direction:column;gap:5px;text-align:left;font-family:inherit;color:inherit;}
 .dshgt-day-clickable{cursor:pointer;}
@@ -2249,14 +2259,25 @@ function SettingsView(props) {
   };
   const startSignIn = async (method) => {
     try {
-      const view = await beginGithubSignIn(method);
+      let view = await beginGithubSignIn(method);
+      if (view.phase === "idle") view = await getGithubSignInStatus();
       setSignIn(view);
+      if (view.phase === "error") {
+        notify("err", t("auth.browser.failed.detail", { message: view.error ?? "" }));
+        return;
+      }
       if (view.phase === "waiting-browser" && view.authorizeUrl !== void 0) {
         try {
           window.open(view.authorizeUrl, "_blank", "noopener,noreferrer");
         } catch {
         }
       }
+      if (view.phase === "waiting-device" && view.verificationUri !== void 0) {
+        try {
+          window.open(view.verificationUri, "_blank", "noopener,noreferrer");
+        } catch {
+        }
+      }
     } catch (error) {
       notify("err", error instanceof Error ? error.message : String(error));
     }
@@ -2333,6 +2354,7 @@ function SettingsView(props) {
   const isGh = draft.github.authMode === "gh";
   const isBrowser = draft.github.authMode === "browser";
   const browserAvailable = state.github.browserAvailable === true;
+  const loopbackAvailable = state.github.loopbackAvailable === true;
   const sections = [
     { id: "source", label: t("st.source") },
     { id: "model", label: t("st.model") },
@@ -2527,12 +2549,12 @@ function SettingsView(props) {
         {
           small: true,
           variant: "primary",
-          onClick: () => void startSignIn("browser"),
+          onClick: () => void startSignIn(loopbackAvailable ? "browser" : "device"),
           disabled: signInActive
         },
         signIn.phase === "done" && signIn.login !== void 0 ? `${t("auth.browser.done")} · @${signIn.login}` : signInActive ? t("auth.browser.waiting") : t("auth.browser.signin")
       ) : h("span", { className: "dshgt-hint" }, t("auth.browser.unavailable")),
-      browserAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
+      browserAvailable && loopbackAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
       signInActive ? h(Btn, { small: true, variant: "ghost", onClick: () => void cancelSignIn() }, t("auth.browser.cancel")) : null
     ) : h(
       Row,
@@ -2542,8 +2564,10 @@ function SettingsView(props) {
       }) }),
       h("span", { className: "dshgt-hint" }, t("auth.tokenRef.hint"))
     ),
-    // 浏览器登录进行中的状态行：授权页链接（可复制）+ 设备码。
-    isBrowser && signIn.phase !== "idle" && signIn.phase !== "done" ? h(
+    // 浏览器登录失败：必须显式说出来，否则「点了没反应」又回来了。
+    isBrowser && signIn.phase === "error" ? h(Alert, { kind: "err", title: t("auth.browser.failed") }, signIn.error ?? t("auth.browser.failed.hint")) : null,
+    // 浏览器登录进行中的状态行：可点的授权页链接 + 复制兜底 + 设备码。
+    isBrowser && (signIn.phase === "waiting-browser" || signIn.phase === "waiting-device" || signIn.phase === "exchanging") ? h(
       "div",
       { className: "dshgt-hint" },
       signIn.authorizeUrl !== void 0 ? h(
@@ -2551,8 +2575,19 @@ function SettingsView(props) {
         { className: "dshgt-desc" },
         h("span", null, t("auth.browser.openHint")),
         " ",
+        h(
+          "a",
+          { className: "dshgt-link", href: signIn.authorizeUrl, target: "_blank", rel: "noreferrer" },
+          t("auth.browser.open")
+        ),
+        " ",
         h(Btn, { small: true, variant: "ghost", onClick: () => copyAuthorizeLink() }, t("auth.browser.copy"))
       ) : null,
+      signIn.verificationUri !== void 0 ? h(
+        "div",
+        { className: "dshgt-desc" },
+        h("a", { className: "dshgt-link", href: signIn.verificationUri, target: "_blank", rel: "noreferrer" }, signIn.verificationUri)
+      ) : null,
       signIn.userCode !== void 0 ? h("div", { className: "dshgt-mono" }, `${t("auth.browser.code")} ${signIn.userCode}`) : null
     ) : null,
     h(

package/lib/{chunk-LLTW4YHJ.js → chunk-VO72OOVK.js}

@@ -3538,9 +3538,14 @@ __export(github_auth_exports, {
   buildAuthorizeUrl: () => buildAuthorizeUrl,
   cancelGithubSignIn: () => cancelGithubSignIn,
   createPkce: () => createPkce,
+  ensureGithubFlow: () => ensureGithubFlow,
+  isGithubFlowRegistered: () => isGithubFlowRegistered,
+  isLoopbackSignInAvailable: () => isLoopbackSignInAvailable,
   registerGithubFlow: () => registerGithubFlow,
   resetAttemptForTest: () => resetAttemptForTest,
   resolveClientId: () => resolveClientId,
+  resolveClientSecret: () => resolveClientSecret,
+  resolveMethod: () => resolveMethod,
   verifyState: () => verifyState
 });
 import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -3551,6 +3556,16 @@ function resolveClientId(deps) {
   const fromConfig = deps.clientId;
   return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
 }
+function resolveClientSecret(deps) {
+  const secret = deps.clientSecret;
+  return secret !== void 0 && secret !== "" ? secret : void 0;
+}
+function isLoopbackSignInAvailable(deps) {
+  return resolveClientSecret(deps) !== void 0;
+}
+function resolveMethod(deps, requested) {
+  return requested === "browser" && !isLoopbackSignInAvailable(deps) ? "device" : requested;
+}
 var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
 var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -3587,21 +3602,29 @@ function buildAuthorizeUrl(params) {
   return url.toString();
 }
 async function exchangeCode(fetchImpl, endpoint, params, signal) {
+  const form = new URLSearchParams({
+    client_id: params.clientId,
+    code: params.code,
+    code_verifier: params.verifier,
+    redirect_uri: params.redirectUri
+  });
+  if (params.clientSecret !== void 0) form.set("client_secret", params.clientSecret);
   const response = await fetchImpl(endpoint, {
     method: "POST",
     headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      client_id: params.clientId,
-      code: params.code,
-      code_verifier: params.verifier,
-      redirect_uri: params.redirectUri
-    }).toString(),
+    body: form.toString(),
     signal
   });
   if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
   const body = await response.json();
   if (typeof body.access_token !== "string" || body.access_token === "") {
-    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${typeof body.error === "string" ? `\uFF08${body.error}\uFF09` : ""}`);
+    const error = typeof body.error === "string" ? body.error : void 0;
+    if (error === "incorrect_client_credentials") {
+      throw new Error(
+        params.clientSecret === void 0 ? "GitHub \u7F51\u9875\u6388\u6743\u9700\u8981 client_secret\uFF08incorrect_client_credentials\uFF09\uFF0C\u5185\u7F6E\u7684\u516C\u5F00 client_id \u65E0\u6CD5\u5B8C\u6210\u8FD9\u4E00\u6B65\uFF1A\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF0C\u6216\u914D\u7F6E\u81EA\u5DF1\u7684 OAuth App client_id + client_secret\u3002" : "GitHub \u8BA4\u4E3A\u8FD9\u4E2A OAuth App \u7684 client_id / client_secret \u4E0D\u6B63\u786E\uFF08incorrect_client_credentials\uFF09\uFF1A\u8BF7\u68C0\u67E5\u63D2\u4EF6\u914D\u7F6E\uFF0C\u6216\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\u3002"
+      );
+    }
+    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${error === void 0 ? "" : `\uFF08${error}\uFF09`}`);
   }
   return {
     token: body.access_token,
@@ -3629,6 +3652,10 @@ async function runBrowser(deps, session) {
   }
   const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const clientSecret = resolveClientSecret(deps);
+  if (clientSecret === void 0) {
+    throw new Error("\u56DE\u73AF\u767B\u5F55\u4E0D\u53EF\u7528\uFF1A\u6CA1\u6709\u914D\u7F6E GitHub OAuth App \u7684 client_secret\uFF0C\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55");
+  }
   const fetchImpl = deps.fetchImpl ?? fetch;
   const endpoints = normalizeEndpoints(deps.endpoints);
   const scope = deps.scope ?? DEFAULT_SCOPE;
@@ -3679,7 +3706,12 @@ async function runBrowser(deps, session) {
     session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
     const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
     updateCurrent({ phase: "exchanging" });
-    const exchanged = await exchangeCode(fetchImpl, endpoints.accessToken, { clientId, code, verifier, redirectUri }, session.signal);
+    const exchanged = await exchangeCode(
+      fetchImpl,
+      endpoints.accessToken,
+      { clientId, clientSecret, code, verifier, redirectUri },
+      session.signal
+    );
     const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
     const payload = {
       version: 1,
@@ -3709,7 +3741,10 @@ async function runDevice(deps, session) {
   if (!startResponse.ok) throw new Error(`GitHub device/code HTTP ${startResponse.status}`);
   const start = await startResponse.json();
   if (typeof start.device_code !== "string" || typeof start.user_code !== "string" || typeof start.verification_uri !== "string") {
-    throw new Error("GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574");
+    const error = typeof start.error === "string" ? start.error : void 0;
+    throw new Error(
+      error === "device_flow_disabled" ? "GitHub \u6CA1\u6709\u4E3A\u8FD9\u4E2A OAuth App \u542F\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF1A\u8BF7\u5230 OAuth App \u8BBE\u7F6E\u52FE\u9009 Device flow\uFF0C\u6216\u6539\u7528\u300C\u672C\u673A gh\u300D/ PAT\u3002" : `GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574${error === void 0 ? "" : `\uFF08${error}\uFF09`}`
+    );
   }
   const deviceCode = start.device_code;
   const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
@@ -3764,13 +3799,8 @@ async function runDevice(deps, session) {
   }
   throw new Error("GitHub device flow \u8D85\u65F6");
 }
-function registerGithubFlow(deps) {
-  const authorization = deps.get("authorization");
-  if (authorization === void 0 || typeof authorization.registerFlow !== "function") {
-    deps.logger?.("auth.flow.skipped", { reason: "no-authorization-service" });
-    return;
-  }
-  authorization.registerFlow({
+function flowDefinition(deps) {
+  return {
     key: GITHUB_RECORD_KEY2,
     label: "GitHub",
     methods: [
@@ -3778,44 +3808,105 @@ function registerGithubFlow(deps) {
       { id: "device", label: "Use a device code" }
     ],
     run: (session) => session.method === "device" ? runDevice(deps, session) : runBrowser(deps, session)
-  });
+  };
+}
+var registeredOn = /* @__PURE__ */ new WeakSet();
+var failedOn = /* @__PURE__ */ new WeakSet();
+function isGithubFlowRegistered(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0) return false;
+  if (typeof authorization.describe === "function") {
+    try {
+      return authorization.describe(GITHUB_RECORD_KEY2) !== void 0;
+    } catch {
+      return registeredOn.has(authorization);
+    }
+  }
+  return registeredOn.has(authorization);
+}
+function ensureGithubFlow(deps) {
+  const authorization = deps.get("authorization");
+  if (authorization === void 0 || typeof authorization.registerFlow !== "function") return false;
+  if (isGithubFlowRegistered(deps)) {
+    registeredOn.add(authorization);
+    return true;
+  }
+  if (failedOn.has(authorization)) return false;
+  try {
+    authorization.registerFlow(flowDefinition(deps));
+  } catch (error) {
+    failedOn.add(authorization);
+    deps.logger?.("auth.flow.failed", {
+      key: GITHUB_RECORD_KEY2,
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return isGithubFlowRegistered(deps);
+  }
+  registeredOn.add(authorization);
   deps.logger?.("auth.flow.registered", { key: GITHUB_RECORD_KEY2 });
+  return true;
+}
+function registerGithubFlow(deps) {
+  if (!ensureGithubFlow(deps)) deps.logger?.("auth.flow.skipped", { reason: "no-authorization-service" });
 }
+var START_TIMEOUT_MS = 1500;
+var START_POLL_MS = 10;
 async function beginGithubSignIn(deps, method = "browser") {
   const authorization = deps.get("authorization");
   if (authorization === void 0 || typeof authorization.begin !== "function") {
     throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C\u6D4F\u89C8\u5668\u767B\u5F55");
   }
+  if (!ensureGithubFlow(deps)) {
+    throw new Error("authorization \u670D\u52A1\u5C1A\u672A\u5C31\u7EEA\uFF0CGitHub \u6388\u6743\u6D41\u7A0B\u6CA1\u6709\u6CE8\u518C\u6210\u529F\uFF1A\u8BF7\u7A0D\u540E\u91CD\u8BD5");
+  }
   if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
     throw new Error("already-in-flight");
   }
+  const effectiveMethod = resolveMethod(deps, method);
+  if (effectiveMethod !== method) {
+    deps.logger?.("auth.method.fallback", { from: method, to: effectiveMethod, reason: "no-client-secret" });
+  }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
   const attempt = { phase: "idle", controller, done: Promise.resolve() };
   current = attempt;
-  attempt.done = authorization.begin({
-    key: GITHUB_RECORD_KEY2,
-    method,
-    signal: controller.signal,
-    // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
-    interaction: {
-      notify: (notice) => {
-        if (notice.code !== void 0 && notice.url !== void 0) {
-          updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
-        } else if (notice.url !== void 0) {
-          updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
-        }
-      },
-      prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
-    }
-  }).then((outcome) => {
+  let started;
+  try {
+    started = authorization.begin({
+      key: GITHUB_RECORD_KEY2,
+      method: effectiveMethod,
+      signal: controller.signal,
+      // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
+      interaction: {
+        notify: (notice) => {
+          if (notice.code !== void 0 && notice.url !== void 0) {
+            updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
+          } else if (notice.url !== void 0) {
+            updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
+          }
+        },
+        prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
+      }
+    });
+  } catch (error) {
+    clearTimeout(timer);
+    updateCurrent({ phase: "error", error: error instanceof Error ? error.message : String(error) });
+    return attemptView();
+  }
+  attempt.done = started.then((outcome) => {
     if (outcome.status === "cancelled") updateCurrent({ phase: "idle" });
   }).catch((error) => {
     updateCurrent({ phase: "error", error: error instanceof Error ? error.message : String(error) });
   }).finally(() => clearTimeout(timer));
-  await Promise.resolve();
+  await waitForStart(attempt);
   return attemptView();
 }
+async function waitForStart(attempt, timeoutMs = START_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  while (attempt.phase === "idle" && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, START_POLL_MS));
+  }
+}
 function cancelGithubSignIn(deps) {
   const authorization = deps.get("authorization");
   if (authorization !== void 0 && typeof authorization.cancel === "function") {
@@ -4392,11 +4483,16 @@ function isAuthorizationAvailable(get) {
   const authorization = get("authorization");
   return authorization !== void 0 && typeof authorization.begin === "function";
 }
+function browserSignInAvailable(deps) {
+  if (!isAuthorizationAvailable(deps.get)) return false;
+  return ensureGithubFlow(githubAuthDeps(deps));
+}
 function githubAuthDeps(deps) {
   return {
     get: deps.get,
     ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
     ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
+    ...deps.githubClientSecret === void 0 ? {} : { clientSecret: deps.githubClientSecret },
     ...deps.logger === void 0 ? {} : { logger: deps.logger }
   };
 }
@@ -4586,8 +4682,10 @@ async function dispatch(method, pathname, url, body, deps) {
     const method2 = body.method === "device" ? "device" : "browser";
     try {
       const view = await beginGithubSignIn(githubAuthDeps(deps), method2);
+      if (view.phase === "error") throw new IpcError("GITHUB_AUTH_UNAVAILABLE", redact(view.error ?? "GitHub \u767B\u5F55\u5931\u8D25"));
       return { attempt: view };
     } catch (error) {
+      if (error instanceof IpcError) throw error;
       const message = error instanceof Error ? error.message : String(error);
       if (message === "already-in-flight") {
         return { attempt: attemptView(), alreadyInFlight: true };
@@ -4733,8 +4831,13 @@ async function statePayload(deps, settings) {
       source: github.source,
       /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
       attempt: attemptView(),
-      /** 浏览器登录是否可用：核心提供了 authorization 服务即可（client_id 有内置默认）。 */
-      browserAvailable: isAuthorizationAvailable(deps.get)
+      /** 浏览器登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
+      browserAvailable: browserSignInAvailable(deps),
+      /**
+       * 回环 web flow 是否可用：GitHub 换 token 必须有 client_secret，内置 client_id 没有 → 只能设备码。
+       * 前端据此决定主按钮启动哪个 method（false 时直接用 device，避免点了必然失败的 web flow）。
+       */
+      loopbackAvailable: isLoopbackSignInAvailable(githubAuthDeps(deps))
     }
   };
 }
@@ -5013,7 +5116,7 @@ export {
   readPluginInfo,
   plugin_info_exports,
   github_exports,
-  registerGithubFlow,
+  ensureGithubFlow,
   github_auth_exports,
   import_cli_exports,
   pending_pr_exports,

package/lib/index.d.ts

@@ -10,6 +10,8 @@ interface PluginLogger {
 interface PluginContext {
     get?: (name: string) => unknown;
     effect?: (factory: () => unknown, label?: string) => unknown;
+    /** cordis 的服务就绪钩子：依赖被提供（或重提供）时回调，用于「晚到的服务」注册。 */
+    inject?: (deps: string[], callback: (scope: PluginContext) => unknown) => unknown;
     logger?: PluginLogger;
     webServer?: {
         register: (options: {
@@ -25,6 +27,7 @@ declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
     githubClientId?: string;
+    githubClientSecret?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -7,9 +7,9 @@ import {
   createTrendingHistoryTool,
   createTrendingRunTool,
   createUpdateService,
-  readPluginInfo,
-  registerGithubFlow
-} from "./chunk-LLTW4YHJ.js";
+  ensureGithubFlow,
+  readPluginInfo
+} from "./chunk-VO72OOVK.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -20,6 +20,7 @@ function readVersion() {
 var VERSION = readVersion();
 function apply(ctx, config = {}) {
   const env = process.env;
+  const githubClientSecret = (config.githubClientSecret ?? env.DSH_GITHUB_CLIENT_SECRET)?.trim();
   const get = (key) => typeof ctx.get === "function" ? ctx.get(key) : void 0;
   const log = (event, data) => {
     const suffix = data === void 0 ? "" : ` ${JSON.stringify(data)}`;
@@ -64,11 +65,22 @@ function apply(ctx, config = {}) {
     onError: (error) => ctx.logger?.warn?.(`[dsh-github-trending] \u5B9A\u65F6\u8FD0\u884C\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`)
   });
   const pluginInfo = readPluginInfo();
-  registerGithubFlow({
-    get,
+  const githubAuth = (resolve) => ({
+    get: resolve,
     logger: log,
-    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId },
+    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { clientSecret: githubClientSecret }
   });
+  const registerAuth = (resolve) => {
+    if (!ensureGithubFlow(githubAuth(resolve ?? get))) log("auth.flow.deferred", { reason: "authorization-not-ready" });
+  };
+  if (typeof ctx.inject === "function") {
+    ctx.inject(["authorization"], (scope) => {
+      registerAuth((name2) => typeof scope.get === "function" ? scope.get(name2) : void 0);
+    });
+  } else {
+    registerAuth();
+  }
   const update = createUpdateService({
     get,
     env,
@@ -90,6 +102,7 @@ function apply(ctx, config = {}) {
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
     ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
+    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { githubClientSecret },
     logger: log
   });
   const register = () => {

package/lib/internal.d.ts

@@ -1164,7 +1164,13 @@ declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callbac
 /**
  * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
  * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
- * 纯 PKCE public client，无需 client_secret。用户/部署可在 `apply(config.githubClientId)` 覆盖。
+ *
+ * ⚠️ 只有 client_id 不够：GitHub 的 web application flow 在换 token 时**仍然要求
+ * client_secret**（PKCE 是叠加保护，不能替代，2025-07 起官方也只说「推荐」而非「可免 secret」）。
+ * 因此：
+ *   - 内置 client_id → 只能走 **device flow**（`resolveMethod` 自动降级），开箱即用；
+ *   - 用户自带 OAuth App（`githubClientId` + `githubClientSecret`）→ 才启用回环 web flow。
+ * 且 device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
  *
  * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
  * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
@@ -1172,6 +1178,18 @@ declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callbac
 declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
 /** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
 declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
+/** 解析生效的 client_secret（没有就返回 undefined，绝不以空串形式发出去）。 */
+declare function resolveClientSecret(deps: GithubAuthDeps): string | undefined;
+/**
+ * 回环（浏览器 web flow）是否可用：GitHub 换 token 必须带 client_secret，
+ * 内置的公开 client_id 没有 secret，只能退到设备码。见文件头的说明。
+ */
+declare function isLoopbackSignInAvailable(deps: GithubAuthDeps): boolean;
+/**
+ * 实际要跑的方法：`browser` 需要 client_secret，缺省时自动降级为 `device`（开箱即用）。
+ * 显式选择 `device` 的调用不受影响。
+ */
+declare function resolveMethod(deps: GithubAuthDeps, requested: 'browser' | 'device'): 'browser' | 'device';
 /** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
 declare const DEFAULT_SCOPE = "repo";
 interface AuthorizationFlow {
@@ -1203,6 +1221,8 @@ interface AuthorizationLike {
         status: 'authorized' | 'cancelled';
     }>;
     cancel?: (key: string) => void;
+    /** 核心 0.2.x 有：按 key 查已注册的 flow；判定「真的注册上了」靠它。 */
+    describe?: (key: string) => unknown;
 }
 interface WebServerLike {
     register?: (route: {
@@ -1227,6 +1247,11 @@ interface GithubAuthDeps {
     };
     /** GitHub OAuth App 的 public client_id（无需 secret）。 */
     clientId?: string;
+    /**
+     * GitHub OAuth App 的 client_secret。只有自带 OAuth App 的回环 web flow 才需要；
+     * 缺省时 `browser` 方法自动降级为 device flow。不进 `settings.json`、不进日志。
+     */
+    clientSecret?: string;
     scope?: string;
     attemptTimeoutMs?: number;
 }
@@ -1264,14 +1289,35 @@ interface GithubGrantPayload {
     tokenType?: string;
     scope?: string;
 }
+/** 这个 key 现在是否**真的**有 flow 在注册表里。 */
+declare function isGithubFlowRegistered(deps: GithubAuthDeps): boolean;
+/**
+ * 幂等注册 GitHub flow；`authorization` 还没就绪时返回 false，调用方可稍后重试。
+ *
+ * 为什么不能只在 `apply()` 里试一次：宿主按「服务可用性」激活插件，本插件只
+ * `inject: ['webServer']`，apply 完全可能早于 `authorization`——后者要等
+ * `credentials` 的异步 `[Service.init]`（启动时读 `.credentials.yaml`）走完才
+ * 可见，而 `ctx.get()` 对未 active 的 provider 返回 undefined。那一刻若放弃注册，
+ * 就永久没有 flow；而可用性又是按请求现算的，于是出现「按钮亮着、点了必然
+ * NO_FLOW、界面毫无反馈」。所以注册做成可重入的自愈入口：apply 用
+ * `ctx.inject(['authorization'])` 等服务就绪，HTTP 面每次读状态再兜底一次。
+ *
+ * @returns 注册后是否可用（服务缺失 / 注册失败时为 false）。
+ */
+declare function ensureGithubFlow(deps: GithubAuthDeps): boolean;
 /**
  * 向 `ctx.authorization` 注册 GitHub flow（若核心没有该服务则降级 no-op）。
- * 在 `apply()` 里调用一次。
+ * 等价于 {@link ensureGithubFlow}，保留旧名字给 `apply()` 与测试用。
  */
 declare function registerGithubFlow(deps: GithubAuthDeps): void;
 /**
  * 启动一次浏览器登录 attempt（进程内 `authorization.begin`，不阻塞请求）。
- * @returns 当前 attempt 视图（含 authorizeUrl，供前端打开）。二次调用在已有进行中时抛错。
+ *
+ * 返回的视图保证**不是 `idle`**：要么已经进入 waiting-*，要么已经落成 `error`
+ * （供路由转成 HTTP 错误）。`idle` 只可能来自「flow 没注册」这类抢跑，前端拿到
+ * 它就会以为什么都没发生——那正是「点了没反应」的形态，所以这里把它堵掉。
+ *
+ * @throws 服务不可用、flow 未注册、已有 attempt 在飞时抛错。
  */
 declare function beginGithubSignIn(deps: GithubAuthDeps, method?: 'browser' | 'device'): Promise<GithubAttemptView>;
 /** 取消进行中的 attempt。 */
@@ -1296,12 +1342,17 @@ declare const githubAuth_beginGithubSignIn: typeof beginGithubSignIn;
 declare const githubAuth_buildAuthorizeUrl: typeof buildAuthorizeUrl;
 declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
 declare const githubAuth_createPkce: typeof createPkce;
+declare const githubAuth_ensureGithubFlow: typeof ensureGithubFlow;
+declare const githubAuth_isGithubFlowRegistered: typeof isGithubFlowRegistered;
+declare const githubAuth_isLoopbackSignInAvailable: typeof isLoopbackSignInAvailable;
 declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
 declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
 declare const githubAuth_resolveClientId: typeof resolveClientId;
+declare const githubAuth_resolveClientSecret: typeof resolveClientSecret;
+declare const githubAuth_resolveMethod: typeof resolveMethod;
 declare const githubAuth_verifyState: typeof verifyState;
 declare namespace githubAuth {
-  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_verifyState as verifyState };
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_isLoopbackSignInAvailable as isLoopbackSignInAvailable, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_resolveClientSecret as resolveClientSecret, githubAuth_resolveMethod as resolveMethod, githubAuth_verifyState as verifyState };
 }
 
 interface DefaultBranchResult {
@@ -1985,8 +2036,10 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
-    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时按钮会提示未配置）。 */
+    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
     githubClientId?: string;
+    /** 自带 OAuth App 时的 client_secret（只用于回环 web flow；缺省时该 method 自动降级为设备码）。 */
+    githubClientSecret?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;

package/lib/internal.js

@@ -27,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-LLTW4YHJ.js";
+} from "./chunk-VO72OOVK.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",