@morehao/dsh-github-trending 0.8.2 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [v0.8.3] - 2026-11-02
+
+### Fixes
+
+- **auth**: fall back to device flow when client_secret is missing (#75)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.2...v0.8.3
+
 ## [v0.8.2] - 2026-11-02
 
 ### Fixes

package/README.md

@@ -59,13 +59,13 @@ GitHub 趋势榜的 **DeepSeek Harness 插件**：按日 / 周 / 月周期定时
 
 认证分区支持三种方式（可随时切换）：
 
-- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token。走 OAuth PKCE + 本机回环回调（或设备码），token 由 DSH 凭据记录安全保存，不落 `settings.json`。插件内置了公开的 OAuth App client_id（client_id 属公开标识、非机密；纯 PKCE 不使用 client_secret），开箱即用。
+- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token，token 由 DSH 凭据记录安全保存、不落 `settings.json`。插件内置了公开的 OAuth App client_id，开箱即用；GitHub 的 web flow 换 token 仍然**必须带 client_secret**（PKCE 只是叠加保护），而客户端不能内置机密，所以默认走**设备码**：点一下后在打开的 GitHub 页面输入验证码即可。若你自带 OAuth App，可在插件配置里同时给 `githubClientId` + `githubClientSecret`，就会改用本机回环回调（不用手输验证码）。
 - **本机 gh**：复用你终端里 `gh auth login` 的登录态。
 - **PAT**：手工填 Personal Access Token（存到凭据引用 / 环境变量）。
 
 > 浏览器登录需要核心提供 `authorization` 服务，并且 GitHub flow 注册成功才算可用；两者任一不满足时，设置页直接提示不可用并引导改用 gh / PAT，而不是给一个点了没反应的按钮。宿主启动时服务可能晚于插件就绪，插件会等服务就绪再注册，并在读状态时再兜底一次。
 >
-> 授权页默认尝试自动打开；若被浏览器的弹窗拦截，状态行里始终有可点的「打开授权页」链接与「复制链接」。
+> 设备码 / 授权页默认尝试自动打开；若被浏览器的弹窗拦截，状态行里始终有可点的「打开授权页」链接、验证码与「复制链接」。
 
 ### 订阅
 

package/client.js

@@ -125,7 +125,7 @@ var DICT = {
     "auth.gh": "本机 gh",
     "auth.browser": "浏览器登录",
     "auth.gh.hint": "使用本机 gh 登录态：终端执行 `gh auth login` 完成登录，再点「测试认证」。",
-    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。",
+    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。默认走设备码：点一下后按提示输入验证码。",
     "auth.browser.signin": "用 GitHub 登录",
     "auth.browser.waiting": "等待浏览器授权…",
     "auth.browser.code": "在打开的页面输入验证码：",
@@ -139,7 +139,7 @@ var DICT = {
     "auth.browser.copied": "授权链接已复制",
     "auth.browser.failed": "登录失败",
     "auth.browser.failed.detail": "登录失败：{message}",
-    "auth.browser.failed.hint": "宿主没有完成 GitHub 授权流程的注册，请重试；仍失败请改用「本机 gh」或 PAT。",
+    "auth.browser.failed.hint": "请重试一次；仍失败可改用「本机 gh」或 PAT。",
     "auth.pat.hint": "在 GitHub → Settings → Developer settings 生成 Personal Access Token（勾选 public_repo），填到下方引用或环境变量。",
     "auth.tokenRef": "凭据引用",
     "auth.tokenRef.hint": "凭据引用名 / 环境变量名",
@@ -670,7 +670,7 @@ var DICT = {
     "auth.gh": "Local gh",
     "auth.browser": "Browser login",
     "auth.gh.hint": "Uses your local gh login: run `gh auth login` in a terminal, then click Test authentication.",
-    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste.",
+    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste. Uses a device code by default: enter the code on the GitHub page after clicking.",
     "auth.browser.signin": "Sign in with GitHub",
     "auth.browser.waiting": "Waiting for browser authorization…",
     "auth.browser.code": "Enter this code on the opened page:",
@@ -684,7 +684,7 @@ var DICT = {
     "auth.browser.copied": "Authorization link copied",
     "auth.browser.failed": "Sign-in failed",
     "auth.browser.failed.detail": "Sign-in failed: {message}",
-    "auth.browser.failed.hint": "The host did not register the GitHub authorization flow. Retry, or use Local gh / a PAT instead.",
+    "auth.browser.failed.hint": "Retry once; if it keeps failing, use Local gh or a PAT instead.",
     "auth.pat.hint": "Create a Personal Access Token under GitHub → Settings → Developer settings (scope public_repo) and put it in the ref below or an env var.",
     "auth.tokenRef": "Credential ref",
     "auth.tokenRef.hint": "credential ref / env var name",
@@ -2272,6 +2272,12 @@ function SettingsView(props) {
         } catch {
         }
       }
+      if (view.phase === "waiting-device" && view.verificationUri !== void 0) {
+        try {
+          window.open(view.verificationUri, "_blank", "noopener,noreferrer");
+        } catch {
+        }
+      }
     } catch (error) {
       notify("err", error instanceof Error ? error.message : String(error));
     }
@@ -2348,6 +2354,7 @@ function SettingsView(props) {
   const isGh = draft.github.authMode === "gh";
   const isBrowser = draft.github.authMode === "browser";
   const browserAvailable = state.github.browserAvailable === true;
+  const loopbackAvailable = state.github.loopbackAvailable === true;
   const sections = [
     { id: "source", label: t("st.source") },
     { id: "model", label: t("st.model") },
@@ -2542,12 +2549,12 @@ function SettingsView(props) {
         {
           small: true,
           variant: "primary",
-          onClick: () => void startSignIn("browser"),
+          onClick: () => void startSignIn(loopbackAvailable ? "browser" : "device"),
           disabled: signInActive
         },
         signIn.phase === "done" && signIn.login !== void 0 ? `${t("auth.browser.done")} · @${signIn.login}` : signInActive ? t("auth.browser.waiting") : t("auth.browser.signin")
       ) : h("span", { className: "dshgt-hint" }, t("auth.browser.unavailable")),
-      browserAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
+      browserAvailable && loopbackAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
       signInActive ? h(Btn, { small: true, variant: "ghost", onClick: () => void cancelSignIn() }, t("auth.browser.cancel")) : null
     ) : h(
       Row,

package/lib/{chunk-5D2VRWPJ.js → chunk-VO72OOVK.js}

@@ -3540,9 +3540,12 @@ __export(github_auth_exports, {
   createPkce: () => createPkce,
   ensureGithubFlow: () => ensureGithubFlow,
   isGithubFlowRegistered: () => isGithubFlowRegistered,
+  isLoopbackSignInAvailable: () => isLoopbackSignInAvailable,
   registerGithubFlow: () => registerGithubFlow,
   resetAttemptForTest: () => resetAttemptForTest,
   resolveClientId: () => resolveClientId,
+  resolveClientSecret: () => resolveClientSecret,
+  resolveMethod: () => resolveMethod,
   verifyState: () => verifyState
 });
 import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -3553,6 +3556,16 @@ function resolveClientId(deps) {
   const fromConfig = deps.clientId;
   return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
 }
+function resolveClientSecret(deps) {
+  const secret = deps.clientSecret;
+  return secret !== void 0 && secret !== "" ? secret : void 0;
+}
+function isLoopbackSignInAvailable(deps) {
+  return resolveClientSecret(deps) !== void 0;
+}
+function resolveMethod(deps, requested) {
+  return requested === "browser" && !isLoopbackSignInAvailable(deps) ? "device" : requested;
+}
 var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
 var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -3589,21 +3602,29 @@ function buildAuthorizeUrl(params) {
   return url.toString();
 }
 async function exchangeCode(fetchImpl, endpoint, params, signal) {
+  const form = new URLSearchParams({
+    client_id: params.clientId,
+    code: params.code,
+    code_verifier: params.verifier,
+    redirect_uri: params.redirectUri
+  });
+  if (params.clientSecret !== void 0) form.set("client_secret", params.clientSecret);
   const response = await fetchImpl(endpoint, {
     method: "POST",
     headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      client_id: params.clientId,
-      code: params.code,
-      code_verifier: params.verifier,
-      redirect_uri: params.redirectUri
-    }).toString(),
+    body: form.toString(),
     signal
   });
   if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
   const body = await response.json();
   if (typeof body.access_token !== "string" || body.access_token === "") {
-    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${typeof body.error === "string" ? `\uFF08${body.error}\uFF09` : ""}`);
+    const error = typeof body.error === "string" ? body.error : void 0;
+    if (error === "incorrect_client_credentials") {
+      throw new Error(
+        params.clientSecret === void 0 ? "GitHub \u7F51\u9875\u6388\u6743\u9700\u8981 client_secret\uFF08incorrect_client_credentials\uFF09\uFF0C\u5185\u7F6E\u7684\u516C\u5F00 client_id \u65E0\u6CD5\u5B8C\u6210\u8FD9\u4E00\u6B65\uFF1A\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF0C\u6216\u914D\u7F6E\u81EA\u5DF1\u7684 OAuth App client_id + client_secret\u3002" : "GitHub \u8BA4\u4E3A\u8FD9\u4E2A OAuth App \u7684 client_id / client_secret \u4E0D\u6B63\u786E\uFF08incorrect_client_credentials\uFF09\uFF1A\u8BF7\u68C0\u67E5\u63D2\u4EF6\u914D\u7F6E\uFF0C\u6216\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\u3002"
+      );
+    }
+    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${error === void 0 ? "" : `\uFF08${error}\uFF09`}`);
   }
   return {
     token: body.access_token,
@@ -3631,6 +3652,10 @@ async function runBrowser(deps, session) {
   }
   const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const clientSecret = resolveClientSecret(deps);
+  if (clientSecret === void 0) {
+    throw new Error("\u56DE\u73AF\u767B\u5F55\u4E0D\u53EF\u7528\uFF1A\u6CA1\u6709\u914D\u7F6E GitHub OAuth App \u7684 client_secret\uFF0C\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55");
+  }
   const fetchImpl = deps.fetchImpl ?? fetch;
   const endpoints = normalizeEndpoints(deps.endpoints);
   const scope = deps.scope ?? DEFAULT_SCOPE;
@@ -3681,7 +3706,12 @@ async function runBrowser(deps, session) {
     session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
     const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
     updateCurrent({ phase: "exchanging" });
-    const exchanged = await exchangeCode(fetchImpl, endpoints.accessToken, { clientId, code, verifier, redirectUri }, session.signal);
+    const exchanged = await exchangeCode(
+      fetchImpl,
+      endpoints.accessToken,
+      { clientId, clientSecret, code, verifier, redirectUri },
+      session.signal
+    );
     const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
     const payload = {
       version: 1,
@@ -3711,7 +3741,10 @@ async function runDevice(deps, session) {
   if (!startResponse.ok) throw new Error(`GitHub device/code HTTP ${startResponse.status}`);
   const start = await startResponse.json();
   if (typeof start.device_code !== "string" || typeof start.user_code !== "string" || typeof start.verification_uri !== "string") {
-    throw new Error("GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574");
+    const error = typeof start.error === "string" ? start.error : void 0;
+    throw new Error(
+      error === "device_flow_disabled" ? "GitHub \u6CA1\u6709\u4E3A\u8FD9\u4E2A OAuth App \u542F\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF1A\u8BF7\u5230 OAuth App \u8BBE\u7F6E\u52FE\u9009 Device flow\uFF0C\u6216\u6539\u7528\u300C\u672C\u673A gh\u300D/ PAT\u3002" : `GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574${error === void 0 ? "" : `\uFF08${error}\uFF09`}`
+    );
   }
   const deviceCode = start.device_code;
   const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
@@ -3829,6 +3862,10 @@ async function beginGithubSignIn(deps, method = "browser") {
   if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
     throw new Error("already-in-flight");
   }
+  const effectiveMethod = resolveMethod(deps, method);
+  if (effectiveMethod !== method) {
+    deps.logger?.("auth.method.fallback", { from: method, to: effectiveMethod, reason: "no-client-secret" });
+  }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
   const attempt = { phase: "idle", controller, done: Promise.resolve() };
@@ -3837,7 +3874,7 @@ async function beginGithubSignIn(deps, method = "browser") {
   try {
     started = authorization.begin({
       key: GITHUB_RECORD_KEY2,
-      method,
+      method: effectiveMethod,
       signal: controller.signal,
       // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
       interaction: {
@@ -4455,6 +4492,7 @@ function githubAuthDeps(deps) {
     get: deps.get,
     ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
     ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
+    ...deps.githubClientSecret === void 0 ? {} : { clientSecret: deps.githubClientSecret },
     ...deps.logger === void 0 ? {} : { logger: deps.logger }
   };
 }
@@ -4794,7 +4832,12 @@ async function statePayload(deps, settings) {
       /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
       attempt: attemptView(),
       /** 浏览器登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
-      browserAvailable: browserSignInAvailable(deps)
+      browserAvailable: browserSignInAvailable(deps),
+      /**
+       * 回环 web flow 是否可用：GitHub 换 token 必须有 client_secret，内置 client_id 没有 → 只能设备码。
+       * 前端据此决定主按钮启动哪个 method（false 时直接用 device，避免点了必然失败的 web flow）。
+       */
+      loopbackAvailable: isLoopbackSignInAvailable(githubAuthDeps(deps))
     }
   };
 }

package/lib/index.d.ts

@@ -27,6 +27,7 @@ declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
     githubClientId?: string;
+    githubClientSecret?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -9,7 +9,7 @@ import {
   createUpdateService,
   ensureGithubFlow,
   readPluginInfo
-} from "./chunk-5D2VRWPJ.js";
+} from "./chunk-VO72OOVK.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -20,6 +20,7 @@ function readVersion() {
 var VERSION = readVersion();
 function apply(ctx, config = {}) {
   const env = process.env;
+  const githubClientSecret = (config.githubClientSecret ?? env.DSH_GITHUB_CLIENT_SECRET)?.trim();
   const get = (key) => typeof ctx.get === "function" ? ctx.get(key) : void 0;
   const log = (event, data) => {
     const suffix = data === void 0 ? "" : ` ${JSON.stringify(data)}`;
@@ -67,7 +68,8 @@ function apply(ctx, config = {}) {
   const githubAuth = (resolve) => ({
     get: resolve,
     logger: log,
-    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId },
+    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { clientSecret: githubClientSecret }
   });
   const registerAuth = (resolve) => {
     if (!ensureGithubFlow(githubAuth(resolve ?? get))) log("auth.flow.deferred", { reason: "authorization-not-ready" });
@@ -100,6 +102,7 @@ function apply(ctx, config = {}) {
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
     ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
+    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { githubClientSecret },
     logger: log
   });
   const register = () => {

package/lib/internal.d.ts

@@ -1164,7 +1164,13 @@ declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callbac
 /**
  * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
  * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
- * 纯 PKCE public client，无需 client_secret。用户/部署可在 `apply(config.githubClientId)` 覆盖。
+ *
+ * ⚠️ 只有 client_id 不够：GitHub 的 web application flow 在换 token 时**仍然要求
+ * client_secret**（PKCE 是叠加保护，不能替代，2025-07 起官方也只说「推荐」而非「可免 secret」）。
+ * 因此：
+ *   - 内置 client_id → 只能走 **device flow**（`resolveMethod` 自动降级），开箱即用；
+ *   - 用户自带 OAuth App（`githubClientId` + `githubClientSecret`）→ 才启用回环 web flow。
+ * 且 device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
  *
  * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
  * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
@@ -1172,6 +1178,18 @@ declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callbac
 declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
 /** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
 declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
+/** 解析生效的 client_secret（没有就返回 undefined，绝不以空串形式发出去）。 */
+declare function resolveClientSecret(deps: GithubAuthDeps): string | undefined;
+/**
+ * 回环（浏览器 web flow）是否可用：GitHub 换 token 必须带 client_secret，
+ * 内置的公开 client_id 没有 secret，只能退到设备码。见文件头的说明。
+ */
+declare function isLoopbackSignInAvailable(deps: GithubAuthDeps): boolean;
+/**
+ * 实际要跑的方法：`browser` 需要 client_secret，缺省时自动降级为 `device`（开箱即用）。
+ * 显式选择 `device` 的调用不受影响。
+ */
+declare function resolveMethod(deps: GithubAuthDeps, requested: 'browser' | 'device'): 'browser' | 'device';
 /** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
 declare const DEFAULT_SCOPE = "repo";
 interface AuthorizationFlow {
@@ -1229,6 +1247,11 @@ interface GithubAuthDeps {
     };
     /** GitHub OAuth App 的 public client_id（无需 secret）。 */
     clientId?: string;
+    /**
+     * GitHub OAuth App 的 client_secret。只有自带 OAuth App 的回环 web flow 才需要；
+     * 缺省时 `browser` 方法自动降级为 device flow。不进 `settings.json`、不进日志。
+     */
+    clientSecret?: string;
     scope?: string;
     attemptTimeoutMs?: number;
 }
@@ -1321,12 +1344,15 @@ declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
 declare const githubAuth_createPkce: typeof createPkce;
 declare const githubAuth_ensureGithubFlow: typeof ensureGithubFlow;
 declare const githubAuth_isGithubFlowRegistered: typeof isGithubFlowRegistered;
+declare const githubAuth_isLoopbackSignInAvailable: typeof isLoopbackSignInAvailable;
 declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
 declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
 declare const githubAuth_resolveClientId: typeof resolveClientId;
+declare const githubAuth_resolveClientSecret: typeof resolveClientSecret;
+declare const githubAuth_resolveMethod: typeof resolveMethod;
 declare const githubAuth_verifyState: typeof verifyState;
 declare namespace githubAuth {
-  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_verifyState as verifyState };
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_isLoopbackSignInAvailable as isLoopbackSignInAvailable, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_resolveClientSecret as resolveClientSecret, githubAuth_resolveMethod as resolveMethod, githubAuth_verifyState as verifyState };
 }
 
 interface DefaultBranchResult {
@@ -2010,8 +2036,10 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
-    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时按钮会提示未配置）。 */
+    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
     githubClientId?: string;
+    /** 自带 OAuth App 时的 client_secret（只用于回环 web flow；缺省时该 method 自动降级为设备码）。 */
+    githubClientSecret?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;

package/lib/internal.js

@@ -27,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-5D2VRWPJ.js";
+} from "./chunk-VO72OOVK.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",