@morehao/dsh-github-trending 0.8.2 → 0.8.4

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [v0.8.4] - 2026-11-02
+
+### Features
+
+- **auth**: open device-code page with prefilled code
+- **auth**: 美化 GitHub OAuth 回调落地页 (#78)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.3...v0.8.4
+
+## [v0.8.3] - 2026-11-02
+
+### Fixes
+
+- **auth**: fall back to device flow when client_secret is missing (#75)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.2...v0.8.3
+
 ## [v0.8.2] - 2026-11-02
 
 ### Fixes

package/README.md

@@ -59,13 +59,13 @@ GitHub 趋势榜的 **DeepSeek Harness 插件**：按日 / 周 / 月周期定时
 
 认证分区支持三种方式（可随时切换）：
 
-- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token。走 OAuth PKCE + 本机回环回调（或设备码），token 由 DSH 凭据记录安全保存，不落 `settings.json`。插件内置了公开的 OAuth App client_id（client_id 属公开标识、非机密；纯 PKCE 不使用 client_secret），开箱即用。
+- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token，token 由 DSH 凭据记录安全保存、不落 `settings.json`。插件内置了公开的 OAuth App client_id，开箱即用；GitHub 的 web flow 换 token 仍然**必须带 client_secret**（PKCE 只是叠加保护），而客户端不能内置机密，所以默认走**设备码**：点一下后在打开的 GitHub 页面输入验证码即可。若你自带 OAuth App，可在插件配置里同时给 `githubClientId` + `githubClientSecret`，就会改用本机回环回调（不用手输验证码）。
 - **本机 gh**：复用你终端里 `gh auth login` 的登录态。
 - **PAT**：手工填 Personal Access Token（存到凭据引用 / 环境变量）。
 
 > 浏览器登录需要核心提供 `authorization` 服务，并且 GitHub flow 注册成功才算可用；两者任一不满足时，设置页直接提示不可用并引导改用 gh / PAT，而不是给一个点了没反应的按钮。宿主启动时服务可能晚于插件就绪，插件会等服务就绪再注册，并在读状态时再兜底一次。
 >
-> 授权页默认尝试自动打开；若被浏览器的弹窗拦截，状态行里始终有可点的「打开授权页」链接与「复制链接」。
+> 设备码 / 授权页默认尝试自动打开；若被浏览器的弹窗拦截，状态行里始终有可点的「打开授权页」链接、验证码与「复制链接」。
 
 ### 订阅
 

package/client.js

@@ -125,10 +125,10 @@ var DICT = {
     "auth.gh": "本机 gh",
     "auth.browser": "浏览器登录",
     "auth.gh.hint": "使用本机 gh 登录态：终端执行 `gh auth login` 完成登录，再点「测试认证」。",
-    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。",
+    "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。点一下会在浏览器打开授权页（验证码通常已自动填入），确认授权即可。",
     "auth.browser.signin": "用 GitHub 登录",
     "auth.browser.waiting": "等待浏览器授权…",
-    "auth.browser.code": "在打开的页面输入验证码：",
+    "auth.browser.code": "如未自动填入，请手动输入验证码：",
     "auth.browser.cancel": "取消",
     "auth.browser.done": "已登录",
     "auth.browser.device": "用设备码登录",
@@ -139,7 +139,7 @@ var DICT = {
     "auth.browser.copied": "授权链接已复制",
     "auth.browser.failed": "登录失败",
     "auth.browser.failed.detail": "登录失败：{message}",
-    "auth.browser.failed.hint": "宿主没有完成 GitHub 授权流程的注册，请重试；仍失败请改用「本机 gh」或 PAT。",
+    "auth.browser.failed.hint": "请重试一次；仍失败可改用「本机 gh」或 PAT。",
     "auth.pat.hint": "在 GitHub → Settings → Developer settings 生成 Personal Access Token（勾选 public_repo），填到下方引用或环境变量。",
     "auth.tokenRef": "凭据引用",
     "auth.tokenRef.hint": "凭据引用名 / 环境变量名",
@@ -670,10 +670,10 @@ var DICT = {
     "auth.gh": "Local gh",
     "auth.browser": "Browser login",
     "auth.gh.hint": "Uses your local gh login: run `gh auth login` in a terminal, then click Test authentication.",
-    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste.",
+    "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste. Clicking opens the authorization page with the code usually pre-filled — just confirm.",
     "auth.browser.signin": "Sign in with GitHub",
     "auth.browser.waiting": "Waiting for browser authorization…",
-    "auth.browser.code": "Enter this code on the opened page:",
+    "auth.browser.code": "If it is not filled in automatically, enter this code:",
     "auth.browser.cancel": "Cancel",
     "auth.browser.done": "Signed in",
     "auth.browser.device": "Use a device code",
@@ -684,7 +684,7 @@ var DICT = {
     "auth.browser.copied": "Authorization link copied",
     "auth.browser.failed": "Sign-in failed",
     "auth.browser.failed.detail": "Sign-in failed: {message}",
-    "auth.browser.failed.hint": "The host did not register the GitHub authorization flow. Retry, or use Local gh / a PAT instead.",
+    "auth.browser.failed.hint": "Retry once; if it keeps failing, use Local gh or a PAT instead.",
     "auth.pat.hint": "Create a Personal Access Token under GitHub → Settings → Developer settings (scope public_repo) and put it in the ref below or an env var.",
     "auth.tokenRef": "Credential ref",
     "auth.tokenRef.hint": "credential ref / env var name",
@@ -2272,6 +2272,13 @@ function SettingsView(props) {
         } catch {
         }
       }
+      const deviceUrl = view.verificationUriComplete ?? view.verificationUri;
+      if (view.phase === "waiting-device" && deviceUrl !== void 0) {
+        try {
+          window.open(deviceUrl, "_blank", "noopener,noreferrer");
+        } catch {
+        }
+      }
     } catch (error) {
       notify("err", error instanceof Error ? error.message : String(error));
     }
@@ -2348,6 +2355,7 @@ function SettingsView(props) {
   const isGh = draft.github.authMode === "gh";
   const isBrowser = draft.github.authMode === "browser";
   const browserAvailable = state.github.browserAvailable === true;
+  const loopbackAvailable = state.github.loopbackAvailable === true;
   const sections = [
     { id: "source", label: t("st.source") },
     { id: "model", label: t("st.model") },
@@ -2542,12 +2550,12 @@ function SettingsView(props) {
         {
           small: true,
           variant: "primary",
-          onClick: () => void startSignIn("browser"),
+          onClick: () => void startSignIn(loopbackAvailable ? "browser" : "device"),
           disabled: signInActive
         },
         signIn.phase === "done" && signIn.login !== void 0 ? `${t("auth.browser.done")} · @${signIn.login}` : signInActive ? t("auth.browser.waiting") : t("auth.browser.signin")
       ) : h("span", { className: "dshgt-hint" }, t("auth.browser.unavailable")),
-      browserAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
+      browserAvailable && loopbackAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
       signInActive ? h(Btn, { small: true, variant: "ghost", onClick: () => void cancelSignIn() }, t("auth.browser.cancel")) : null
     ) : h(
       Row,
@@ -2576,10 +2584,19 @@ function SettingsView(props) {
         " ",
         h(Btn, { small: true, variant: "ghost", onClick: () => copyAuthorizeLink() }, t("auth.browser.copy"))
       ) : null,
-      signIn.verificationUri !== void 0 ? h(
+      signIn.verificationUriComplete !== void 0 || signIn.verificationUri !== void 0 ? h(
         "div",
         { className: "dshgt-desc" },
-        h("a", { className: "dshgt-link", href: signIn.verificationUri, target: "_blank", rel: "noreferrer" }, signIn.verificationUri)
+        h(
+          "a",
+          {
+            className: "dshgt-link",
+            href: signIn.verificationUriComplete ?? signIn.verificationUri,
+            target: "_blank",
+            rel: "noreferrer"
+          },
+          t("auth.browser.open")
+        )
       ) : null,
       signIn.userCode !== void 0 ? h("div", { className: "dshgt-mono" }, `${t("auth.browser.code")} ${signIn.userCode}`) : null
     ) : null,

package/lib/{chunk-5D2VRWPJ.js → chunk-QOYTABJH.js}

@@ -3540,9 +3540,14 @@ __export(github_auth_exports, {
   createPkce: () => createPkce,
   ensureGithubFlow: () => ensureGithubFlow,
   isGithubFlowRegistered: () => isGithubFlowRegistered,
+  isHttpUrl: () => isHttpUrl,
+  isLoopbackSignInAvailable: () => isLoopbackSignInAvailable,
   registerGithubFlow: () => registerGithubFlow,
+  renderCallbackPage: () => renderCallbackPage,
   resetAttemptForTest: () => resetAttemptForTest,
   resolveClientId: () => resolveClientId,
+  resolveClientSecret: () => resolveClientSecret,
+  resolveMethod: () => resolveMethod,
   verifyState: () => verifyState
 });
 import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -3553,6 +3558,16 @@ function resolveClientId(deps) {
   const fromConfig = deps.clientId;
   return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
 }
+function resolveClientSecret(deps) {
+  const secret = deps.clientSecret;
+  return secret !== void 0 && secret !== "" ? secret : void 0;
+}
+function isLoopbackSignInAvailable(deps) {
+  return resolveClientSecret(deps) !== void 0;
+}
+function resolveMethod(deps, requested) {
+  return requested === "browser" && !isLoopbackSignInAvailable(deps) ? "device" : requested;
+}
 var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
 var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -3568,6 +3583,16 @@ function attemptView() {
 function base64url(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+function isHttpUrl(value) {
+  if (typeof value !== "string" || value === "") return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  return url.protocol === "https:" || url.protocol === "http:";
+}
 function createPkce() {
   const verifier = base64url(randomBytes2(32));
   const challenge = base64url(createHash3("sha256").update(verifier).digest());
@@ -3578,6 +3603,41 @@ function verifyState(received, expected) {
   const b = Buffer.from(expected);
   return a.length === b.length && timingSafeEqual2(a, b);
 }
+function renderCallbackPage(kind) {
+  const ok = kind === "success";
+  const title = ok ? "\u767B\u5F55\u5B8C\u6210" : "\u767B\u5F55\u672A\u5B8C\u6210";
+  const heading = ok ? "GitHub \u6388\u6743\u6210\u529F" : "GitHub \u6388\u6743\u5931\u8D25";
+  const body = ok ? "\u5DF2\u5B8C\u6210\u767B\u5F55\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002" : "\u6388\u6743\u6821\u9A8C\u672A\u901A\u8FC7\uFF0C\u8BF7\u56DE\u5230 DSH \u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u3002";
+  const accent = ok ? "#1f883d" : "#cf222e";
+  const icon = ok ? '<path d="M20 6 9 17l-5-5"/>' : '<path d="M18 6 6 18"/><path d="m6 6 12 12"/>';
+  const autoClose = ok ? "<script>(function(){try{setTimeout(function(){window.close()},1200)}catch(e){}})()</script>" : "";
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>${title}</title>
+<style>
+  :root{--bg:#f6f8fa;--card:#ffffff;--fg:#1f2328;--muted:#59636e;--border:#d1d9e0;--accent:${accent}}
+  @media (prefers-color-scheme:dark){:root{--bg:#0d1117;--card:#151b23;--fg:#e6edf3;--muted:#9198a1;--border:#3d444d}}
+  *{box-sizing:border-box}
+  html,body{height:100%}
+  body{margin:0;display:flex;align-items:center;justify-content:center;padding:24px;
+    background:var(--bg);color:var(--fg);
+    font:400 15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC","Hiragino Sans GB","Microsoft YaHei",sans-serif}
+  main{width:100%;max-width:400px;background:var(--card);border:1px solid var(--border);
+    border-radius:14px;padding:40px 32px;text-align:center;
+    box-shadow:0 8px 24px rgba(0,0,0,.06)}
+  .mark{width:64px;height:64px;margin:0 auto 20px;border-radius:50%;display:flex;
+    align-items:center;justify-content:center;background:color-mix(in srgb,var(--accent) 14%,transparent);color:var(--accent)}
+  .mark svg{width:30px;height:30px;fill:none;stroke:currentColor;stroke-width:2.4;stroke-linecap:round;stroke-linejoin:round}
+  h1{margin:0 0 8px;font-size:19px;font-weight:600;letter-spacing:.2px}
+  p{margin:0;color:var(--muted);font-size:14px}
+</style></head>
+<body><main role="status">
+  <div class="mark"><svg viewBox="0 0 24 24" aria-hidden="true">${icon}</svg></div>
+  <h1>${heading}</h1>
+  <p>${body}</p>
+</main>${autoClose}</body></html>`;
+}
 function buildAuthorizeUrl(params) {
   const url = new URL(params.authorizeEndpoint);
   url.searchParams.set("client_id", params.clientId);
@@ -3589,21 +3649,29 @@ function buildAuthorizeUrl(params) {
   return url.toString();
 }
 async function exchangeCode(fetchImpl, endpoint, params, signal) {
+  const form = new URLSearchParams({
+    client_id: params.clientId,
+    code: params.code,
+    code_verifier: params.verifier,
+    redirect_uri: params.redirectUri
+  });
+  if (params.clientSecret !== void 0) form.set("client_secret", params.clientSecret);
   const response = await fetchImpl(endpoint, {
     method: "POST",
     headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      client_id: params.clientId,
-      code: params.code,
-      code_verifier: params.verifier,
-      redirect_uri: params.redirectUri
-    }).toString(),
+    body: form.toString(),
     signal
   });
   if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
   const body = await response.json();
   if (typeof body.access_token !== "string" || body.access_token === "") {
-    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${typeof body.error === "string" ? `\uFF08${body.error}\uFF09` : ""}`);
+    const error = typeof body.error === "string" ? body.error : void 0;
+    if (error === "incorrect_client_credentials") {
+      throw new Error(
+        params.clientSecret === void 0 ? "GitHub \u7F51\u9875\u6388\u6743\u9700\u8981 client_secret\uFF08incorrect_client_credentials\uFF09\uFF0C\u5185\u7F6E\u7684\u516C\u5F00 client_id \u65E0\u6CD5\u5B8C\u6210\u8FD9\u4E00\u6B65\uFF1A\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF0C\u6216\u914D\u7F6E\u81EA\u5DF1\u7684 OAuth App client_id + client_secret\u3002" : "GitHub \u8BA4\u4E3A\u8FD9\u4E2A OAuth App \u7684 client_id / client_secret \u4E0D\u6B63\u786E\uFF08incorrect_client_credentials\uFF09\uFF1A\u8BF7\u68C0\u67E5\u63D2\u4EF6\u914D\u7F6E\uFF0C\u6216\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\u3002"
+      );
+    }
+    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${error === void 0 ? "" : `\uFF08${error}\uFF09`}`);
   }
   return {
     token: body.access_token,
@@ -3631,6 +3699,10 @@ async function runBrowser(deps, session) {
   }
   const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
+  const clientSecret = resolveClientSecret(deps);
+  if (clientSecret === void 0) {
+    throw new Error("\u56DE\u73AF\u767B\u5F55\u4E0D\u53EF\u7528\uFF1A\u6CA1\u6709\u914D\u7F6E GitHub OAuth App \u7684 client_secret\uFF0C\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55");
+  }
   const fetchImpl = deps.fetchImpl ?? fetch;
   const endpoints = normalizeEndpoints(deps.endpoints);
   const scope = deps.scope ?? DEFAULT_SCOPE;
@@ -3659,10 +3731,10 @@ async function runBrowser(deps, session) {
       const single = url.searchParams.getAll("state").length === 1 && url.searchParams.getAll("code").length === 1;
       const bad = req.method !== "GET" || url.pathname !== CALLBACK_PATH || !single || code === "" || !verifyState(gotState, state);
       if (bad) {
-        res.writeHead(400, { "cache-control": "no-store" }).end();
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(renderCallbackPage("error"));
         return;
       }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end('<!doctype html><meta charset="utf-8"><title>GitHub</title><p>\u5DF2\u5B8C\u6210\u767B\u5F55\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002</p>');
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(renderCallbackPage("success"));
       resolveCode(code);
     }
   });
@@ -3681,7 +3753,12 @@ async function runBrowser(deps, session) {
     session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
     const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
     updateCurrent({ phase: "exchanging" });
-    const exchanged = await exchangeCode(fetchImpl, endpoints.accessToken, { clientId, code, verifier, redirectUri }, session.signal);
+    const exchanged = await exchangeCode(
+      fetchImpl,
+      endpoints.accessToken,
+      { clientId, clientSecret, code, verifier, redirectUri },
+      session.signal
+    );
     const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
     const payload = {
       version: 1,
@@ -3711,21 +3788,26 @@ async function runDevice(deps, session) {
   if (!startResponse.ok) throw new Error(`GitHub device/code HTTP ${startResponse.status}`);
   const start = await startResponse.json();
   if (typeof start.device_code !== "string" || typeof start.user_code !== "string" || typeof start.verification_uri !== "string") {
-    throw new Error("GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574");
+    const error = typeof start.error === "string" ? start.error : void 0;
+    throw new Error(
+      error === "device_flow_disabled" ? "GitHub \u6CA1\u6709\u4E3A\u8FD9\u4E2A OAuth App \u542F\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF1A\u8BF7\u5230 OAuth App \u8BBE\u7F6E\u52FE\u9009 Device flow\uFF0C\u6216\u6539\u7528\u300C\u672C\u673A gh\u300D/ PAT\u3002" : `GitHub device/code \u8FD4\u56DE\u4E0D\u5B8C\u6574${error === void 0 ? "" : `\uFF08${error}\uFF09`}`
+    );
   }
   const deviceCode = start.device_code;
   const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
   const expiresInSec = typeof start.expires_in === "number" && start.expires_in > 0 ? start.expires_in : 900;
   const deadline = Date.now() + expiresInSec * 1e3;
+  const verificationUriComplete = isHttpUrl(start.verification_uri_complete) ? start.verification_uri_complete : void 0;
   updateCurrent({
     phase: "waiting-device",
     verificationUri: start.verification_uri,
+    ...verificationUriComplete === void 0 ? {} : { verificationUriComplete },
     userCode: start.user_code,
     expiresAt: deadline
   });
   session.notify?.({
     message: "Enter this code on the verification page to finish signing in.",
-    url: start.verification_uri,
+    url: verificationUriComplete ?? start.verification_uri,
     code: start.user_code
   });
   let waitMs = intervalSec * 1e3;
@@ -3829,6 +3911,10 @@ async function beginGithubSignIn(deps, method = "browser") {
   if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
     throw new Error("already-in-flight");
   }
+  const effectiveMethod = resolveMethod(deps, method);
+  if (effectiveMethod !== method) {
+    deps.logger?.("auth.method.fallback", { from: method, to: effectiveMethod, reason: "no-client-secret" });
+  }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
   const attempt = { phase: "idle", controller, done: Promise.resolve() };
@@ -3837,13 +3923,13 @@ async function beginGithubSignIn(deps, method = "browser") {
   try {
     started = authorization.begin({
       key: GITHUB_RECORD_KEY2,
-      method,
+      method: effectiveMethod,
       signal: controller.signal,
       // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
       interaction: {
         notify: (notice) => {
           if (notice.code !== void 0 && notice.url !== void 0) {
-            updateCurrent({ phase: "waiting-device", verificationUri: notice.url, userCode: notice.code });
+            updateCurrent({ phase: "waiting-device", userCode: notice.code });
           } else if (notice.url !== void 0) {
             updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
           }
@@ -4455,6 +4541,7 @@ function githubAuthDeps(deps) {
     get: deps.get,
     ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
     ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
+    ...deps.githubClientSecret === void 0 ? {} : { clientSecret: deps.githubClientSecret },
     ...deps.logger === void 0 ? {} : { logger: deps.logger }
   };
 }
@@ -4794,7 +4881,12 @@ async function statePayload(deps, settings) {
       /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
       attempt: attemptView(),
       /** 浏览器登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
-      browserAvailable: browserSignInAvailable(deps)
+      browserAvailable: browserSignInAvailable(deps),
+      /**
+       * 回环 web flow 是否可用：GitHub 换 token 必须有 client_secret，内置 client_id 没有 → 只能设备码。
+       * 前端据此决定主按钮启动哪个 method（false 时直接用 device，避免点了必然失败的 web flow）。
+       */
+      loopbackAvailable: isLoopbackSignInAvailable(githubAuthDeps(deps))
     }
   };
 }

package/lib/index.d.ts

@@ -27,6 +27,7 @@ declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
     githubClientId?: string;
+    githubClientSecret?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -9,7 +9,7 @@ import {
   createUpdateService,
   ensureGithubFlow,
   readPluginInfo
-} from "./chunk-5D2VRWPJ.js";
+} from "./chunk-QOYTABJH.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -20,6 +20,7 @@ function readVersion() {
 var VERSION = readVersion();
 function apply(ctx, config = {}) {
   const env = process.env;
+  const githubClientSecret = (config.githubClientSecret ?? env.DSH_GITHUB_CLIENT_SECRET)?.trim();
   const get = (key) => typeof ctx.get === "function" ? ctx.get(key) : void 0;
   const log = (event, data) => {
     const suffix = data === void 0 ? "" : ` ${JSON.stringify(data)}`;
@@ -67,7 +68,8 @@ function apply(ctx, config = {}) {
   const githubAuth = (resolve) => ({
     get: resolve,
     logger: log,
-    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId },
+    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { clientSecret: githubClientSecret }
   });
   const registerAuth = (resolve) => {
     if (!ensureGithubFlow(githubAuth(resolve ?? get))) log("auth.flow.deferred", { reason: "authorization-not-ready" });
@@ -100,6 +102,7 @@ function apply(ctx, config = {}) {
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
     ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
+    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { githubClientSecret },
     logger: log
   });
   const register = () => {

package/lib/internal.d.ts

@@ -1164,7 +1164,13 @@ declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callbac
 /**
  * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
  * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
- * 纯 PKCE public client，无需 client_secret。用户/部署可在 `apply(config.githubClientId)` 覆盖。
+ *
+ * ⚠️ 只有 client_id 不够：GitHub 的 web application flow 在换 token 时**仍然要求
+ * client_secret**（PKCE 是叠加保护，不能替代，2025-07 起官方也只说「推荐」而非「可免 secret」）。
+ * 因此：
+ *   - 内置 client_id → 只能走 **device flow**（`resolveMethod` 自动降级），开箱即用；
+ *   - 用户自带 OAuth App（`githubClientId` + `githubClientSecret`）→ 才启用回环 web flow。
+ * 且 device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
  *
  * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
  * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
@@ -1172,6 +1178,18 @@ declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callbac
 declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
 /** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
 declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
+/** 解析生效的 client_secret（没有就返回 undefined，绝不以空串形式发出去）。 */
+declare function resolveClientSecret(deps: GithubAuthDeps): string | undefined;
+/**
+ * 回环（浏览器 web flow）是否可用：GitHub 换 token 必须带 client_secret，
+ * 内置的公开 client_id 没有 secret，只能退到设备码。见文件头的说明。
+ */
+declare function isLoopbackSignInAvailable(deps: GithubAuthDeps): boolean;
+/**
+ * 实际要跑的方法：`browser` 需要 client_secret，缺省时自动降级为 `device`（开箱即用）。
+ * 显式选择 `device` 的调用不受影响。
+ */
+declare function resolveMethod(deps: GithubAuthDeps, requested: 'browser' | 'device'): 'browser' | 'device';
 /** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
 declare const DEFAULT_SCOPE = "repo";
 interface AuthorizationFlow {
@@ -1229,6 +1247,11 @@ interface GithubAuthDeps {
     };
     /** GitHub OAuth App 的 public client_id（无需 secret）。 */
     clientId?: string;
+    /**
+     * GitHub OAuth App 的 client_secret。只有自带 OAuth App 的回环 web flow 才需要；
+     * 缺省时 `browser` 方法自动降级为 device flow。不进 `settings.json`、不进日志。
+     */
+    clientSecret?: string;
     scope?: string;
     attemptTimeoutMs?: number;
 }
@@ -1237,12 +1260,16 @@ interface GithubAttemptView {
     phase: GithubAttemptPhase;
     authorizeUrl?: string;
     verificationUri?: string;
+    /** device flow 预填验证码的地址（GitHub 返回的 `verification_uri_complete`）：打开只需点授权。 */
+    verificationUriComplete?: string;
     userCode?: string;
     expiresAt?: number;
     login?: string;
     error?: string;
 }
 declare function attemptView(): GithubAttemptView;
+/** 判断一个未知值是否是可直接打开的 http(s) URL（用于校验 GitHub 返回的验证页地址）。 */
+declare function isHttpUrl(value: unknown): boolean;
 /** PKCE：返回 verifier 与 S256 challenge。 */
 declare function createPkce(): {
     verifier: string;
@@ -1250,6 +1277,13 @@ declare function createPkce(): {
 };
 /** 常量时间比较 state（长度不等直接 false，避免 timingSafeEqual 抛错）。 */
 declare function verifyState(received: string, expected: string): boolean;
+/** 回调落地页的两种结果（纯展示，无外部资源，离线可测）。 */
+type CallbackPageKind = 'success' | 'error';
+/**
+ * 回环回调的落地页 HTML。自包含、无外链资源（CSP 友好、离线可用），
+ * 跟随系统深浅色；成功页会尝试自动关闭本窗口（脚本失败时文字兜底）。
+ */
+declare function renderCallbackPage(kind: CallbackPageKind): string;
 /** 拼授权页 URL。 */
 declare function buildAuthorizeUrl(params: {
     authorizeEndpoint: string;
@@ -1321,12 +1355,17 @@ declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
 declare const githubAuth_createPkce: typeof createPkce;
 declare const githubAuth_ensureGithubFlow: typeof ensureGithubFlow;
 declare const githubAuth_isGithubFlowRegistered: typeof isGithubFlowRegistered;
+declare const githubAuth_isHttpUrl: typeof isHttpUrl;
+declare const githubAuth_isLoopbackSignInAvailable: typeof isLoopbackSignInAvailable;
 declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
+declare const githubAuth_renderCallbackPage: typeof renderCallbackPage;
 declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
 declare const githubAuth_resolveClientId: typeof resolveClientId;
+declare const githubAuth_resolveClientSecret: typeof resolveClientSecret;
+declare const githubAuth_resolveMethod: typeof resolveMethod;
 declare const githubAuth_verifyState: typeof verifyState;
 declare namespace githubAuth {
-  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_verifyState as verifyState };
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_isHttpUrl as isHttpUrl, githubAuth_isLoopbackSignInAvailable as isLoopbackSignInAvailable, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_renderCallbackPage as renderCallbackPage, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_resolveClientSecret as resolveClientSecret, githubAuth_resolveMethod as resolveMethod, githubAuth_verifyState as verifyState };
 }
 
 interface DefaultBranchResult {
@@ -2010,8 +2049,10 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
-    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时按钮会提示未配置）。 */
+    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
     githubClientId?: string;
+    /** 自带 OAuth App 时的 client_secret（只用于回环 web flow；缺省时该 method 自动降级为设备码）。 */
+    githubClientSecret?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;

package/lib/internal.js

@@ -27,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-5D2VRWPJ.js";
+} from "./chunk-QOYTABJH.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",