@morehao/dsh-github-trending 0.8.5 → 0.8.6

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [v0.8.6] - 2026-11-02
+
+### Features
+
+- **auth**: device-code sign-in modal with prominent code (#82)
+
+### Refactors
+
+- **auth**: drop loopback web flow, keep device flow only (#81)
+
+**Full Changelog**: https://github.com/morehao/dsh-github-trending/compare/v0.8.5...v0.8.6
+
 ## [v0.8.5] - 2026-11-02
 
 ### Fixes

package/README.md

@@ -59,7 +59,7 @@ GitHub 趋势榜的 **DeepSeek Harness 插件**：按日 / 周 / 月周期定时
 
 认证分区支持三种方式（可随时切换）：
 
-- **浏览器登录（默认推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token，token 由 DSH 凭据记录安全保存、不落 `settings.json`。插件内置了公开的 OAuth App client_id，开箱即用；GitHub 的 web flow 换 token 仍然**必须带 client_secret**（PKCE 只是叠加保护），而客户端不能内置机密，所以默认走**设备码**：点一下后在打开的 GitHub 页面输入验证码即可。若你自带 OAuth App，可在插件配置里同时给 `githubClientId` + `githubClientSecret`，就会改用本机回环回调（不用手输验证码）。
+- **浏览器登录（推荐）**：点「用 GitHub 登录」在浏览器完成授权，无需手工粘贴 token，token 由 DSH 凭据记录安全保存、不落 `settings.json`。插件内置了公开的 OAuth App client_id，开箱即用。GitHub 的 web flow 换 token 必须带 client_secret（客户端不能内置机密），所以走**设备码**：点一下打开 GitHub 验证页，把页面上的验证码（设置页可一键复制）输入并确认即可。
 - **本机 gh**：复用你终端里 `gh auth login` 的登录态。
 - **PAT**：手工填 Personal Access Token（存到凭据引用 / 环境变量）。
 

package/client.js

@@ -127,19 +127,22 @@ var DICT = {
     "auth.gh.hint": "使用本机 gh 登录态：终端执行 `gh auth login` 完成登录，再点「测试认证」。",
     "auth.browser.hint": "在浏览器里完成 GitHub 授权，token 由 DSH 安全保存，无需手工粘贴。点一下会打开 GitHub 验证页，把下方验证码输入并确认即可。",
     "auth.browser.signin": "用 GitHub 登录",
-    "auth.browser.waiting": "等待浏览器授权…",
-    "auth.browser.code": "验证码：",
     "auth.browser.copyCode": "复制验证码",
     "auth.browser.codeCopied": "验证码已复制",
     "auth.browser.codeCopyFailed": "复制失败，请手动记下验证码",
     "auth.browser.cancel": "取消",
     "auth.browser.done": "已登录",
-    "auth.browser.device": "用设备码登录",
     "auth.browser.unavailable": "宿主的 authorization 服务不可用（或 GitHub 授权流程没注册成功）：请重试一次；仍不行就改用「本机 gh」或 PAT。",
-    "auth.browser.openHint": "若浏览器没有自动打开，点下面的链接完成授权，或复制链接：",
-    "auth.browser.open": "打开授权页",
-    "auth.browser.copy": "复制链接",
-    "auth.browser.copied": "授权链接已复制",
+    "auth.modal.title": "用 GitHub 登录",
+    "auth.modal.lead": "在浏览器中打开 GitHub，输入下面的验证码完成授权。",
+    "auth.modal.openPage": "打开 GitHub 验证页",
+    "auth.modal.waiting": "等待授权中…",
+    "auth.modal.exchanging": "授权成功，正在换取令牌…",
+    "auth.modal.requesting": "正在向 GitHub 申请验证码…",
+    "auth.modal.retry": "重试",
+    "auth.modal.close": "关闭",
+    "auth.modal.closeHint": "关窗不取消，可随时回来查看。",
+    "auth.modal.viewCode": "查看验证码",
     "auth.browser.failed": "登录失败",
     "auth.browser.failed.detail": "登录失败：{message}",
     "auth.browser.failed.hint": "请重试一次；仍失败可改用「本机 gh」或 PAT。",
@@ -675,19 +678,22 @@ var DICT = {
     "auth.gh.hint": "Uses your local gh login: run `gh auth login` in a terminal, then click Test authentication.",
     "auth.browser.hint": "Authorize GitHub in your browser; DSH stores the token securely, no manual paste. Clicking opens the GitHub verification page — enter the code below and confirm.",
     "auth.browser.signin": "Sign in with GitHub",
-    "auth.browser.waiting": "Waiting for browser authorization…",
-    "auth.browser.code": "Verification code:",
     "auth.browser.copyCode": "Copy code",
     "auth.browser.codeCopied": "Code copied",
     "auth.browser.codeCopyFailed": "Copy failed — please note the code manually",
     "auth.browser.cancel": "Cancel",
     "auth.browser.done": "Signed in",
-    "auth.browser.device": "Use a device code",
     "auth.browser.unavailable": "The host authorization service is unavailable (or the GitHub flow did not register): retry once, then fall back to Local gh or a PAT.",
-    "auth.browser.openHint": "If the browser did not open, use the link below to finish signing in, or copy the link:",
-    "auth.browser.open": "Open authorization page",
-    "auth.browser.copy": "Copy link",
-    "auth.browser.copied": "Authorization link copied",
+    "auth.modal.title": "Sign in with GitHub",
+    "auth.modal.lead": "Open GitHub in your browser and enter the code below to authorize.",
+    "auth.modal.openPage": "Open GitHub verification page",
+    "auth.modal.waiting": "Waiting for authorization…",
+    "auth.modal.exchanging": "Authorized — exchanging for token…",
+    "auth.modal.requesting": "Requesting a device code from GitHub…",
+    "auth.modal.retry": "Retry",
+    "auth.modal.close": "Close",
+    "auth.modal.closeHint": "Closing keeps the attempt running; reopen anytime.",
+    "auth.modal.viewCode": "View code",
     "auth.browser.failed": "Sign-in failed",
     "auth.browser.failed.detail": "Sign-in failed: {message}",
     "auth.browser.failed.hint": "Retry once; if it keeps failing, use Local gh or a PAT instead.",
@@ -1238,6 +1244,20 @@ var CSS = `
 .dshgt-modal-mask{position:fixed;inset:0;background:var(--dsw-alias-bg-mask-1,rgba(15,23,42,.38));display:flex;align-items:center;justify-content:center;z-index:2147483000;}
 .dshgt-modal{background:var(--gt-bg);border-radius:12px;border:1px solid var(--gt-border);max-width:640px;width:calc(100% - 32px);max-height:80vh;overflow:auto;padding:16px;display:flex;flex-direction:column;gap:10px;box-shadow:0 20px 50px rgba(15,23,42,.25);}
 
+/* ——— GitHub 设备码登录弹窗 ——— */
+.dshgt-authmodal{max-width:420px;gap:14px;}
+.dshgt-authmodal-head{display:flex;align-items:center;justify-content:space-between;gap:8px;}
+.dshgt-authmodal-x{border:0;background:transparent;color:var(--gt-muted);font-size:14px;line-height:1;cursor:pointer;padding:4px 6px;border-radius:6px;}
+.dshgt-authmodal-x:hover{background:color-mix(in srgb,var(--gt-fg) 8%,transparent);color:var(--gt-fg);}
+.dshgt-authmodal-body{display:flex;flex-direction:column;gap:12px;}
+.dshgt-authcode{display:flex;align-items:center;justify-content:center;padding:16px 12px;border:1px dashed color-mix(in srgb,var(--gt-accent) 45%,var(--gt-border));border-radius:12px;background:color-mix(in srgb,var(--gt-accent) 6%,var(--gt-bg));}
+.dshgt-authcode-value{font-family:var(--gt-mono,ui-monospace,SFMono-Regular,Menlo,monospace);font-size:30px;font-weight:700;letter-spacing:6px;line-height:1.1;color:var(--gt-fg);user-select:all;}
+.dshgt-authcode-actions{display:flex;gap:8px;flex-wrap:wrap;justify-content:center;}
+.dshgt-authwait{display:flex;align-items:center;gap:8px;font-size:12px;color:var(--gt-muted);}
+.dshgt-authwait-dot{width:8px;height:8px;border-radius:50%;background:var(--gt-accent);animation:dshgt-pulse 1.1s ease-in-out infinite;}
+@keyframes dshgt-pulse{0%,100%{opacity:.25;transform:scale(.8);}50%{opacity:1;transform:scale(1);}}
+.dshgt-authmodal-footer{display:flex;align-items:center;justify-content:space-between;gap:8px;border-top:1px solid var(--gt-border);padding-top:10px;}
+
 /* ——— 01 工作台外壳 ——— */
 .dshgt-shell{gap:0;height:100%;min-height:0;overflow:hidden;}
 .dshgt-app{flex:1;min-height:0;display:flex;flex-direction:column;background:var(--gt-bg);}
@@ -1891,8 +1911,8 @@ async function apiCall(method, path, body, options = {}) {
   }
   return json;
 }
-async function beginGithubSignIn(method = "browser") {
-  const payload = await apiCall("POST", "/github/browser/begin", { method });
+async function beginGithubSignIn() {
+  const payload = await apiCall("POST", "/github/browser/begin", {});
   return payload.attempt;
 }
 async function getGithubSignInStatus(signal) {
@@ -2136,6 +2156,7 @@ function SettingsView(props) {
   const [testing, setTesting] = import_react.default.useState(false);
   const [githubTest, setGithubTest] = import_react.default.useState(null);
   const [signIn, setSignIn] = import_react.default.useState({ phase: "idle" });
+  const [signInModal, setSignInModal] = import_react.default.useState(false);
   const anyDirty = SECTIONS.some((id) => dirtySections[id]);
   const sectionEditable = section !== "source";
   import_react.default.useEffect(() => {
@@ -2263,50 +2284,43 @@ function SettingsView(props) {
       setTesting(false);
     }
   };
-  const startSignIn = async (method) => {
+  const openVerifyPage = (url) => {
+    if (url === void 0) return;
+    try {
+      window.open(url, "_blank", "noopener,noreferrer");
+    } catch {
+    }
+  };
+  const startSignIn = async () => {
+    setSignInModal(true);
+    setSignIn({ phase: "idle" });
     try {
-      let view = await beginGithubSignIn(method);
+      let view = await beginGithubSignIn();
       if (view.phase === "idle") view = await getGithubSignInStatus();
       setSignIn(view);
-      if (view.phase === "error") {
-        notify("err", t("auth.browser.failed.detail", { message: view.error ?? "" }));
-        return;
-      }
-      if (view.phase === "waiting-browser" && view.authorizeUrl !== void 0) {
-        try {
-          window.open(view.authorizeUrl, "_blank", "noopener,noreferrer");
-        } catch {
-        }
-      }
-      const deviceUrl = view.verificationUriComplete ?? view.verificationUri;
-      if (view.phase === "waiting-device" && deviceUrl !== void 0) {
-        try {
-          window.open(deviceUrl, "_blank", "noopener,noreferrer");
-        } catch {
-        }
-      }
+      if (view.phase === "waiting-device") openVerifyPage(view.verificationUri);
     } catch (error) {
-      notify("err", error instanceof Error ? error.message : String(error));
+      setSignIn({ phase: "error", error: error instanceof Error ? error.message : String(error) });
     }
   };
+  const openSignInModal = () => setSignInModal(true);
+  const closeSignInModal = () => setSignInModal(false);
   const cancelSignIn = async () => {
     try {
       setSignIn(await cancelGithubSignIn());
     } catch (error) {
       notify("err", error instanceof Error ? error.message : String(error));
+    } finally {
+      setSignInModal(false);
     }
   };
-  const copyAuthorizeLink = () => {
-    if (signIn.authorizeUrl === void 0) return;
-    void navigator.clipboard?.writeText(signIn.authorizeUrl).then(() => notify("ok", t("auth.browser.copied")));
-  };
   const copyDeviceCode = () => {
     if (signIn.userCode === void 0) return;
     void copyText(signIn.userCode).then(
       (ok) => notify(ok ? "ok" : "err", ok ? t("auth.browser.codeCopied") : t("auth.browser.codeCopyFailed"))
     );
   };
-  const signInActive = signIn.phase === "waiting-browser" || signIn.phase === "waiting-device" || signIn.phase === "exchanging";
+  const signInActive = signIn.phase === "waiting-device" || signIn.phase === "exchanging";
   import_react.default.useEffect(() => {
     if (!signInActive) return void 0;
     let alive = true;
@@ -2367,7 +2381,6 @@ function SettingsView(props) {
   const isGh = draft.github.authMode === "gh";
   const isBrowser = draft.github.authMode === "browser";
   const browserAvailable = state.github.browserAvailable === true;
-  const loopbackAvailable = state.github.loopbackAvailable === true;
   const sections = [
     { id: "source", label: t("st.source") },
     { id: "model", label: t("st.model") },
@@ -2562,13 +2575,10 @@ function SettingsView(props) {
         {
           small: true,
           variant: "primary",
-          onClick: () => void startSignIn(loopbackAvailable ? "browser" : "device"),
-          disabled: signInActive
+          onClick: () => void (signInActive ? openSignInModal() : startSignIn())
         },
-        signIn.phase === "done" && signIn.login !== void 0 ? `${t("auth.browser.done")} · @${signIn.login}` : signInActive ? t("auth.browser.waiting") : t("auth.browser.signin")
-      ) : h("span", { className: "dshgt-hint" }, t("auth.browser.unavailable")),
-      browserAvailable && loopbackAvailable ? h(Btn, { small: true, variant: "ghost", onClick: () => void startSignIn("device"), disabled: signInActive }, t("auth.browser.device")) : null,
-      signInActive ? h(Btn, { small: true, variant: "ghost", onClick: () => void cancelSignIn() }, t("auth.browser.cancel")) : null
+        signInActive ? t("auth.modal.viewCode") : signIn.phase === "done" && signIn.login !== void 0 ? `${t("auth.browser.done")} · @${signIn.login}` : t("auth.browser.signin")
+      ) : h("span", { className: "dshgt-hint" }, t("auth.browser.unavailable"))
     ) : h(
       Row,
       { label: t("auth.tokenRef") },
@@ -2577,47 +2587,6 @@ function SettingsView(props) {
       }) }),
       h("span", { className: "dshgt-hint" }, t("auth.tokenRef.hint"))
     ),
-    // 浏览器登录失败：必须显式说出来，否则「点了没反应」又回来了。
-    isBrowser && signIn.phase === "error" ? h(Alert, { kind: "err", title: t("auth.browser.failed") }, signIn.error ?? t("auth.browser.failed.hint")) : null,
-    // 浏览器登录进行中的状态行：可点的授权页链接 + 复制兜底 + 设备码。
-    isBrowser && (signIn.phase === "waiting-browser" || signIn.phase === "waiting-device" || signIn.phase === "exchanging") ? h(
-      "div",
-      { className: "dshgt-hint" },
-      signIn.authorizeUrl !== void 0 ? h(
-        "div",
-        { className: "dshgt-desc" },
-        h("span", null, t("auth.browser.openHint")),
-        " ",
-        h(
-          "a",
-          { className: "dshgt-link", href: signIn.authorizeUrl, target: "_blank", rel: "noreferrer" },
-          t("auth.browser.open")
-        ),
-        " ",
-        h(Btn, { small: true, variant: "ghost", onClick: () => copyAuthorizeLink() }, t("auth.browser.copy"))
-      ) : null,
-      signIn.verificationUriComplete !== void 0 || signIn.verificationUri !== void 0 ? h(
-        "div",
-        { className: "dshgt-desc" },
-        h(
-          "a",
-          {
-            className: "dshgt-link",
-            href: signIn.verificationUriComplete ?? signIn.verificationUri,
-            target: "_blank",
-            rel: "noreferrer"
-          },
-          t("auth.browser.open")
-        )
-      ) : null,
-      signIn.userCode !== void 0 ? h(
-        "div",
-        { className: "dshgt-desc", style: { display: "flex", alignItems: "center", gap: "8px", flexWrap: "wrap" } },
-        h("span", null, t("auth.browser.code")),
-        h("span", { className: "dshgt-mono", style: { fontSize: "1.1em", fontWeight: "bold", letterSpacing: "1px" } }, signIn.userCode),
-        h(Btn, { small: true, variant: "ghost", onClick: () => copyDeviceCode() }, t("auth.browser.copyCode"))
-      ) : null
-    ) : null,
     h(
       Row,
       { label: t("auth.test") },
@@ -2891,7 +2860,88 @@ function SettingsView(props) {
       setDirtySections({ ...EMPTY_DIRTY });
       setSavedSection(null);
       void store.refresh({ quiet: true });
-    } }) : null
+    } }) : null,
+    signInModal ? h(AuthSignInModal, {
+      t,
+      view: signIn,
+      onClose: closeSignInModal,
+      onCancel: () => void cancelSignIn(),
+      onRetry: () => void startSignIn(),
+      onCopyCode: copyDeviceCode,
+      onOpenPage: () => openVerifyPage(signIn.verificationUri)
+    }) : null
+  );
+}
+function AuthSignInModal(props) {
+  const { t, view } = props;
+  const active = view.phase === "waiting-device" || view.phase === "exchanging";
+  const body = view.phase === "waiting-device" || view.phase === "exchanging" ? h(
+    "div",
+    { className: "dshgt-authmodal-body" },
+    h("p", { className: "dshgt-hint", style: { margin: 0 } }, t("auth.modal.lead")),
+    view.userCode !== void 0 ? h(
+      "div",
+      { className: "dshgt-authcode" },
+      h("span", { className: "dshgt-authcode-value" }, view.userCode)
+    ) : null,
+    view.userCode !== void 0 ? h(
+      "div",
+      { className: "dshgt-authcode-actions" },
+      h(Btn, { small: true, variant: "ghost", onClick: props.onCopyCode }, t("auth.browser.copyCode")),
+      view.verificationUri !== void 0 ? h(Btn, { small: true, variant: "primary", onClick: props.onOpenPage }, `${t("auth.modal.openPage")} ↗`) : null
+    ) : null,
+    h(
+      "div",
+      { className: "dshgt-authwait" },
+      h("span", { className: "dshgt-authwait-dot" }),
+      h("span", null, view.phase === "exchanging" ? t("auth.modal.exchanging") : t("auth.modal.waiting"))
+    )
+  ) : view.phase === "done" ? h(
+    "div",
+    { className: "dshgt-authmodal-body" },
+    h(Alert, { kind: "ok" }, view.login === void 0 ? t("auth.browser.done") : `${t("auth.browser.done")} · @${view.login}`)
+  ) : view.phase === "error" ? h(
+    "div",
+    { className: "dshgt-authmodal-body" },
+    h(Alert, { kind: "err", title: t("auth.browser.failed") }, view.error ?? t("auth.browser.failed.hint"))
+  ) : h(
+    "div",
+    { className: "dshgt-authmodal-body dshgt-authwait" },
+    h("span", { className: "dshgt-authwait-dot" }),
+    h("span", null, t("auth.modal.requesting"))
+  );
+  const footer = view.phase === "error" ? h(
+    "div",
+    { className: "dshgt-authmodal-footer" },
+    h(Btn, { small: true, variant: "primary", onClick: props.onRetry }, t("auth.modal.retry")),
+    h(Btn, { small: true, variant: "ghost", onClick: props.onClose }, t("auth.modal.close"))
+  ) : view.phase === "done" ? h(
+    "div",
+    { className: "dshgt-authmodal-footer" },
+    h(Btn, { small: true, variant: "primary", onClick: props.onClose }, t("auth.modal.close"))
+  ) : h(
+    "div",
+    { className: "dshgt-authmodal-footer" },
+    h("span", { className: "dshgt-hint" }, t("auth.modal.closeHint")),
+    h(Btn, { small: true, variant: "ghost", onClick: props.onCancel, disabled: !active }, t("auth.browser.cancel"))
+  );
+  return h(
+    "div",
+    { className: "dshgt-modal-mask", onClick: (event) => {
+      if (event.target === event.currentTarget) props.onClose();
+    } },
+    h(
+      "div",
+      { className: "dshgt-modal dshgt-authmodal", role: "dialog", "aria-modal": "true", "aria-label": t("auth.modal.title") },
+      h(
+        "div",
+        { className: "dshgt-authmodal-head" },
+        h("h3", { style: { margin: 0, fontSize: 14 } }, t("auth.modal.title")),
+        h("button", { type: "button", className: "dshgt-authmodal-x", "aria-label": t("auth.modal.close"), onClick: props.onClose }, "✕")
+      ),
+      body,
+      footer
+    )
   );
 }
 function QuickFillModal(props) {

package/lib/{chunk-QOYTABJH.js → chunk-OMQY3T3V.js}

@@ -3529,48 +3529,26 @@ async function probeGithubAuth(options) {
 // src/host/github-auth.ts
 var github_auth_exports = {};
 __export(github_auth_exports, {
-  CALLBACK_PATH: () => CALLBACK_PATH,
   DEFAULT_GITHUB_CLIENT_ID: () => DEFAULT_GITHUB_CLIENT_ID,
   DEFAULT_SCOPE: () => DEFAULT_SCOPE,
   GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY2,
   attemptView: () => attemptView,
   beginGithubSignIn: () => beginGithubSignIn,
-  buildAuthorizeUrl: () => buildAuthorizeUrl,
   cancelGithubSignIn: () => cancelGithubSignIn,
-  createPkce: () => createPkce,
   ensureGithubFlow: () => ensureGithubFlow,
   isGithubFlowRegistered: () => isGithubFlowRegistered,
-  isHttpUrl: () => isHttpUrl,
-  isLoopbackSignInAvailable: () => isLoopbackSignInAvailable,
   registerGithubFlow: () => registerGithubFlow,
-  renderCallbackPage: () => renderCallbackPage,
   resetAttemptForTest: () => resetAttemptForTest,
-  resolveClientId: () => resolveClientId,
-  resolveClientSecret: () => resolveClientSecret,
-  resolveMethod: () => resolveMethod,
-  verifyState: () => verifyState
+  resolveClientId: () => resolveClientId
 });
-import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var GITHUB_RECORD_KEY2 = "github/default";
-var CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
 var DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
 function resolveClientId(deps) {
   const fromConfig = deps.clientId;
   return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
 }
-function resolveClientSecret(deps) {
-  const secret = deps.clientSecret;
-  return secret !== void 0 && secret !== "" ? secret : void 0;
-}
-function isLoopbackSignInAvailable(deps) {
-  return resolveClientSecret(deps) !== void 0;
-}
-function resolveMethod(deps, requested) {
-  return requested === "browser" && !isLoopbackSignInAvailable(deps) ? "device" : requested;
-}
-var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
-var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var GITHUB_USER_URL = "https://api.github.com/user";
 var DEFAULT_SCOPE = "repo";
 var DEFAULT_ATTEMPT_TIMEOUT_MS = 10 * 60 * 1e3;
@@ -3580,105 +3558,6 @@ function attemptView() {
   const { controller: _c, done: _d, ...view } = current;
   return view;
 }
-function base64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function isHttpUrl(value) {
-  if (typeof value !== "string" || value === "") return false;
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" || url.protocol === "http:";
-}
-function createPkce() {
-  const verifier = base64url(randomBytes2(32));
-  const challenge = base64url(createHash3("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function verifyState(received, expected) {
-  const a = Buffer.from(received);
-  const b = Buffer.from(expected);
-  return a.length === b.length && timingSafeEqual2(a, b);
-}
-function renderCallbackPage(kind) {
-  const ok = kind === "success";
-  const title = ok ? "\u767B\u5F55\u5B8C\u6210" : "\u767B\u5F55\u672A\u5B8C\u6210";
-  const heading = ok ? "GitHub \u6388\u6743\u6210\u529F" : "GitHub \u6388\u6743\u5931\u8D25";
-  const body = ok ? "\u5DF2\u5B8C\u6210\u767B\u5F55\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002" : "\u6388\u6743\u6821\u9A8C\u672A\u901A\u8FC7\uFF0C\u8BF7\u56DE\u5230 DSH \u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u3002";
-  const accent = ok ? "#1f883d" : "#cf222e";
-  const icon = ok ? '<path d="M20 6 9 17l-5-5"/>' : '<path d="M18 6 6 18"/><path d="m6 6 12 12"/>';
-  const autoClose = ok ? "<script>(function(){try{setTimeout(function(){window.close()},1200)}catch(e){}})()</script>" : "";
-  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="color-scheme" content="light dark">
-<title>${title}</title>
-<style>
-  :root{--bg:#f6f8fa;--card:#ffffff;--fg:#1f2328;--muted:#59636e;--border:#d1d9e0;--accent:${accent}}
-  @media (prefers-color-scheme:dark){:root{--bg:#0d1117;--card:#151b23;--fg:#e6edf3;--muted:#9198a1;--border:#3d444d}}
-  *{box-sizing:border-box}
-  html,body{height:100%}
-  body{margin:0;display:flex;align-items:center;justify-content:center;padding:24px;
-    background:var(--bg);color:var(--fg);
-    font:400 15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC","Hiragino Sans GB","Microsoft YaHei",sans-serif}
-  main{width:100%;max-width:400px;background:var(--card);border:1px solid var(--border);
-    border-radius:14px;padding:40px 32px;text-align:center;
-    box-shadow:0 8px 24px rgba(0,0,0,.06)}
-  .mark{width:64px;height:64px;margin:0 auto 20px;border-radius:50%;display:flex;
-    align-items:center;justify-content:center;background:color-mix(in srgb,var(--accent) 14%,transparent);color:var(--accent)}
-  .mark svg{width:30px;height:30px;fill:none;stroke:currentColor;stroke-width:2.4;stroke-linecap:round;stroke-linejoin:round}
-  h1{margin:0 0 8px;font-size:19px;font-weight:600;letter-spacing:.2px}
-  p{margin:0;color:var(--muted);font-size:14px}
-</style></head>
-<body><main role="status">
-  <div class="mark"><svg viewBox="0 0 24 24" aria-hidden="true">${icon}</svg></div>
-  <h1>${heading}</h1>
-  <p>${body}</p>
-</main>${autoClose}</body></html>`;
-}
-function buildAuthorizeUrl(params) {
-  const url = new URL(params.authorizeEndpoint);
-  url.searchParams.set("client_id", params.clientId);
-  url.searchParams.set("redirect_uri", params.redirectUri);
-  url.searchParams.set("scope", params.scope);
-  url.searchParams.set("state", params.state);
-  url.searchParams.set("code_challenge", params.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url.toString();
-}
-async function exchangeCode(fetchImpl, endpoint, params, signal) {
-  const form = new URLSearchParams({
-    client_id: params.clientId,
-    code: params.code,
-    code_verifier: params.verifier,
-    redirect_uri: params.redirectUri
-  });
-  if (params.clientSecret !== void 0) form.set("client_secret", params.clientSecret);
-  const response = await fetchImpl(endpoint, {
-    method: "POST",
-    headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
-    body: form.toString(),
-    signal
-  });
-  if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
-  const body = await response.json();
-  if (typeof body.access_token !== "string" || body.access_token === "") {
-    const error = typeof body.error === "string" ? body.error : void 0;
-    if (error === "incorrect_client_credentials") {
-      throw new Error(
-        params.clientSecret === void 0 ? "GitHub \u7F51\u9875\u6388\u6743\u9700\u8981 client_secret\uFF08incorrect_client_credentials\uFF09\uFF0C\u5185\u7F6E\u7684\u516C\u5F00 client_id \u65E0\u6CD5\u5B8C\u6210\u8FD9\u4E00\u6B65\uFF1A\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF0C\u6216\u914D\u7F6E\u81EA\u5DF1\u7684 OAuth App client_id + client_secret\u3002" : "GitHub \u8BA4\u4E3A\u8FD9\u4E2A OAuth App \u7684 client_id / client_secret \u4E0D\u6B63\u786E\uFF08incorrect_client_credentials\uFF09\uFF1A\u8BF7\u68C0\u67E5\u63D2\u4EF6\u914D\u7F6E\uFF0C\u6216\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\u3002"
-      );
-    }
-    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${error === void 0 ? "" : `\uFF08${error}\uFF09`}`);
-  }
-  return {
-    token: body.access_token,
-    ...typeof body.token_type === "string" ? { tokenType: body.token_type } : {},
-    ...typeof body.scope === "string" ? { scope: body.scope } : {}
-  };
-}
 async function fetchLogin(fetchImpl, endpoint, token, signal) {
   try {
     const response = await fetchImpl(endpoint, {
@@ -3692,87 +3571,6 @@ async function fetchLogin(fetchImpl, endpoint, token, signal) {
     return void 0;
   }
 }
-async function runBrowser(deps, session) {
-  const webServer = deps.get("webServer");
-  if (webServer === void 0 || typeof webServer.register !== "function") {
-    throw new Error("webServer \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u6D4F\u89C8\u5668\u767B\u5F55\u9700\u8981\u5B83\u627F\u8F7D OAuth \u56DE\u8C03");
-  }
-  const clientId = resolveClientId(deps);
-  if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
-  const clientSecret = resolveClientSecret(deps);
-  if (clientSecret === void 0) {
-    throw new Error("\u56DE\u73AF\u767B\u5F55\u4E0D\u53EF\u7528\uFF1A\u6CA1\u6709\u914D\u7F6E GitHub OAuth App \u7684 client_secret\uFF0C\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55");
-  }
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const endpoints = normalizeEndpoints(deps.endpoints);
-  const scope = deps.scope ?? DEFAULT_SCOPE;
-  const state = base64url(randomBytes2(32));
-  const { verifier, challenge } = createPkce();
-  let resolveCode;
-  let rejectCode;
-  const codePromise = new Promise((resolve, reject) => {
-    resolveCode = resolve;
-    rejectCode = reject;
-  });
-  codePromise.catch(() => void 0);
-  const dispose = webServer.register({
-    kind: "exact",
-    path: CALLBACK_PATH,
-    handler: (req, res) => {
-      let url;
-      try {
-        url = new URL(req.url ?? "/", "http://127.0.0.1");
-      } catch {
-        res.writeHead(400, { "cache-control": "no-store" }).end();
-        return;
-      }
-      const code = url.searchParams.get("code") ?? "";
-      const gotState = url.searchParams.get("state") ?? "";
-      const single = url.searchParams.getAll("state").length === 1 && url.searchParams.getAll("code").length === 1;
-      const bad = req.method !== "GET" || url.pathname !== CALLBACK_PATH || !single || code === "" || !verifyState(gotState, state);
-      if (bad) {
-        res.writeHead(400, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(renderCallbackPage("error"));
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(renderCallbackPage("success"));
-      resolveCode(code);
-    }
-  });
-  try {
-    const origin = localOrigin(webServer);
-    const redirectUri = `${origin}${CALLBACK_PATH}`;
-    const authorizeUrl = buildAuthorizeUrl({
-      authorizeEndpoint: endpoints.authorize,
-      clientId,
-      redirectUri,
-      scope,
-      state,
-      challenge
-    });
-    updateCurrent({ phase: "waiting-browser", authorizeUrl, expiresAt: Date.now() + attemptTimeout(deps) });
-    session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
-    const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
-    updateCurrent({ phase: "exchanging" });
-    const exchanged = await exchangeCode(
-      fetchImpl,
-      endpoints.accessToken,
-      { clientId, clientSecret, code, verifier, redirectUri },
-      session.signal
-    );
-    const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
-    const payload = {
-      version: 1,
-      token: exchanged.token,
-      ...login === void 0 ? {} : { login },
-      tokenType: exchanged.tokenType ?? "bearer",
-      scope: exchanged.scope ?? scope
-    };
-    if (typeof session.commit === "function") await session.commit({ kind: "grant", payload });
-    updateCurrent({ phase: "done", ...login === void 0 ? {} : { login } });
-  } finally {
-    dispose();
-  }
-}
 async function runDevice(deps, session) {
   const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
@@ -3797,17 +3595,15 @@ async function runDevice(deps, session) {
   const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
   const expiresInSec = typeof start.expires_in === "number" && start.expires_in > 0 ? start.expires_in : 900;
   const deadline = Date.now() + expiresInSec * 1e3;
-  const verificationUriComplete = isHttpUrl(start.verification_uri_complete) ? start.verification_uri_complete : void 0;
   updateCurrent({
     phase: "waiting-device",
     verificationUri: start.verification_uri,
-    ...verificationUriComplete === void 0 ? {} : { verificationUriComplete },
     userCode: start.user_code,
     expiresAt: deadline
   });
   session.notify?.({
     message: "Enter this code on the verification page to finish signing in.",
-    url: verificationUriComplete ?? start.verification_uri,
+    url: start.verification_uri,
     code: start.user_code
   });
   let waitMs = intervalSec * 1e3;
@@ -3852,11 +3648,8 @@ function flowDefinition(deps) {
   return {
     key: GITHUB_RECORD_KEY2,
     label: "GitHub",
-    methods: [
-      { id: "browser", label: "Sign in with GitHub" },
-      { id: "device", label: "Use a device code" }
-    ],
-    run: (session) => session.method === "device" ? runDevice(deps, session) : runBrowser(deps, session)
+    methods: [{ id: "device", label: "Use a device code" }],
+    run: (session) => runDevice(deps, session)
   };
 }
 var registeredOn = /* @__PURE__ */ new WeakSet();
@@ -3900,21 +3693,17 @@ function registerGithubFlow(deps) {
 }
 var START_TIMEOUT_MS = 1500;
 var START_POLL_MS = 10;
-async function beginGithubSignIn(deps, method = "browser") {
+async function beginGithubSignIn(deps) {
   const authorization = deps.get("authorization");
   if (authorization === void 0 || typeof authorization.begin !== "function") {
-    throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C\u6D4F\u89C8\u5668\u767B\u5F55");
+    throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C GitHub \u767B\u5F55");
   }
   if (!ensureGithubFlow(deps)) {
     throw new Error("authorization \u670D\u52A1\u5C1A\u672A\u5C31\u7EEA\uFF0CGitHub \u6388\u6743\u6D41\u7A0B\u6CA1\u6709\u6CE8\u518C\u6210\u529F\uFF1A\u8BF7\u7A0D\u540E\u91CD\u8BD5");
   }
-  if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
+  if (current !== void 0 && (current.phase === "waiting-device" || current.phase === "exchanging")) {
     throw new Error("already-in-flight");
   }
-  const effectiveMethod = resolveMethod(deps, method);
-  if (effectiveMethod !== method) {
-    deps.logger?.("auth.method.fallback", { from: method, to: effectiveMethod, reason: "no-client-secret" });
-  }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
   const attempt = { phase: "idle", controller, done: Promise.resolve() };
@@ -3923,15 +3712,13 @@ async function beginGithubSignIn(deps, method = "browser") {
   try {
     started = authorization.begin({
       key: GITHUB_RECORD_KEY2,
-      method: effectiveMethod,
+      method: "device",
       signal: controller.signal,
-      // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
+      // 设备码：notify 只更新内存视图；prompt 不支持（拒绝）。
       interaction: {
         notify: (notice) => {
-          if (notice.code !== void 0 && notice.url !== void 0) {
+          if (notice.code !== void 0) {
             updateCurrent({ phase: "waiting-device", userCode: notice.code });
-          } else if (notice.url !== void 0) {
-            updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
           }
         },
         prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
@@ -3968,7 +3755,6 @@ function resetAttemptForTest() {
 }
 function normalizeEndpoints(endpoints = {}) {
   return {
-    authorize: endpoints?.authorize ?? AUTHORIZE_URL,
     accessToken: endpoints?.accessToken ?? ACCESS_TOKEN_URL,
     deviceCode: endpoints?.deviceCode ?? DEVICE_CODE_URL,
     user: endpoints?.user ?? GITHUB_USER_URL
@@ -3977,37 +3763,6 @@ function normalizeEndpoints(endpoints = {}) {
 function attemptTimeout(deps) {
   return typeof deps.attemptTimeoutMs === "number" && deps.attemptTimeoutMs > 0 ? deps.attemptTimeoutMs : DEFAULT_ATTEMPT_TIMEOUT_MS;
 }
-function localOrigin(webServer) {
-  const port = webServer.port;
-  if (typeof port !== "number" || port <= 0) throw new Error("webServer \u5C1A\u672A\u76D1\u542C\uFF0C\u65E0\u6CD5\u786E\u5B9A\u56DE\u8C03\u5730\u5740");
-  const host = typeof webServer.host === "string" && webServer.host !== "" ? webServer.host : "127.0.0.1";
-  const loopback = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-  return `http://${loopback}:${port}`;
-}
-function withAbort(promise, signal, onAbort) {
-  if (signal === void 0) return promise;
-  if (signal.aborted) {
-    onAbort();
-    return Promise.reject(new Error("authorization cancelled"));
-  }
-  return new Promise((resolve, reject) => {
-    const abort = () => {
-      onAbort();
-      reject(new Error("authorization cancelled"));
-    };
-    signal.addEventListener("abort", abort, { once: true });
-    promise.then(
-      (value) => {
-        signal.removeEventListener("abort", abort);
-        resolve(value);
-      },
-      (error) => {
-        signal.removeEventListener("abort", abort);
-        reject(error);
-      }
-    );
-  });
-}
 function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted === true) {
@@ -4541,7 +4296,6 @@ function githubAuthDeps(deps) {
     get: deps.get,
     ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
     ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
-    ...deps.githubClientSecret === void 0 ? {} : { clientSecret: deps.githubClientSecret },
     ...deps.logger === void 0 ? {} : { logger: deps.logger }
   };
 }
@@ -4728,9 +4482,8 @@ async function dispatch(method, pathname, url, body, deps) {
     return { github: probe };
   }
   if (method === "POST" && pathname === "/github/browser/begin") {
-    const method2 = body.method === "device" ? "device" : "browser";
     try {
-      const view = await beginGithubSignIn(githubAuthDeps(deps), method2);
+      const view = await beginGithubSignIn(githubAuthDeps(deps));
       if (view.phase === "error") throw new IpcError("GITHUB_AUTH_UNAVAILABLE", redact(view.error ?? "GitHub \u767B\u5F55\u5931\u8D25"));
       return { attempt: view };
     } catch (error) {
@@ -4878,15 +4631,10 @@ async function statePayload(deps, settings) {
       authMode: settings.github.authMode,
       configured: github.token !== void 0,
       source: github.source,
-      /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
+      /** GitHub 登录 attempt 视图（idle / waiting-device / exchanging / done / error）。 */
       attempt: attemptView(),
-      /** 浏览器登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
-      browserAvailable: browserSignInAvailable(deps),
-      /**
-       * 回环 web flow 是否可用：GitHub 换 token 必须有 client_secret，内置 client_id 没有 → 只能设备码。
-       * 前端据此决定主按钮启动哪个 method（false 时直接用 device，避免点了必然失败的 web flow）。
-       */
-      loopbackAvailable: isLoopbackSignInAvailable(githubAuthDeps(deps))
+      /** 登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
+      browserAvailable: browserSignInAvailable(deps)
     }
   };
 }

package/lib/index.d.ts

@@ -27,7 +27,6 @@ declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
     githubClientId?: string;
-    githubClientSecret?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -9,7 +9,7 @@ import {
   createUpdateService,
   ensureGithubFlow,
   readPluginInfo
-} from "./chunk-QOYTABJH.js";
+} from "./chunk-OMQY3T3V.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -20,7 +20,6 @@ function readVersion() {
 var VERSION = readVersion();
 function apply(ctx, config = {}) {
   const env = process.env;
-  const githubClientSecret = (config.githubClientSecret ?? env.DSH_GITHUB_CLIENT_SECRET)?.trim();
   const get = (key) => typeof ctx.get === "function" ? ctx.get(key) : void 0;
   const log = (event, data) => {
     const suffix = data === void 0 ? "" : ` ${JSON.stringify(data)}`;
@@ -68,8 +67,7 @@ function apply(ctx, config = {}) {
   const githubAuth = (resolve) => ({
     get: resolve,
     logger: log,
-    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId },
-    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { clientSecret: githubClientSecret }
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
   });
   const registerAuth = (resolve) => {
     if (!ensureGithubFlow(githubAuth(resolve ?? get))) log("auth.flow.deferred", { reason: "authorization-not-ready" });
@@ -102,7 +100,6 @@ function apply(ctx, config = {}) {
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
     ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
-    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { githubClientSecret },
     logger: log
   });
   const register = () => {

package/lib/internal.d.ts

@@ -1157,39 +1157,36 @@ declare namespace github {
   export { type github_GithubProbeResult as GithubProbeResult, github_probeGithubAuth as probeGithubAuth };
 }
 
+/**
+ * GitHub 浏览器登录（薄 adapter）。
+ *
+ * 设计原则：**只补核心缺的那一层，其余全用核心轮子**（见
+ * `.dsh/docs/plans/2026-11-01-github-browser-auth-plan.md`）。
+ *   - 协议生命周期 / attempt 单飞 / 取消 / 结算 → `ctx.authorization`（核心）
+ *   - 回环回调 HTTP 载体 → `ctx.webServer.register({ kind:'exact' })`（核心）
+ *   - token 落盘 / 原子写 / 0600 / record 事件 → `ctx.credentials`（核心）
+ *   - 交互词汇 notify/prompt → `AuthorizationSession`（核心）
+ *
+ * 本文件只写 GitHub provider 专有的：client_id、端点、PKCE 三行、state 校验、exchange、
+ * grant payload，以及「进程内 begin + 内存 attempt 视图」这点胶水（核心没有给第三方 key
+ * 的 authorization HTTP 投影，见阶段 0 核实 R4）。
+ *
+ * 不 import 任何 `@deepseek-ai/*` 运行时模块：全部走 `get(...)` 的鸭子类型，故不需要新增
+ * peerDependency。record 键用字符串 `'github/default'`（与核心包提案同名同构，便于迁移）。
+ */
 /** 与核心 `@deepseek-ai/dsh-github-auth` 提案保持同 key；迁移时消费端无需改。 */
 declare const GITHUB_RECORD_KEY = "github/default";
-/** 本地回调路径（带集成前缀，避免多 provider 撞 webServer 的 `(kind,path)` 唯一约束）。 */
-declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
 /**
  * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
  * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
  *
- * ⚠️ 只有 client_id 不够：GitHub 的 web application flow 在换 token 时**仍然要求
- * client_secret**（PKCE 是叠加保护，不能替代，2025-07 起官方也只说「推荐」而非「可免 secret」）。
- * 因此：
- *   - 内置 client_id → 只能走 **device flow**（`resolveMethod` 自动降级），开箱即用；
- *   - 用户自带 OAuth App（`githubClientId` + `githubClientSecret`）→ 才启用回环 web flow。
- * 且 device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
- *
- * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
- * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
+ * 只走 **device flow**：GitHub 的 web application flow 换 token 必须带 client_secret，
+ * 而客户端不能内置机密，故本插件不实现回环 web flow（也不支持自带 OAuth App 的 secret）。
+ * device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
  */
 declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
-/** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
+/** 解析生效的 client_id：显式 config 优先，否则用内置默认（device flow 允许自定义 client_id）。 */
 declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
-/** 解析生效的 client_secret（没有就返回 undefined，绝不以空串形式发出去）。 */
-declare function resolveClientSecret(deps: GithubAuthDeps): string | undefined;
-/**
- * 回环（浏览器 web flow）是否可用：GitHub 换 token 必须带 client_secret，
- * 内置的公开 client_id 没有 secret，只能退到设备码。见文件头的说明。
- */
-declare function isLoopbackSignInAvailable(deps: GithubAuthDeps): boolean;
-/**
- * 实际要跑的方法：`browser` 需要 client_secret，缺省时自动降级为 `device`（开箱即用）。
- * 显式选择 `device` 的调用不受影响。
- */
-declare function resolveMethod(deps: GithubAuthDeps, requested: 'browser' | 'device'): 'browser' | 'device';
 /** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
 declare const DEFAULT_SCOPE = "repo";
 interface AuthorizationFlow {
@@ -1224,15 +1221,6 @@ interface AuthorizationLike {
     /** 核心 0.2.x 有：按 key 查已注册的 flow；判定「真的注册上了」靠它。 */
     describe?: (key: string) => unknown;
 }
-interface WebServerLike {
-    register?: (route: {
-        kind: 'exact';
-        path: string;
-        handler: (req: any, res: any) => void;
-    }) => () => void;
-    port?: number;
-    host?: string;
-}
 type FetchLike = typeof fetch;
 interface GithubAuthDeps {
     get: (name: string) => unknown;
@@ -1240,70 +1228,25 @@ interface GithubAuthDeps {
     logger?: (event: string, data?: Record<string, unknown>) => void;
     /** 覆盖端点（测试用）；生产留空走 GitHub 官方。 */
     endpoints?: {
-        authorize?: string;
         accessToken?: string;
         deviceCode?: string;
         user?: string;
     };
-    /** GitHub OAuth App 的 public client_id（无需 secret）。 */
+    /** GitHub OAuth App 的 public client_id（device flow 用；无需 secret）。 */
     clientId?: string;
-    /**
-     * GitHub OAuth App 的 client_secret。只有自带 OAuth App 的回环 web flow 才需要；
-     * 缺省时 `browser` 方法自动降级为 device flow。不进 `settings.json`、不进日志。
-     */
-    clientSecret?: string;
     scope?: string;
     attemptTimeoutMs?: number;
 }
-type GithubAttemptPhase = 'idle' | 'waiting-browser' | 'waiting-device' | 'exchanging' | 'done' | 'error';
+type GithubAttemptPhase = 'idle' | 'waiting-device' | 'exchanging' | 'done' | 'error';
 interface GithubAttemptView {
     phase: GithubAttemptPhase;
-    authorizeUrl?: string;
     verificationUri?: string;
-    /**
-     * device flow 的预填验证码地址（`verification_uri_complete`），**可选**：若 provider 返回就透出，
-     * 前端优先用它打开（码已预填）。注意 GitHub 官方 device flow 实测不返回该字段，此时走
-     * `verificationUri` + 手动输入；保留此字段只为兼容会返回它的 provider。
-     */
-    verificationUriComplete?: string;
     userCode?: string;
     expiresAt?: number;
     login?: string;
     error?: string;
 }
 declare function attemptView(): GithubAttemptView;
-/** 判断一个未知值是否是可直接打开的 http(s) URL（用于校验 GitHub 返回的验证页地址）。 */
-declare function isHttpUrl(value: unknown): boolean;
-/** PKCE：返回 verifier 与 S256 challenge。 */
-declare function createPkce(): {
-    verifier: string;
-    challenge: string;
-};
-/** 常量时间比较 state（长度不等直接 false，避免 timingSafeEqual 抛错）。 */
-declare function verifyState(received: string, expected: string): boolean;
-/** 回调落地页的两种结果（纯展示，无外部资源，离线可测）。 */
-type CallbackPageKind = 'success' | 'error';
-/**
- * 回环回调的落地页 HTML。自包含、无外链资源（CSP 友好、离线可用），
- * 跟随系统深浅色；成功页会尝试自动关闭本窗口（脚本失败时文字兜底）。
- */
-declare function renderCallbackPage(kind: CallbackPageKind): string;
-/** 拼授权页 URL。 */
-declare function buildAuthorizeUrl(params: {
-    authorizeEndpoint: string;
-    clientId: string;
-    redirectUri: string;
-    scope: string;
-    state: string;
-    challenge: string;
-}): string;
-interface GithubGrantPayload {
-    version: 1;
-    token: string;
-    login?: string;
-    tokenType?: string;
-    scope?: string;
-}
 /** 这个 key 现在是否**真的**有 flow 在注册表里。 */
 declare function isGithubFlowRegistered(deps: GithubAuthDeps): boolean;
 /**
@@ -1334,7 +1277,7 @@ declare function registerGithubFlow(deps: GithubAuthDeps): void;
  *
  * @throws 服务不可用、flow 未注册、已有 attempt 在飞时抛错。
  */
-declare function beginGithubSignIn(deps: GithubAuthDeps, method?: 'browser' | 'device'): Promise<GithubAttemptView>;
+declare function beginGithubSignIn(deps: GithubAuthDeps): Promise<GithubAttemptView>;
 /** 取消进行中的 attempt。 */
 declare function cancelGithubSignIn(deps: GithubAuthDeps): void;
 /** 仅测试用：清空内存 attempt。 */
@@ -1343,33 +1286,22 @@ declare function resetAttemptForTest(): void;
 type githubAuth_AuthorizationFlow = AuthorizationFlow;
 type githubAuth_AuthorizationLike = AuthorizationLike;
 type githubAuth_AuthorizationSessionLike = AuthorizationSessionLike;
-declare const githubAuth_CALLBACK_PATH: typeof CALLBACK_PATH;
 declare const githubAuth_DEFAULT_GITHUB_CLIENT_ID: typeof DEFAULT_GITHUB_CLIENT_ID;
 declare const githubAuth_DEFAULT_SCOPE: typeof DEFAULT_SCOPE;
 declare const githubAuth_GITHUB_RECORD_KEY: typeof GITHUB_RECORD_KEY;
 type githubAuth_GithubAttemptPhase = GithubAttemptPhase;
 type githubAuth_GithubAttemptView = GithubAttemptView;
 type githubAuth_GithubAuthDeps = GithubAuthDeps;
-type githubAuth_GithubGrantPayload = GithubGrantPayload;
-type githubAuth_WebServerLike = WebServerLike;
 declare const githubAuth_attemptView: typeof attemptView;
 declare const githubAuth_beginGithubSignIn: typeof beginGithubSignIn;
-declare const githubAuth_buildAuthorizeUrl: typeof buildAuthorizeUrl;
 declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
-declare const githubAuth_createPkce: typeof createPkce;
 declare const githubAuth_ensureGithubFlow: typeof ensureGithubFlow;
 declare const githubAuth_isGithubFlowRegistered: typeof isGithubFlowRegistered;
-declare const githubAuth_isHttpUrl: typeof isHttpUrl;
-declare const githubAuth_isLoopbackSignInAvailable: typeof isLoopbackSignInAvailable;
 declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
-declare const githubAuth_renderCallbackPage: typeof renderCallbackPage;
 declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
 declare const githubAuth_resolveClientId: typeof resolveClientId;
-declare const githubAuth_resolveClientSecret: typeof resolveClientSecret;
-declare const githubAuth_resolveMethod: typeof resolveMethod;
-declare const githubAuth_verifyState: typeof verifyState;
 declare namespace githubAuth {
-  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_isHttpUrl as isHttpUrl, githubAuth_isLoopbackSignInAvailable as isLoopbackSignInAvailable, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_renderCallbackPage as renderCallbackPage, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_resolveClientSecret as resolveClientSecret, githubAuth_resolveMethod as resolveMethod, githubAuth_verifyState as verifyState };
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId };
 }
 
 interface DefaultBranchResult {
@@ -2053,10 +1985,8 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
-    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
+    /** GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
     githubClientId?: string;
-    /** 自带 OAuth App 时的 client_secret（只用于回环 web flow；缺省时该 method 自动降级为设备码）。 */
-    githubClientSecret?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;

package/lib/internal.js

@@ -27,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-QOYTABJH.js";
+} from "./chunk-OMQY3T3V.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "GitHub 趋势日报的 DeepSeek Harness 插件：按日 / 周 / 月周期定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与周期总结，并可选把订阅仓库的新 Release 合成中文摘要，一起提交到你的仓库、自动开 PR 合并；内置概览 / 榜单 / 运行记录 / 订阅 / 设置工作台。",
   "type": "module",
   "main": "lib/index.js",