@morehao/dsh-github-trending 0.8.5 → 0.8.7

package/lib/{chunk-QOYTABJH.js → chunk-OMQY3T3V.js}

@@ -3529,48 +3529,26 @@ async function probeGithubAuth(options) {
 // src/host/github-auth.ts
 var github_auth_exports = {};
 __export(github_auth_exports, {
-  CALLBACK_PATH: () => CALLBACK_PATH,
   DEFAULT_GITHUB_CLIENT_ID: () => DEFAULT_GITHUB_CLIENT_ID,
   DEFAULT_SCOPE: () => DEFAULT_SCOPE,
   GITHUB_RECORD_KEY: () => GITHUB_RECORD_KEY2,
   attemptView: () => attemptView,
   beginGithubSignIn: () => beginGithubSignIn,
-  buildAuthorizeUrl: () => buildAuthorizeUrl,
   cancelGithubSignIn: () => cancelGithubSignIn,
-  createPkce: () => createPkce,
   ensureGithubFlow: () => ensureGithubFlow,
   isGithubFlowRegistered: () => isGithubFlowRegistered,
-  isHttpUrl: () => isHttpUrl,
-  isLoopbackSignInAvailable: () => isLoopbackSignInAvailable,
   registerGithubFlow: () => registerGithubFlow,
-  renderCallbackPage: () => renderCallbackPage,
   resetAttemptForTest: () => resetAttemptForTest,
-  resolveClientId: () => resolveClientId,
-  resolveClientSecret: () => resolveClientSecret,
-  resolveMethod: () => resolveMethod,
-  verifyState: () => verifyState
+  resolveClientId: () => resolveClientId
 });
-import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var GITHUB_RECORD_KEY2 = "github/default";
-var CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
 var DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
 function resolveClientId(deps) {
   const fromConfig = deps.clientId;
   return fromConfig !== void 0 && fromConfig !== "" ? fromConfig : DEFAULT_GITHUB_CLIENT_ID;
 }
-function resolveClientSecret(deps) {
-  const secret = deps.clientSecret;
-  return secret !== void 0 && secret !== "" ? secret : void 0;
-}
-function isLoopbackSignInAvailable(deps) {
-  return resolveClientSecret(deps) !== void 0;
-}
-function resolveMethod(deps, requested) {
-  return requested === "browser" && !isLoopbackSignInAvailable(deps) ? "device" : requested;
-}
-var AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
-var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var GITHUB_USER_URL = "https://api.github.com/user";
 var DEFAULT_SCOPE = "repo";
 var DEFAULT_ATTEMPT_TIMEOUT_MS = 10 * 60 * 1e3;
@@ -3580,105 +3558,6 @@ function attemptView() {
   const { controller: _c, done: _d, ...view } = current;
   return view;
 }
-function base64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function isHttpUrl(value) {
-  if (typeof value !== "string" || value === "") return false;
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" || url.protocol === "http:";
-}
-function createPkce() {
-  const verifier = base64url(randomBytes2(32));
-  const challenge = base64url(createHash3("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function verifyState(received, expected) {
-  const a = Buffer.from(received);
-  const b = Buffer.from(expected);
-  return a.length === b.length && timingSafeEqual2(a, b);
-}
-function renderCallbackPage(kind) {
-  const ok = kind === "success";
-  const title = ok ? "\u767B\u5F55\u5B8C\u6210" : "\u767B\u5F55\u672A\u5B8C\u6210";
-  const heading = ok ? "GitHub \u6388\u6743\u6210\u529F" : "GitHub \u6388\u6743\u5931\u8D25";
-  const body = ok ? "\u5DF2\u5B8C\u6210\u767B\u5F55\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002" : "\u6388\u6743\u6821\u9A8C\u672A\u901A\u8FC7\uFF0C\u8BF7\u56DE\u5230 DSH \u91CD\u65B0\u53D1\u8D77\u767B\u5F55\u3002";
-  const accent = ok ? "#1f883d" : "#cf222e";
-  const icon = ok ? '<path d="M20 6 9 17l-5-5"/>' : '<path d="M18 6 6 18"/><path d="m6 6 12 12"/>';
-  const autoClose = ok ? "<script>(function(){try{setTimeout(function(){window.close()},1200)}catch(e){}})()</script>" : "";
-  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="color-scheme" content="light dark">
-<title>${title}</title>
-<style>
-  :root{--bg:#f6f8fa;--card:#ffffff;--fg:#1f2328;--muted:#59636e;--border:#d1d9e0;--accent:${accent}}
-  @media (prefers-color-scheme:dark){:root{--bg:#0d1117;--card:#151b23;--fg:#e6edf3;--muted:#9198a1;--border:#3d444d}}
-  *{box-sizing:border-box}
-  html,body{height:100%}
-  body{margin:0;display:flex;align-items:center;justify-content:center;padding:24px;
-    background:var(--bg);color:var(--fg);
-    font:400 15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC","Hiragino Sans GB","Microsoft YaHei",sans-serif}
-  main{width:100%;max-width:400px;background:var(--card);border:1px solid var(--border);
-    border-radius:14px;padding:40px 32px;text-align:center;
-    box-shadow:0 8px 24px rgba(0,0,0,.06)}
-  .mark{width:64px;height:64px;margin:0 auto 20px;border-radius:50%;display:flex;
-    align-items:center;justify-content:center;background:color-mix(in srgb,var(--accent) 14%,transparent);color:var(--accent)}
-  .mark svg{width:30px;height:30px;fill:none;stroke:currentColor;stroke-width:2.4;stroke-linecap:round;stroke-linejoin:round}
-  h1{margin:0 0 8px;font-size:19px;font-weight:600;letter-spacing:.2px}
-  p{margin:0;color:var(--muted);font-size:14px}
-</style></head>
-<body><main role="status">
-  <div class="mark"><svg viewBox="0 0 24 24" aria-hidden="true">${icon}</svg></div>
-  <h1>${heading}</h1>
-  <p>${body}</p>
-</main>${autoClose}</body></html>`;
-}
-function buildAuthorizeUrl(params) {
-  const url = new URL(params.authorizeEndpoint);
-  url.searchParams.set("client_id", params.clientId);
-  url.searchParams.set("redirect_uri", params.redirectUri);
-  url.searchParams.set("scope", params.scope);
-  url.searchParams.set("state", params.state);
-  url.searchParams.set("code_challenge", params.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url.toString();
-}
-async function exchangeCode(fetchImpl, endpoint, params, signal) {
-  const form = new URLSearchParams({
-    client_id: params.clientId,
-    code: params.code,
-    code_verifier: params.verifier,
-    redirect_uri: params.redirectUri
-  });
-  if (params.clientSecret !== void 0) form.set("client_secret", params.clientSecret);
-  const response = await fetchImpl(endpoint, {
-    method: "POST",
-    headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
-    body: form.toString(),
-    signal
-  });
-  if (!response.ok) throw new Error(`GitHub access_token HTTP ${response.status}`);
-  const body = await response.json();
-  if (typeof body.access_token !== "string" || body.access_token === "") {
-    const error = typeof body.error === "string" ? body.error : void 0;
-    if (error === "incorrect_client_credentials") {
-      throw new Error(
-        params.clientSecret === void 0 ? "GitHub \u7F51\u9875\u6388\u6743\u9700\u8981 client_secret\uFF08incorrect_client_credentials\uFF09\uFF0C\u5185\u7F6E\u7684\u516C\u5F00 client_id \u65E0\u6CD5\u5B8C\u6210\u8FD9\u4E00\u6B65\uFF1A\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\uFF0C\u6216\u914D\u7F6E\u81EA\u5DF1\u7684 OAuth App client_id + client_secret\u3002" : "GitHub \u8BA4\u4E3A\u8FD9\u4E2A OAuth App \u7684 client_id / client_secret \u4E0D\u6B63\u786E\uFF08incorrect_client_credentials\uFF09\uFF1A\u8BF7\u68C0\u67E5\u63D2\u4EF6\u914D\u7F6E\uFF0C\u6216\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55\u3002"
-      );
-    }
-    throw new Error(`GitHub access_token \u672A\u8FD4\u56DE token${error === void 0 ? "" : `\uFF08${error}\uFF09`}`);
-  }
-  return {
-    token: body.access_token,
-    ...typeof body.token_type === "string" ? { tokenType: body.token_type } : {},
-    ...typeof body.scope === "string" ? { scope: body.scope } : {}
-  };
-}
 async function fetchLogin(fetchImpl, endpoint, token, signal) {
   try {
     const response = await fetchImpl(endpoint, {
@@ -3692,87 +3571,6 @@ async function fetchLogin(fetchImpl, endpoint, token, signal) {
     return void 0;
   }
 }
-async function runBrowser(deps, session) {
-  const webServer = deps.get("webServer");
-  if (webServer === void 0 || typeof webServer.register !== "function") {
-    throw new Error("webServer \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u6D4F\u89C8\u5668\u767B\u5F55\u9700\u8981\u5B83\u627F\u8F7D OAuth \u56DE\u8C03");
-  }
-  const clientId = resolveClientId(deps);
-  if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
-  const clientSecret = resolveClientSecret(deps);
-  if (clientSecret === void 0) {
-    throw new Error("\u56DE\u73AF\u767B\u5F55\u4E0D\u53EF\u7528\uFF1A\u6CA1\u6709\u914D\u7F6E GitHub OAuth App \u7684 client_secret\uFF0C\u8BF7\u6539\u7528\u8BBE\u5907\u7801\u767B\u5F55");
-  }
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const endpoints = normalizeEndpoints(deps.endpoints);
-  const scope = deps.scope ?? DEFAULT_SCOPE;
-  const state = base64url(randomBytes2(32));
-  const { verifier, challenge } = createPkce();
-  let resolveCode;
-  let rejectCode;
-  const codePromise = new Promise((resolve, reject) => {
-    resolveCode = resolve;
-    rejectCode = reject;
-  });
-  codePromise.catch(() => void 0);
-  const dispose = webServer.register({
-    kind: "exact",
-    path: CALLBACK_PATH,
-    handler: (req, res) => {
-      let url;
-      try {
-        url = new URL(req.url ?? "/", "http://127.0.0.1");
-      } catch {
-        res.writeHead(400, { "cache-control": "no-store" }).end();
-        return;
-      }
-      const code = url.searchParams.get("code") ?? "";
-      const gotState = url.searchParams.get("state") ?? "";
-      const single = url.searchParams.getAll("state").length === 1 && url.searchParams.getAll("code").length === 1;
-      const bad = req.method !== "GET" || url.pathname !== CALLBACK_PATH || !single || code === "" || !verifyState(gotState, state);
-      if (bad) {
-        res.writeHead(400, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(renderCallbackPage("error"));
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(renderCallbackPage("success"));
-      resolveCode(code);
-    }
-  });
-  try {
-    const origin = localOrigin(webServer);
-    const redirectUri = `${origin}${CALLBACK_PATH}`;
-    const authorizeUrl = buildAuthorizeUrl({
-      authorizeEndpoint: endpoints.authorize,
-      clientId,
-      redirectUri,
-      scope,
-      state,
-      challenge
-    });
-    updateCurrent({ phase: "waiting-browser", authorizeUrl, expiresAt: Date.now() + attemptTimeout(deps) });
-    session.notify?.({ message: "Continue in your browser to sign in to GitHub.", url: authorizeUrl });
-    const code = await withAbort(codePromise, session.signal, () => rejectCode(new Error("authorization cancelled")));
-    updateCurrent({ phase: "exchanging" });
-    const exchanged = await exchangeCode(
-      fetchImpl,
-      endpoints.accessToken,
-      { clientId, clientSecret, code, verifier, redirectUri },
-      session.signal
-    );
-    const login = await fetchLogin(fetchImpl, endpoints.user, exchanged.token, session.signal);
-    const payload = {
-      version: 1,
-      token: exchanged.token,
-      ...login === void 0 ? {} : { login },
-      tokenType: exchanged.tokenType ?? "bearer",
-      scope: exchanged.scope ?? scope
-    };
-    if (typeof session.commit === "function") await session.commit({ kind: "grant", payload });
-    updateCurrent({ phase: "done", ...login === void 0 ? {} : { login } });
-  } finally {
-    dispose();
-  }
-}
 async function runDevice(deps, session) {
   const clientId = resolveClientId(deps);
   if (clientId === void 0 || clientId === "") throw new Error("\u7F3A\u5C11 GitHub OAuth client_id");
@@ -3797,17 +3595,15 @@ async function runDevice(deps, session) {
   const intervalSec = typeof start.interval === "number" && start.interval > 0 ? start.interval : 5;
   const expiresInSec = typeof start.expires_in === "number" && start.expires_in > 0 ? start.expires_in : 900;
   const deadline = Date.now() + expiresInSec * 1e3;
-  const verificationUriComplete = isHttpUrl(start.verification_uri_complete) ? start.verification_uri_complete : void 0;
   updateCurrent({
     phase: "waiting-device",
     verificationUri: start.verification_uri,
-    ...verificationUriComplete === void 0 ? {} : { verificationUriComplete },
     userCode: start.user_code,
     expiresAt: deadline
   });
   session.notify?.({
     message: "Enter this code on the verification page to finish signing in.",
-    url: verificationUriComplete ?? start.verification_uri,
+    url: start.verification_uri,
     code: start.user_code
   });
   let waitMs = intervalSec * 1e3;
@@ -3852,11 +3648,8 @@ function flowDefinition(deps) {
   return {
     key: GITHUB_RECORD_KEY2,
     label: "GitHub",
-    methods: [
-      { id: "browser", label: "Sign in with GitHub" },
-      { id: "device", label: "Use a device code" }
-    ],
-    run: (session) => session.method === "device" ? runDevice(deps, session) : runBrowser(deps, session)
+    methods: [{ id: "device", label: "Use a device code" }],
+    run: (session) => runDevice(deps, session)
   };
 }
 var registeredOn = /* @__PURE__ */ new WeakSet();
@@ -3900,21 +3693,17 @@ function registerGithubFlow(deps) {
 }
 var START_TIMEOUT_MS = 1500;
 var START_POLL_MS = 10;
-async function beginGithubSignIn(deps, method = "browser") {
+async function beginGithubSignIn(deps) {
   const authorization = deps.get("authorization");
   if (authorization === void 0 || typeof authorization.begin !== "function") {
-    throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C\u6D4F\u89C8\u5668\u767B\u5F55");
+    throw new Error("authorization \u670D\u52A1\u4E0D\u53EF\u7528\uFF1A\u65E0\u6CD5\u8FDB\u884C GitHub \u767B\u5F55");
   }
   if (!ensureGithubFlow(deps)) {
     throw new Error("authorization \u670D\u52A1\u5C1A\u672A\u5C31\u7EEA\uFF0CGitHub \u6388\u6743\u6D41\u7A0B\u6CA1\u6709\u6CE8\u518C\u6210\u529F\uFF1A\u8BF7\u7A0D\u540E\u91CD\u8BD5");
   }
-  if (current !== void 0 && (current.phase === "waiting-browser" || current.phase === "waiting-device" || current.phase === "exchanging")) {
+  if (current !== void 0 && (current.phase === "waiting-device" || current.phase === "exchanging")) {
     throw new Error("already-in-flight");
   }
-  const effectiveMethod = resolveMethod(deps, method);
-  if (effectiveMethod !== method) {
-    deps.logger?.("auth.method.fallback", { from: method, to: effectiveMethod, reason: "no-client-secret" });
-  }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), attemptTimeout(deps));
   const attempt = { phase: "idle", controller, done: Promise.resolve() };
@@ -3923,15 +3712,13 @@ async function beginGithubSignIn(deps, method = "browser") {
   try {
     started = authorization.begin({
       key: GITHUB_RECORD_KEY2,
-      method: effectiveMethod,
+      method: "device",
       signal: controller.signal,
-      // 浏览器往返靠 authorizeUrl + 回调；notify 只更新内存视图，prompt 不支持（拒绝）。
+      // 设备码：notify 只更新内存视图；prompt 不支持（拒绝）。
       interaction: {
         notify: (notice) => {
-          if (notice.code !== void 0 && notice.url !== void 0) {
+          if (notice.code !== void 0) {
             updateCurrent({ phase: "waiting-device", userCode: notice.code });
-          } else if (notice.url !== void 0) {
-            updateCurrent({ phase: "waiting-browser", authorizeUrl: notice.url });
           }
         },
         prompt: () => Promise.reject(new Error("interactive prompt unsupported in this surface"))
@@ -3968,7 +3755,6 @@ function resetAttemptForTest() {
 }
 function normalizeEndpoints(endpoints = {}) {
   return {
-    authorize: endpoints?.authorize ?? AUTHORIZE_URL,
     accessToken: endpoints?.accessToken ?? ACCESS_TOKEN_URL,
     deviceCode: endpoints?.deviceCode ?? DEVICE_CODE_URL,
     user: endpoints?.user ?? GITHUB_USER_URL
@@ -3977,37 +3763,6 @@ function normalizeEndpoints(endpoints = {}) {
 function attemptTimeout(deps) {
   return typeof deps.attemptTimeoutMs === "number" && deps.attemptTimeoutMs > 0 ? deps.attemptTimeoutMs : DEFAULT_ATTEMPT_TIMEOUT_MS;
 }
-function localOrigin(webServer) {
-  const port = webServer.port;
-  if (typeof port !== "number" || port <= 0) throw new Error("webServer \u5C1A\u672A\u76D1\u542C\uFF0C\u65E0\u6CD5\u786E\u5B9A\u56DE\u8C03\u5730\u5740");
-  const host = typeof webServer.host === "string" && webServer.host !== "" ? webServer.host : "127.0.0.1";
-  const loopback = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-  return `http://${loopback}:${port}`;
-}
-function withAbort(promise, signal, onAbort) {
-  if (signal === void 0) return promise;
-  if (signal.aborted) {
-    onAbort();
-    return Promise.reject(new Error("authorization cancelled"));
-  }
-  return new Promise((resolve, reject) => {
-    const abort = () => {
-      onAbort();
-      reject(new Error("authorization cancelled"));
-    };
-    signal.addEventListener("abort", abort, { once: true });
-    promise.then(
-      (value) => {
-        signal.removeEventListener("abort", abort);
-        resolve(value);
-      },
-      (error) => {
-        signal.removeEventListener("abort", abort);
-        reject(error);
-      }
-    );
-  });
-}
 function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted === true) {
@@ -4541,7 +4296,6 @@ function githubAuthDeps(deps) {
     get: deps.get,
     ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
     ...deps.githubClientId === void 0 ? {} : { clientId: deps.githubClientId },
-    ...deps.githubClientSecret === void 0 ? {} : { clientSecret: deps.githubClientSecret },
     ...deps.logger === void 0 ? {} : { logger: deps.logger }
   };
 }
@@ -4728,9 +4482,8 @@ async function dispatch(method, pathname, url, body, deps) {
     return { github: probe };
   }
   if (method === "POST" && pathname === "/github/browser/begin") {
-    const method2 = body.method === "device" ? "device" : "browser";
     try {
-      const view = await beginGithubSignIn(githubAuthDeps(deps), method2);
+      const view = await beginGithubSignIn(githubAuthDeps(deps));
       if (view.phase === "error") throw new IpcError("GITHUB_AUTH_UNAVAILABLE", redact(view.error ?? "GitHub \u767B\u5F55\u5931\u8D25"));
       return { attempt: view };
     } catch (error) {
@@ -4878,15 +4631,10 @@ async function statePayload(deps, settings) {
       authMode: settings.github.authMode,
       configured: github.token !== void 0,
       source: github.source,
-      /** 浏览器登录 attempt 视图（idle / waiting-browser / waiting-device / exchanging / done / error）。 */
+      /** GitHub 登录 attempt 视图（idle / waiting-device / exchanging / done / error）。 */
       attempt: attemptView(),
-      /** 浏览器登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
-      browserAvailable: browserSignInAvailable(deps),
-      /**
-       * 回环 web flow 是否可用：GitHub 换 token 必须有 client_secret，内置 client_id 没有 → 只能设备码。
-       * 前端据此决定主按钮启动哪个 method（false 时直接用 device，避免点了必然失败的 web flow）。
-       */
-      loopbackAvailable: isLoopbackSignInAvailable(githubAuthDeps(deps))
+      /** 登录是否可用：authorization 服务在、且 GitHub flow 真的注册上了（client_id 有内置默认）。 */
+      browserAvailable: browserSignInAvailable(deps)
     }
   };
 }

package/lib/index.d.ts

@@ -27,7 +27,6 @@ declare function apply(ctx: PluginContext, config?: {
     stateDir?: string;
     corePath?: string;
     githubClientId?: string;
-    githubClientSecret?: string;
 }): void;
 declare const _default: {
     name: string;

package/lib/index.js

@@ -9,7 +9,7 @@ import {
   createUpdateService,
   ensureGithubFlow,
   readPluginInfo
-} from "./chunk-QOYTABJH.js";
+} from "./chunk-OMQY3T3V.js";
 
 // src/index.ts
 var name = "dsh-github-trending";
@@ -20,7 +20,6 @@ function readVersion() {
 var VERSION = readVersion();
 function apply(ctx, config = {}) {
   const env = process.env;
-  const githubClientSecret = (config.githubClientSecret ?? env.DSH_GITHUB_CLIENT_SECRET)?.trim();
   const get = (key) => typeof ctx.get === "function" ? ctx.get(key) : void 0;
   const log = (event, data) => {
     const suffix = data === void 0 ? "" : ` ${JSON.stringify(data)}`;
@@ -68,8 +67,7 @@ function apply(ctx, config = {}) {
   const githubAuth = (resolve) => ({
     get: resolve,
     logger: log,
-    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId },
-    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { clientSecret: githubClientSecret }
+    ...config.githubClientId === void 0 ? {} : { clientId: config.githubClientId }
   });
   const registerAuth = (resolve) => {
     if (!ensureGithubFlow(githubAuth(resolve ?? get))) log("auth.flow.deferred", { reason: "authorization-not-ready" });
@@ -102,7 +100,6 @@ function apply(ctx, config = {}) {
     pluginName: pluginInfo.name,
     ...pluginInfo.repository === void 0 ? {} : { repository: pluginInfo.repository },
     ...config.githubClientId === void 0 ? {} : { githubClientId: config.githubClientId },
-    ...githubClientSecret === void 0 || githubClientSecret === "" ? {} : { githubClientSecret },
     logger: log
   });
   const register = () => {

package/lib/internal.d.ts

@@ -1157,39 +1157,36 @@ declare namespace github {
   export { type github_GithubProbeResult as GithubProbeResult, github_probeGithubAuth as probeGithubAuth };
 }
 
+/**
+ * GitHub 浏览器登录（薄 adapter）。
+ *
+ * 设计原则：**只补核心缺的那一层，其余全用核心轮子**（见
+ * `.dsh/docs/plans/2026-11-01-github-browser-auth-plan.md`）。
+ *   - 协议生命周期 / attempt 单飞 / 取消 / 结算 → `ctx.authorization`（核心）
+ *   - 回环回调 HTTP 载体 → `ctx.webServer.register({ kind:'exact' })`（核心）
+ *   - token 落盘 / 原子写 / 0600 / record 事件 → `ctx.credentials`（核心）
+ *   - 交互词汇 notify/prompt → `AuthorizationSession`（核心）
+ *
+ * 本文件只写 GitHub provider 专有的：client_id、端点、PKCE 三行、state 校验、exchange、
+ * grant payload，以及「进程内 begin + 内存 attempt 视图」这点胶水（核心没有给第三方 key
+ * 的 authorization HTTP 投影，见阶段 0 核实 R4）。
+ *
+ * 不 import 任何 `@deepseek-ai/*` 运行时模块：全部走 `get(...)` 的鸭子类型，故不需要新增
+ * peerDependency。record 键用字符串 `'github/default'`（与核心包提案同名同构，便于迁移）。
+ */
 /** 与核心 `@deepseek-ai/dsh-github-auth` 提案保持同 key；迁移时消费端无需改。 */
 declare const GITHUB_RECORD_KEY = "github/default";
-/** 本地回调路径（带集成前缀，避免多 provider 撞 webServer 的 `(kind,path)` 唯一约束）。 */
-declare const CALLBACK_PATH = "/api/morehao/github-trending/oauth/github/callback";
 /**
  * 内置的 GitHub OAuth App 公开 client_id（**非机密**：OAuth 的 client_id 设计上就是公开的，
  * 会出现在授权 URL 里，与 `gh`/VS Code 内置自己的 client_id 同理）。
  *
- * ⚠️ 只有 client_id 不够：GitHub 的 web application flow 在换 token 时**仍然要求
- * client_secret**（PKCE 是叠加保护，不能替代，2025-07 起官方也只说「推荐」而非「可免 secret」）。
- * 因此：
- *   - 内置 client_id → 只能走 **device flow**（`resolveMethod` 自动降级），开箱即用；
- *   - 用户自带 OAuth App（`githubClientId` + `githubClientSecret`）→ 才启用回环 web flow。
- * 且 device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
- *
- * OAuth App 侧登记的回调：`http://127.0.0.1/api/morehao/github-trending/oauth/github/callback`
- * （loopback 按 RFC 8252 忽略端口，运行时随机端口可正常回跳）。
+ * 只走 **device flow**：GitHub 的 web application flow 换 token 必须带 client_secret，
+ * 而客户端不能内置机密，故本插件不实现回环 web flow（也不支持自带 OAuth App 的 secret）。
+ * device flow 需要在 OAuth App 设置里勾选启用（本插件内置的 App 已启用）。
  */
 declare const DEFAULT_GITHUB_CLIENT_ID = "Ov23li7rhp0EKoqbkJKY";
-/** 解析生效的 client_id：显式 config 优先，否则用内置默认。 */
+/** 解析生效的 client_id：显式 config 优先，否则用内置默认（device flow 允许自定义 client_id）。 */
 declare function resolveClientId(deps: GithubAuthDeps): string | undefined;
-/** 解析生效的 client_secret（没有就返回 undefined，绝不以空串形式发出去）。 */
-declare function resolveClientSecret(deps: GithubAuthDeps): string | undefined;
-/**
- * 回环（浏览器 web flow）是否可用：GitHub 换 token 必须带 client_secret，
- * 内置的公开 client_id 没有 secret，只能退到设备码。见文件头的说明。
- */
-declare function isLoopbackSignInAvailable(deps: GithubAuthDeps): boolean;
-/**
- * 实际要跑的方法：`browser` 需要 client_secret，缺省时自动降级为 `device`（开箱即用）。
- * 显式选择 `device` 的调用不受影响。
- */
-declare function resolveMethod(deps: GithubAuthDeps, requested: 'browser' | 'device'): 'browser' | 'device';
 /** 本插件运行需要 push / 建 PR，`read:user` 不够；一次授权到 `repo`。 */
 declare const DEFAULT_SCOPE = "repo";
 interface AuthorizationFlow {
@@ -1224,15 +1221,6 @@ interface AuthorizationLike {
     /** 核心 0.2.x 有：按 key 查已注册的 flow；判定「真的注册上了」靠它。 */
     describe?: (key: string) => unknown;
 }
-interface WebServerLike {
-    register?: (route: {
-        kind: 'exact';
-        path: string;
-        handler: (req: any, res: any) => void;
-    }) => () => void;
-    port?: number;
-    host?: string;
-}
 type FetchLike = typeof fetch;
 interface GithubAuthDeps {
     get: (name: string) => unknown;
@@ -1240,70 +1228,25 @@ interface GithubAuthDeps {
     logger?: (event: string, data?: Record<string, unknown>) => void;
     /** 覆盖端点（测试用）；生产留空走 GitHub 官方。 */
     endpoints?: {
-        authorize?: string;
         accessToken?: string;
         deviceCode?: string;
         user?: string;
     };
-    /** GitHub OAuth App 的 public client_id（无需 secret）。 */
+    /** GitHub OAuth App 的 public client_id（device flow 用；无需 secret）。 */
     clientId?: string;
-    /**
-     * GitHub OAuth App 的 client_secret。只有自带 OAuth App 的回环 web flow 才需要；
-     * 缺省时 `browser` 方法自动降级为 device flow。不进 `settings.json`、不进日志。
-     */
-    clientSecret?: string;
     scope?: string;
     attemptTimeoutMs?: number;
 }
-type GithubAttemptPhase = 'idle' | 'waiting-browser' | 'waiting-device' | 'exchanging' | 'done' | 'error';
+type GithubAttemptPhase = 'idle' | 'waiting-device' | 'exchanging' | 'done' | 'error';
 interface GithubAttemptView {
     phase: GithubAttemptPhase;
-    authorizeUrl?: string;
     verificationUri?: string;
-    /**
-     * device flow 的预填验证码地址（`verification_uri_complete`），**可选**：若 provider 返回就透出，
-     * 前端优先用它打开（码已预填）。注意 GitHub 官方 device flow 实测不返回该字段，此时走
-     * `verificationUri` + 手动输入；保留此字段只为兼容会返回它的 provider。
-     */
-    verificationUriComplete?: string;
     userCode?: string;
     expiresAt?: number;
     login?: string;
     error?: string;
 }
 declare function attemptView(): GithubAttemptView;
-/** 判断一个未知值是否是可直接打开的 http(s) URL（用于校验 GitHub 返回的验证页地址）。 */
-declare function isHttpUrl(value: unknown): boolean;
-/** PKCE：返回 verifier 与 S256 challenge。 */
-declare function createPkce(): {
-    verifier: string;
-    challenge: string;
-};
-/** 常量时间比较 state（长度不等直接 false，避免 timingSafeEqual 抛错）。 */
-declare function verifyState(received: string, expected: string): boolean;
-/** 回调落地页的两种结果（纯展示，无外部资源，离线可测）。 */
-type CallbackPageKind = 'success' | 'error';
-/**
- * 回环回调的落地页 HTML。自包含、无外链资源（CSP 友好、离线可用），
- * 跟随系统深浅色；成功页会尝试自动关闭本窗口（脚本失败时文字兜底）。
- */
-declare function renderCallbackPage(kind: CallbackPageKind): string;
-/** 拼授权页 URL。 */
-declare function buildAuthorizeUrl(params: {
-    authorizeEndpoint: string;
-    clientId: string;
-    redirectUri: string;
-    scope: string;
-    state: string;
-    challenge: string;
-}): string;
-interface GithubGrantPayload {
-    version: 1;
-    token: string;
-    login?: string;
-    tokenType?: string;
-    scope?: string;
-}
 /** 这个 key 现在是否**真的**有 flow 在注册表里。 */
 declare function isGithubFlowRegistered(deps: GithubAuthDeps): boolean;
 /**
@@ -1334,7 +1277,7 @@ declare function registerGithubFlow(deps: GithubAuthDeps): void;
  *
  * @throws 服务不可用、flow 未注册、已有 attempt 在飞时抛错。
  */
-declare function beginGithubSignIn(deps: GithubAuthDeps, method?: 'browser' | 'device'): Promise<GithubAttemptView>;
+declare function beginGithubSignIn(deps: GithubAuthDeps): Promise<GithubAttemptView>;
 /** 取消进行中的 attempt。 */
 declare function cancelGithubSignIn(deps: GithubAuthDeps): void;
 /** 仅测试用：清空内存 attempt。 */
@@ -1343,33 +1286,22 @@ declare function resetAttemptForTest(): void;
 type githubAuth_AuthorizationFlow = AuthorizationFlow;
 type githubAuth_AuthorizationLike = AuthorizationLike;
 type githubAuth_AuthorizationSessionLike = AuthorizationSessionLike;
-declare const githubAuth_CALLBACK_PATH: typeof CALLBACK_PATH;
 declare const githubAuth_DEFAULT_GITHUB_CLIENT_ID: typeof DEFAULT_GITHUB_CLIENT_ID;
 declare const githubAuth_DEFAULT_SCOPE: typeof DEFAULT_SCOPE;
 declare const githubAuth_GITHUB_RECORD_KEY: typeof GITHUB_RECORD_KEY;
 type githubAuth_GithubAttemptPhase = GithubAttemptPhase;
 type githubAuth_GithubAttemptView = GithubAttemptView;
 type githubAuth_GithubAuthDeps = GithubAuthDeps;
-type githubAuth_GithubGrantPayload = GithubGrantPayload;
-type githubAuth_WebServerLike = WebServerLike;
 declare const githubAuth_attemptView: typeof attemptView;
 declare const githubAuth_beginGithubSignIn: typeof beginGithubSignIn;
-declare const githubAuth_buildAuthorizeUrl: typeof buildAuthorizeUrl;
 declare const githubAuth_cancelGithubSignIn: typeof cancelGithubSignIn;
-declare const githubAuth_createPkce: typeof createPkce;
 declare const githubAuth_ensureGithubFlow: typeof ensureGithubFlow;
 declare const githubAuth_isGithubFlowRegistered: typeof isGithubFlowRegistered;
-declare const githubAuth_isHttpUrl: typeof isHttpUrl;
-declare const githubAuth_isLoopbackSignInAvailable: typeof isLoopbackSignInAvailable;
 declare const githubAuth_registerGithubFlow: typeof registerGithubFlow;
-declare const githubAuth_renderCallbackPage: typeof renderCallbackPage;
 declare const githubAuth_resetAttemptForTest: typeof resetAttemptForTest;
 declare const githubAuth_resolveClientId: typeof resolveClientId;
-declare const githubAuth_resolveClientSecret: typeof resolveClientSecret;
-declare const githubAuth_resolveMethod: typeof resolveMethod;
-declare const githubAuth_verifyState: typeof verifyState;
 declare namespace githubAuth {
-  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_CALLBACK_PATH as CALLBACK_PATH, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, type githubAuth_GithubGrantPayload as GithubGrantPayload, type githubAuth_WebServerLike as WebServerLike, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_buildAuthorizeUrl as buildAuthorizeUrl, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_createPkce as createPkce, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_isHttpUrl as isHttpUrl, githubAuth_isLoopbackSignInAvailable as isLoopbackSignInAvailable, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_renderCallbackPage as renderCallbackPage, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId, githubAuth_resolveClientSecret as resolveClientSecret, githubAuth_resolveMethod as resolveMethod, githubAuth_verifyState as verifyState };
+  export { type githubAuth_AuthorizationFlow as AuthorizationFlow, type githubAuth_AuthorizationLike as AuthorizationLike, type githubAuth_AuthorizationSessionLike as AuthorizationSessionLike, githubAuth_DEFAULT_GITHUB_CLIENT_ID as DEFAULT_GITHUB_CLIENT_ID, githubAuth_DEFAULT_SCOPE as DEFAULT_SCOPE, githubAuth_GITHUB_RECORD_KEY as GITHUB_RECORD_KEY, type githubAuth_GithubAttemptPhase as GithubAttemptPhase, type githubAuth_GithubAttemptView as GithubAttemptView, type githubAuth_GithubAuthDeps as GithubAuthDeps, githubAuth_attemptView as attemptView, githubAuth_beginGithubSignIn as beginGithubSignIn, githubAuth_cancelGithubSignIn as cancelGithubSignIn, githubAuth_ensureGithubFlow as ensureGithubFlow, githubAuth_isGithubFlowRegistered as isGithubFlowRegistered, githubAuth_registerGithubFlow as registerGithubFlow, githubAuth_resetAttemptForTest as resetAttemptForTest, githubAuth_resolveClientId as resolveClientId };
 }
 
 interface DefaultBranchResult {
@@ -2053,10 +1985,8 @@ interface RouteDeps {
     /** 包名与仓库地址都来自 package.json，由 src/index.ts 传入。 */
     pluginName?: string;
     repository?: string;
-    /** 浏览器 GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
+    /** GitHub 登录用的 public client_id（由 apply 的 config 传入；缺省时用内置默认）。 */
     githubClientId?: string;
-    /** 自带 OAuth App 时的 client_secret（只用于回环 web flow；缺省时该 method 自动降级为设备码）。 */
-    githubClientSecret?: string;
     logger?: (event: string, data?: Record<string, unknown>) => void;
 }
 declare function createRoutes(deps: RouteDeps): (request: http.IncomingMessage, response: http.ServerResponse) => Promise<void>;

package/lib/internal.js

@@ -27,7 +27,7 @@ import {
   tools_exports,
   update_exports,
   version_exports
-} from "./chunk-QOYTABJH.js";
+} from "./chunk-OMQY3T3V.js";
 
 // src/internal.ts
 import * as exec from "@morehao/dsh-plugin-kit/exec";