@openma/deepseek-harness-acp 0.4.5 → 0.4.6

package/dist/bridge.js

@@ -22,7 +22,6 @@ import { createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { foldSessionTitle } from "@deepseek-ai/dsh-session-title";
 import { SANDBOX_MODES, setSandboxMode } from "@deepseek-ai/dsh-sandbox-policy";
-import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import * as agentModule from "@deepseek-ai/dsh-agent";
 import * as mcpClient from "@deepseek-ai/dsh-mcp-client";
 function selfHarness() {
@@ -35,7 +34,6 @@ function selfHarness() {
     foldSessionTitle,
     setSandboxMode,
     sandboxModes: SANDBOX_MODES,
-    credentialRef,
     ...installModelSelection !== void 0 ? { installModelSelection } : {},
     mcpClient
   };
@@ -56,11 +54,245 @@ import {
   PROTOCOL_VERSION,
   RequestError
 } from "@agentclientprotocol/sdk";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
 
 // src/version.ts
 import { createRequire } from "node:module";
 var VERSION = createRequire(import.meta.url)("../package.json").version;
 
+// src/auth.ts
+var LOGIN_DESCRIPTION = "Save an API key to the harness credential store shared with the dsh Web UI";
+function isDeepseekRoute(provider) {
+  return provider === void 0 || provider === "deepseek-official" || provider === "deepseek";
+}
+function credentialEnvNames(provider) {
+  if (provider === void 0 || isDeepseekRoute(provider)) return ["DEEPSEEK_API_KEY", "DEEPSEEK_BASE_URL"];
+  if (provider === "anthropic") return ["ANTHROPIC_API_KEY"];
+  if (provider === "openai" || provider.startsWith("openai")) return ["OPENAI_API_KEY"];
+  return [`${provider.replace(/[^a-zA-Z0-9]+/g, "_").toUpperCase()}_API_KEY`];
+}
+function primaryCredentialName(provider) {
+  return credentialEnvNames(provider)[0] ?? "DEEPSEEK_API_KEY";
+}
+function providerFromAuthMethodId(methodId) {
+  if (!methodId) return void 0;
+  for (const prefix of ["api-key:", "terminal-login:"]) {
+    if (methodId.startsWith(prefix)) return methodId.slice(prefix.length);
+  }
+  return void 0;
+}
+function apiKeyFromAuthenticate(params) {
+  const meta = params._meta;
+  const block = meta && typeof meta === "object" && !Array.isArray(meta) ? meta["api-key"] : void 0;
+  const record = block && typeof block === "object" && !Array.isArray(block) ? block : void 0;
+  const key = typeof record?.apiKey === "string" ? record.apiKey.trim() : void 0;
+  const providerFromMeta = typeof record?.provider === "string" ? record.provider : void 0;
+  const provider = providerFromMeta || providerFromAuthMethodId(params.methodId);
+  return {
+    ...provider && provider.length > 0 ? { provider } : {},
+    ...key && key.length > 0 ? { key } : {}
+  };
+}
+function gatewayFromAuthenticate(params) {
+  const meta = params._meta;
+  const block = meta && typeof meta === "object" && !Array.isArray(meta) ? meta.gateway : void 0;
+  const record = block && typeof block === "object" && !Array.isArray(block) ? block : void 0;
+  const baseUrl = typeof record?.baseUrl === "string" ? record.baseUrl.trim() : void 0;
+  const headers = stringRecord(record?.headers);
+  const providerName = typeof record?.providerName === "string" ? record.providerName.trim() : void 0;
+  const key = apiKeyFromHeaders(headers);
+  return {
+    ...baseUrl && baseUrl.length > 0 ? { baseUrl } : {},
+    ...headers ? { headers } : {},
+    ...providerName && providerName.length > 0 ? { providerName } : {},
+    ...key && key.length > 0 ? { key } : {}
+  };
+}
+function isBrowserAuthMethod(methodId) {
+  return methodId === "browser";
+}
+function isGatewayAuthMethod(methodId) {
+  return methodId === "gateway";
+}
+function credentialBaseUrlName(provider) {
+  if (isDeepseekRoute(provider) || provider === void 0) return "DEEPSEEK_BASE_URL";
+  if (provider === "anthropic") return "ANTHROPIC_BASE_URL";
+  if (provider === "openai" || provider.startsWith("openai")) return "OPENAI_BASE_URL";
+  return `${provider.replace(/[^a-zA-Z0-9]+/g, "_").toUpperCase()}_BASE_URL`;
+}
+function advertisedAuthMethods(providers, clientCapabilities, env = process.env) {
+  const methods = [...apiKeyAuthMethods(providers)];
+  if (shouldOfferLocalAuthPage(env)) methods.push(browserAuthMethod());
+  if (clientCapabilities?.auth?._meta?.["gateway"] === true) methods.push(gatewayAuthMethod());
+  return methods;
+}
+function apiKeyAuthMethods(providers) {
+  if (providers.length <= 1) {
+    const provider = providers[0];
+    return [apiKeyAuthMethod(provider?.id, provider?.name, providers.length === 0)];
+  }
+  return providers.map((provider) => apiKeyAuthMethod(provider.id, provider.name, false));
+}
+function apiKeyAuthMethod(provider, name3, unscoped) {
+  const scoped = !unscoped && provider !== void 0;
+  return {
+    id: scoped ? `api-key:${provider}` : "api-key",
+    name: scoped ? `${name3 ?? provider} API key` : "API Key",
+    description: LOGIN_DESCRIPTION,
+    _meta: { "api-key": scoped ? { provider } : {} }
+  };
+}
+function shouldOfferLocalAuthPage(env = process.env) {
+  if (env["NO_BROWSER"]) return false;
+  if (env["NODE_ENV"] === "test" || env["CI"] === "true" || env["CI"] === "1") return false;
+  if (env["DSH_ACP_AUTH_PAGE"] === "0") return false;
+  return true;
+}
+function browserAuthMethod() {
+  return {
+    id: "browser",
+    name: "Browser",
+    description: "Open a local sign-in page to save an API key. The secret never travels over ACP."
+  };
+}
+function gatewayAuthMethod() {
+  return {
+    id: "gateway",
+    name: "Custom model gateway",
+    description: "Use a custom OpenAI-compatible gateway",
+    _meta: { gateway: { protocol: "openai", restartRequired: "false" } }
+  };
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entries = Object.entries(value).filter(
+    (entry) => typeof entry[1] === "string" && entry[1].trim().length > 0
+  );
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function apiKeyFromHeaders(headers) {
+  if (!headers) return void 0;
+  const authorization = headers["Authorization"] ?? headers["authorization"];
+  if (authorization) {
+    const bearer = authorization.match(/^Bearer\s+(.+)$/i);
+    const token = (bearer?.[1] ?? authorization).trim();
+    if (token.length > 0) return token;
+  }
+  const first = Object.values(headers).find((value) => value.trim().length > 0);
+  return first?.trim();
+}
+
+// src/auth-page.ts
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+function startLocalAuthPage(options) {
+  return new Promise((resolve, reject) => {
+    const server = createServer((request, response) => {
+      void handle(request, response);
+    });
+    let settle;
+    let fail;
+    const completed = new Promise((res, rej) => {
+      settle = res;
+      fail = rej;
+    });
+    const timeoutMs = options.timeoutMs ?? 10 * 6e4;
+    const timer = setTimeout(() => {
+      server.close();
+      fail?.(new Error("local auth page timed out"));
+    }, timeoutMs);
+    timer.unref?.();
+    const handle = async (request, response) => {
+      if (request.method === "GET" || request.method === void 0) {
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        response.end(authPageHtml(options.credentialName));
+        return;
+      }
+      if (request.method === "POST") {
+        const body = await readBody(request);
+        const key = new URLSearchParams(body).get("api-key")?.trim() ?? "";
+        if (key.length === 0) {
+          response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+          response.end(authPageHtml(options.credentialName, "Enter an API key."));
+          return;
+        }
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        response.end(
+          "<!doctype html><html><body><p>Saved. You can return to the client.</p></body></html>"
+        );
+        clearTimeout(timer);
+        server.close();
+        settle?.(key);
+        return;
+      }
+      response.writeHead(405);
+      response.end();
+    };
+    server.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close();
+        reject(new Error("local auth page failed to bind"));
+        return;
+      }
+      const url = `http://127.0.0.1:${address.port}/`;
+      resolve({
+        url,
+        close: () => {
+          clearTimeout(timer);
+          server.close();
+        },
+        completed
+      });
+    });
+  });
+}
+function openLocalAuthPage(url) {
+  const platform = process.platform;
+  if (platform === "darwin") {
+    execFile("open", [url], () => void 0);
+    return;
+  }
+  if (platform === "win32") {
+    execFile("cmd", ["/c", "start", "", url], () => void 0);
+    return;
+  }
+  execFile("xdg-open", [url], () => void 0);
+}
+function authPageHtml(credentialName, error) {
+  const message = error ? `<p>${escapeHtml(error)}</p>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>DeepSeek Harness sign in</title></head>
+<body>
+  <h1>Save API key</h1>
+  <p>Stored as ${escapeHtml(credentialName)} in the harness credential store.</p>
+  ${message}
+  <form method="post">
+    <label>API key <input type="password" name="api-key" autocomplete="off" required></label>
+    <button type="submit">Save</button>
+  </form>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char] ?? char);
+}
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    request.on("data", (chunk) => {
+      chunks.push(Buffer.from(chunk));
+    });
+    request.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    request.on("error", reject);
+  });
+}
+
 // src/log.ts
 var PREFIX = "[dsh-acp]";
 function logWarn(message) {
@@ -604,7 +836,7 @@ ${contextBlock(resource.uri, resource.text)}
 
 // src/bridge/index.ts
 var name = "acp-bridge";
-var inject = ["agents"];
+var inject = ["agents", "credentials", "llm", "agentDefaultModel", "sessionPersistence", "approval", "permissionPresets", "commands", "agentPresets", "skills", "subagents"];
 function invalidParams(detail) {
   return RequestError.invalidParams(void 0, detail);
 }
@@ -614,9 +846,6 @@ function internalError(detail) {
 function authRequired(detail) {
   return RequestError.authRequired(void 0, detail);
 }
-function envCredentialPresent() {
-  return Boolean(process.env["DEEPSEEK_API_KEY"] || process.env["DEEPSEEK_BASE_URL"]);
-}
 var MODE_LABELS = {
   "read-only": { name: "Read-only", description: "Bash and file mutations are denied by the sandbox" },
   "workspace-write": {
@@ -630,6 +859,16 @@ var MODE_LABELS = {
 };
 async function apply(ctx, config = {}) {
   const agents = ctx.agents;
+  const credentials = ctx.credentials;
+  const llm = ctx.llm;
+  const agentDefaultModel = ctx.agentDefaultModel;
+  const sessionPersistence = ctx.sessionPersistence;
+  const approval = ctx.approval;
+  const permissionPresets = ctx.permissionPresets;
+  const commandRuntime = ctx.commands;
+  const agentPresets = ctx.agentPresets;
+  const skillRegistry = ctx.skills;
+  const subagents = ctx.subagents;
   const harness = config.harness ?? (await Promise.resolve().then(() => (init_self_harness(), self_harness_exports))).selfHarness();
   const { createUserMessage: createUserMessage2, errorChain: errorChain2, sessionId: SessionId2, foldSessionTitle: foldSessionTitle2, setSandboxMode: setSandboxMode2 } = harness;
   const SANDBOX_MODES2 = harness.sandboxModes;
@@ -644,10 +883,8 @@ async function apply(ctx, config = {}) {
     return [...seen];
   };
   const defaultSelection = () => {
-    const service = ctx.get("agentDefaultModel");
-    if (service === void 0) return {};
     try {
-      return service.currentSelection();
+      return agentDefaultModel.currentSelection();
     } catch (error) {
       logDebug(`agentDefaultModel.currentSelection failed: ${String(error)}`);
       return {};
@@ -664,28 +901,25 @@ async function apply(ctx, config = {}) {
   const effortCache = /* @__PURE__ */ new Map();
   const discoverModels = async () => {
     if (liveCatalog !== void 0) return liveCatalog;
-    const llm = ctx.get("llm");
     const found = [];
-    if (llm !== void 0) {
-      try {
-        const providers = llm.listProviders();
-        const multi = providers.length > 1;
-        for (const provider of providers) {
-          const models = await llm.listModels(provider.id).catch((error) => {
-            logDebug(`listModels(${provider.id}) failed: ${String(error)}`);
-            return [];
+    try {
+      const providers = llm.listProviders();
+      const multi = providers.length > 1;
+      for (const provider of providers) {
+        const models = await llm.listModels(provider.id).catch((error) => {
+          logDebug(`listModels(${provider.id}) failed: ${String(error)}`);
+          return [];
+        });
+        for (const model of models) {
+          found.push({
+            provider: provider.id,
+            model: model.id,
+            label: multi ? `${model.name} (${provider.name})` : model.name
           });
-          for (const model of models) {
-            found.push({
-              provider: provider.id,
-              model: model.id,
-              label: multi ? `${model.name} (${provider.name})` : model.name
-            });
-          }
         }
-      } catch (error) {
-        logDebug(`model discovery failed: ${String(error)}`);
       }
+    } catch (error) {
+      logDebug(`model discovery failed: ${String(error)}`);
     }
     liveCatalog = found;
     return found;
@@ -721,10 +955,9 @@ async function apply(ctx, config = {}) {
     if (provider === void 0 || model === void 0) return void 0;
     const key = `${provider}::${model}`;
     if (effortCache.has(key)) return effortCache.get(key);
-    const llm = ctx.get("llm");
     let catalog;
     try {
-      const reasoning = (await llm?.resolveModelInfo?.(provider, model))?.reasoning;
+      const reasoning = (await llm.resolveModelInfo(provider, model)).reasoning;
       if (reasoning !== void 0 && reasoning.efforts.length > 0) {
         catalog = {
           efforts: reasoning.efforts.map((effort) => ({
@@ -827,27 +1060,38 @@ async function apply(ctx, config = {}) {
     }
     setApprovalPolicy(record, record.approvals);
   };
-  const credentialPresent = async () => {
-    if (envCredentialPresent()) return true;
-    const brand = harness.credentialRef;
-    if (brand === void 0) return false;
-    const deadline = Date.now() + 5e3;
-    for (; ; ) {
-      const seam = ctx.get("credentials");
-      if (seam !== void 0) {
-        try {
-          return await seam.resolve(brand("DEEPSEEK_API_KEY")) !== void 0;
-        } catch (error) {
-          logWarn(`credential lookup failed: ${String(error)}`);
-          return false;
-        }
-      }
-      if (Date.now() >= deadline) {
-        logDebug("credential gate: no credentials service registered within 5s");
-        return false;
+  const listProviderRoutes = async () => {
+    try {
+      const raw = llm.listProviders();
+      if (!Array.isArray(raw)) return [];
+      return raw.flatMap((entry) => {
+        if (!entry || typeof entry !== "object") return [];
+        const id = entry.id;
+        if (typeof id !== "string" || id.length === 0) return [];
+        const name3 = entry.name;
+        return [{ id, ...typeof name3 === "string" && name3.length > 0 ? { name: name3 } : {} }];
+      });
+    } catch (error) {
+      logDebug(`listProviders failed: ${String(error)}`);
+      return [];
+    }
+  };
+  const credentialPresent = async (provider) => {
+    const names = credentialEnvNames(provider).filter((name3) => !name3.endsWith("_BASE_URL"));
+    for (const name3 of names) {
+      try {
+        if (await credentials.resolve(credentialRef(name3)) !== void 0) return true;
+      } catch (error) {
+        logWarn(`credential lookup failed: ${String(error)}`);
       }
-      await new Promise((resolve) => setTimeout(resolve, 100));
     }
+    return false;
+  };
+  const requireCredential = async (provider) => {
+    if (await credentialPresent(provider)) return;
+    throw authRequired(
+      'no credential found for this provider: call authenticate with `_meta["api-key"].apiKey` or `_meta.gateway`, use the browser method, run `dsh-acp login`, or save a key in the dsh Web UI (Settings \u2192 Models)'
+    );
   };
   const agentOptionsFor = (model, provider) => ({
     ...provider !== void 0 ? { provider } : config.provider !== void 0 ? { provider: config.provider } : {},
@@ -866,7 +1110,6 @@ async function apply(ctx, config = {}) {
   const requireOrRestoreSession = async (sessionId) => {
     const record = sessions.get(sessionId);
     if (record !== void 0) return record;
-    if (ctx.get("sessionPersistence") === void 0) throw invalidParams(`unknown session: ${sessionId}`);
     logWarn(`restoring session ${sessionId} from the persisted log`);
     try {
       return await restoreSession(sessionId, { replay: false });
@@ -906,7 +1149,7 @@ async function apply(ctx, config = {}) {
     }
     const presets = presetsService();
     const storedPreset = presetFromLog(storedHeader, events);
-    const presetId = presets === void 0 ? void 0 : (await presets.resolve(storedPreset)).id;
+    const presetId = (await presets.resolve(storedPreset)).id;
     const handle = await agents.resume({
       resumeSessionId: SessionId2(sessionId),
       agentOptions: agentOptionsFor(config.model),
@@ -929,7 +1172,7 @@ async function apply(ctx, config = {}) {
     if (presetId !== void 0) record.preset = presetId;
     {
       const permission = permissionService();
-      const storedMode = permission?.current(events);
+      const storedMode = permission.current(events);
       if (storedMode !== void 0) record.modeId = storedMode;
       for (let index = events.length - 1; index >= 0; index -= 1) {
         const event = events[index];
@@ -958,9 +1201,9 @@ async function apply(ctx, config = {}) {
     record.inflight = void 0;
     inflight.resolve(reason);
   };
-  const presetsService = () => ctx.get("agentPresets");
+  const presetsService = () => agentPresets;
   const presetSetup = (presets, presetId) => {
-    if (presets === void 0 || presetId === void 0) return void 0;
+    if (presetId === void 0) return void 0;
     return async (agentCtx) => {
       logDebug(`preset setup: mounting "${presetId}"`);
       await presets.mount(agentCtx, presetId);
@@ -979,7 +1222,7 @@ async function apply(ctx, config = {}) {
   const presetLabel = (id) => id.charAt(0).toUpperCase() + id.slice(1);
   const modeState = (record) => {
     const permission = permissionService();
-    if (permission !== void 0 && permission.names.length > 0) {
+    if (permission.names.length > 0) {
       return {
         currentModeId: record.modeId,
         availableModes: permission.names.map((name3) => {
@@ -1001,7 +1244,6 @@ async function apply(ctx, config = {}) {
       throw invalidParams("cannot switch presets while a prompt is running");
     }
     const presets = presetsService();
-    if (presets === void 0) throw invalidParams(`unknown mode: ${presetId}`);
     let resolved;
     try {
       resolved = (await presets.resolve(presetId)).id;
@@ -1009,29 +1251,44 @@ async function apply(ctx, config = {}) {
       throw invalidParams(`unknown preset: ${presetId} (${errorChain2(error)})`);
     }
     if (resolved === record.preset) return;
-    try {
-      record.agent.session.append("agent-preset/selected", { agentPreset: resolved });
-    } catch (error) {
-      logWarn(`recording preset selection failed: ${String(error)}`);
-    }
+    const previous = record.preset;
     const sessionId = record.agent.session.id;
+    const resumeWith = (id) => agents.resume({
+      resumeSessionId: sessionId,
+      agentOptions: agentOptionsFor(record.model ?? config.model, record.provider),
+      ...presetSetup(presets, id) !== void 0 ? { setup: presetSetup(presets, id) } : {}
+    });
     await record.dispose().catch((error) => {
       logWarn(`dispose during preset switch failed: ${String(error)}`);
     });
     let handle;
     try {
-      handle = await agents.resume({
-        resumeSessionId: sessionId,
-        agentOptions: agentOptionsFor(record.model ?? config.model, record.provider),
-        setup: presetSetup(presets, resolved)
-      });
+      handle = await resumeWith(resolved);
     } catch (error) {
-      sessions.delete(acpSessionId);
-      throw internalError(`preset switch failed: ${errorChain2(error)}`);
+      try {
+        handle = await resumeWith(previous);
+      } catch (restoreError) {
+        sessions.delete(acpSessionId);
+        throw internalError(
+          `preset switch failed: ${errorChain2(error)}; restore also failed: ${errorChain2(restoreError)}`
+        );
+      }
+      record.agent = handle.agent;
+      record.dispose = () => handle.dispose();
+      delete record.selection;
+      ensureSelection(record);
+      setApprovalPolicy(record, record.approvals);
+      publishCommands(acpSessionId, record);
+      throw invalidParams(`preset "${resolved}" failed to mount: ${errorChain2(error)}`);
     }
     record.agent = handle.agent;
     record.dispose = () => handle.dispose();
     record.preset = resolved;
+    try {
+      handle.agent.session.append("agent-preset/selected", { agentPreset: resolved });
+    } catch (error) {
+      logWarn(`recording preset selection failed: ${String(error)}`);
+    }
     delete record.selection;
     ensureSelection(record);
     setApprovalPolicy(record, record.approvals);
@@ -1039,16 +1296,16 @@ async function apply(ctx, config = {}) {
   };
   const setApprovalPolicy = (record, policy) => {
     try {
-      ctx.get("approval")?.setPolicy?.(record.agent, policy);
+      approval.setPolicy(record.agent, policy);
     } catch (error) {
       logWarn(`approval policy switch failed: ${String(error)}`);
     }
     record.approvals = policy;
   };
-  const permissionService = () => ctx.get("permissionPresets") ?? ctx.get("permission");
+  const permissionService = () => permissionPresets;
   const applyMode = (record, sessionId, modeId) => {
     const permission = permissionService();
-    if (permission !== void 0 && permission.names.includes(modeId)) {
+    if (permission.names.includes(modeId)) {
       let bundledApproval = record.approvals;
       permission.apply(record.agent.session, modeId, (policy) => {
         bundledApproval = policy;
@@ -1090,7 +1347,7 @@ async function apply(ctx, config = {}) {
     const result = [];
     {
       const permission = permissionService();
-      const levels = permission !== void 0 && permission.names.length > 0 ? permission.names.map((name3) => {
+      const levels = permission.names.length > 0 ? permission.names.map((name3) => {
         const spec = permission.resolve(name3);
         return { value: name3, name: spec.name, description: spec.description };
       }) : SANDBOX_MODES2.map((mode) => {
@@ -1145,14 +1402,14 @@ async function apply(ctx, config = {}) {
       });
     }
     const presets = presetsService();
-    if (presets !== void 0 && record.preset !== void 0) {
+    if (record.preset !== void 0) {
       try {
         const roster = await presets.list();
         if (roster.length >= 2) {
           result.push({
             type: "select",
-            id: "preset",
-            name: "Preset",
+            id: "agent",
+            name: "Agent",
             currentValue: record.preset,
             options: roster.map((preset) => ({
               value: preset.id,
@@ -1169,12 +1426,6 @@ async function apply(ctx, config = {}) {
   };
   const BUILTIN_COMMANDS = [
     { name: "status", description: "Show adapter, model, mode, and token status" },
-    {
-      name: "login",
-      description: "Save a DeepSeek API key into the harness credential store (~/.dsh/.credentials.yaml)",
-      input: { hint: "<api-key>" }
-    },
-    { name: "logout", description: "Remove the API key stored in the harness credential store" },
     {
       name: "model",
       description: "Select the model for this conversation",
@@ -1184,42 +1435,36 @@ async function apply(ctx, config = {}) {
   const availableCommandsFor = async (record) => {
     const list = [...BUILTIN_COMMANDS];
     const seen = new Set(list.map((command) => command.name));
-    const commandsSvc = ctx.get("commands");
-    if (commandsSvc !== void 0) {
-      try {
-        for (const descriptor of commandsSvc.list(record.agent)) {
-          if (seen.has(descriptor.name)) continue;
-          seen.add(descriptor.name);
-          list.push({
-            name: descriptor.name,
-            description: descriptor.description,
-            ...descriptor.input !== void 0 ? { input: { hint: descriptor.input.hint } } : {}
-          });
-        }
-      } catch (error) {
-        logWarn(`command listing failed: ${String(error)}`);
+    try {
+      for (const descriptor of commandRuntime.list(record.agent)) {
+        if (seen.has(descriptor.name)) continue;
+        seen.add(descriptor.name);
+        list.push({
+          name: descriptor.name,
+          description: descriptor.description,
+          ...descriptor.input !== void 0 ? { input: { hint: descriptor.input.hint } } : {}
+        });
       }
+    } catch (error) {
+      logWarn(`command listing failed: ${String(error)}`);
     }
-    const skillsSvc = ctx.get("skills");
-    if (skillsSvc !== void 0) {
-      try {
-        const skills = await skillsSvc.list({
-          ...record.agent.session.header.cwd !== void 0 ? { cwd: record.agent.session.header.cwd } : {},
-          scope: record.agent
+    try {
+      const skills = await skillRegistry.list({
+        ...record.agent.session.header.cwd !== void 0 ? { cwd: record.agent.session.header.cwd } : {},
+        scope: record.agent
+      });
+      for (const skill of skills) {
+        if (skill.invocation.userInvocable !== true) continue;
+        if (seen.has(skill.name)) continue;
+        seen.add(skill.name);
+        list.push({
+          name: skill.name,
+          description: skill.description,
+          input: { hint: "instructions for the skill" }
         });
-        for (const skill of skills) {
-          if (skill.invocation.userInvocable !== true) continue;
-          if (seen.has(skill.name)) continue;
-          seen.add(skill.name);
-          list.push({
-            name: skill.name,
-            description: skill.description,
-            input: { hint: "instructions for the skill" }
-          });
-        }
-      } catch (error) {
-        logDebug(`skill listing failed: ${String(error)}`);
       }
+    } catch (error) {
+      logDebug(`skill listing failed: ${String(error)}`);
     }
     return list;
   };
@@ -1246,7 +1491,7 @@ async function apply(ctx, config = {}) {
     const events = record.agent.session.events;
     if (events === void 0) return;
     const permission = permissionService();
-    const storedMode = permission?.current(events);
+    const storedMode = permission.current(events);
     for (let index = events.length - 1; index >= 0; index -= 1) {
       const event = events[index];
       if (event?.type === "approval/policy") {
@@ -1263,69 +1508,35 @@ async function apply(ctx, config = {}) {
       });
     }
   };
-  const credentialStore = () => {
-    const brand = harness.credentialRef;
-    const store = ctx.get("credentials");
-    if (brand === void 0 || store === void 0) return void 0;
-    return { store, ref: brand("DEEPSEEK_API_KEY") };
-  };
-  const maskKey = (value) => value.length <= 8 ? "\u2026" : `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
-  const describeCredential = async () => {
-    if (envCredentialPresent()) {
-      const viaEnv = process.env["DEEPSEEK_API_KEY"] !== void 0 ? "DEEPSEEK_API_KEY" : "DEEPSEEK_BASE_URL";
-      return `process environment (${viaEnv})`;
-    }
-    const cs = credentialStore();
-    if (cs === void 0) return "not configured";
-    try {
-      const info = await cs.store.describe(cs.ref);
-      if (!info.configured) return "not configured";
-      return info.source ?? "credential store";
-    } catch (error) {
-      logWarn(`credential describe failed: ${String(error)}`);
-      return "unknown";
+  const describeCredential = async (provider) => {
+    const names = credentialEnvNames(provider).filter((candidate) => !candidate.endsWith("_BASE_URL"));
+    for (const name3 of names) {
+      try {
+        const info = await credentials.describe(credentialRef(name3));
+        if (info.configured) return info.source ?? "credential store";
+      } catch (error) {
+        logWarn(`credential describe failed: ${String(error)}`);
+      }
     }
+    return "not configured";
   };
-  const loginText = async (rawArgument) => {
-    const key = rawArgument.trim();
-    const cs = credentialStore();
-    if (cs === void 0) {
-      return "This composition has no writable credential store; export DEEPSEEK_API_KEY in the environment that launches the agent instead.";
-    }
-    if (key.length === 0) {
-      return [
-        "Usage: `/login <api-key>` \u2014 stores the key in the harness credential store",
-        "(`~/.dsh/.credentials.yaml`, the same file the dsh Web UI writes; mode 600).",
-        "",
-        `Current credential source: ${await describeCredential()}.`,
-        "",
-        "Note: text entered here also lands in your client's chat history. If you",
-        "prefer to keep the key out of it, save the key in the dsh Web UI instead."
-      ].join("\n");
-    }
-    try {
-      await cs.store.set(cs.ref, key);
-    } catch (error) {
-      return [
-        `Could not store the key: ${error instanceof Error ? error.message : String(error)}`,
-        "",
-        "A read-only source (usually the process environment) is currently supplying",
-        "this credential, so a stored value would be shadowed. Unset DEEPSEEK_API_KEY",
-        "in the launching environment, or keep using it as the credential."
-      ].join("\n");
-    }
-    return `Saved DEEPSEEK_API_KEY (${maskKey(key)}) to the harness credential store \u2014 source now: ${await describeCredential()}. The dsh Web UI sees the same key.`;
+  const saveCredential = async (provider, key) => {
+    await credentials.set(credentialRef(primaryCredentialName(provider)), key);
   };
-  const logoutText = async () => {
-    const cs = credentialStore();
-    if (cs === void 0) return "This composition has no writable credential store; nothing to remove.";
-    try {
-      await cs.store.unset(cs.ref);
-    } catch (error) {
-      return `Could not remove the stored key: ${error instanceof Error ? error.message : String(error)}`;
+  const saveGateway = async (provider, key, baseUrl) => {
+    await saveCredential(provider, key);
+    await credentials.set(credentialRef(credentialBaseUrlName(provider)), baseUrl);
+  };
+  const logoutStored = async () => {
+    const routes = await listProviderRoutes();
+    const providers = routes.length > 0 ? routes.map((route) => route.id) : [config.provider];
+    for (const provider of providers) {
+      try {
+        await credentials.unset(credentialRef(primaryCredentialName(provider)));
+      } catch (error) {
+        logWarn(`credential unset failed: ${String(error)}`);
+      }
     }
-    const remaining = await describeCredential();
-    return remaining === "not configured" ? "Removed the stored DEEPSEEK_API_KEY. No credential is configured now." : `Removed the stored DEEPSEEK_API_KEY; requests now authenticate via: ${remaining}.`;
   };
   const modelCommandText = async (record, acpSessionId, query) => {
     const discovered = await discoverModels();
@@ -1382,7 +1593,7 @@ async function apply(ctx, config = {}) {
       `| Provider | ${route.provider ?? "(composition default)"} |`,
       `| Model | ${route.model ?? "(composition default)"} |`,
       `| Reasoning | ${effort ?? "(adapter default)"} |`,
-      `| Credential | ${await describeCredential()} |`,
+      `| Credential | ${await describeCredential(route.provider)} |`,
       ...record.preset !== void 0 ? [`| Preset | ${record.preset} |`] : [],
       `| Permission mode | ${record.modeId} |`,
       `| Approvals | ${record.approvals} |`,
@@ -1453,11 +1664,7 @@ async function apply(ctx, config = {}) {
     }).then(({ outcome }) => {
       if (outcome.outcome === "cancelled") return "cancelled";
       if (outcome.optionId === "allow-always") {
-        try {
-          ctx.get("approval")?.setPolicy?.(record.agent, "never");
-        } catch (error) {
-          logWarn(`approval policy switch failed: ${String(error)}`);
-        }
+        setApprovalPolicy(record, "never");
         return "allowed-once";
       }
       return outcome.optionId === "allow-once" ? "allowed-once" : "rejected";
@@ -1466,50 +1673,77 @@ async function apply(ctx, config = {}) {
   const makeAgent = (connection) => {
     conn = connection;
     return {
-      initialize(params) {
-        const hasPersistence = ctx.get("sessionPersistence") !== void 0;
+      async initialize(params) {
         const requested = params.protocolVersion;
         const capsMeta = params.clientCapabilities?.["_meta"];
         clientTerminalOutput = capsMeta !== null && typeof capsMeta === "object" ? capsMeta["terminal_output"] === true : false;
-        return Promise.resolve({
+        const providers = await listProviderRoutes();
+        return {
           protocolVersion: typeof requested === "number" && requested >= 1 && requested < PROTOCOL_VERSION ? requested : PROTOCOL_VERSION,
           agentInfo: { name: "dsh-acp", title: "DeepSeek Harness", version: VERSION },
           agentCapabilities: {
-            loadSession: hasPersistence,
+            loadSession: true,
             promptCapabilities: { image: false, audio: false, embeddedContext: true },
             // Stdio servers always work; streamable HTTP maps onto
             // mcp-client's second transport. Legacy SSE does not.
             mcpCapabilities: { http: true, sse: false },
-            ...hasPersistence ? { sessionCapabilities: { list: {} } } : {}
+            auth: { logout: {} },
+            sessionCapabilities: { list: {} }
           },
-          authMethods: [
-            // ACP Terminal Auth (see the registry's AUTHENTICATION.md):
-            // the client runs `dsh-acp login` in an interactive
-            // terminal; the key lands in the shared harness
-            // credential store (~/.dsh/.credentials.yaml).
-            {
-              id: "terminal-login",
-              name: "Log in with a DeepSeek API key",
-              description: "Interactive terminal setup \u2014 saves the key to the harness credential store shared with the dsh Web UI",
-              _meta: { "terminal-auth": { args: ["login"], env: {} } }
-            }
-          ]
-        });
+          authMethods: advertisedAuthMethods(
+            providers,
+            params.clientCapabilities
+          )
+        };
       },
-      async authenticate(_params) {
-        if (!await credentialPresent()) {
-          throw authRequired(
-            "no DeepSeek credential found: run `dsh-acp login`, save one in the dsh Web UI (Settings \u2192 Models), or set DEEPSEEK_API_KEY"
+      async authenticate(params) {
+        const gateway = gatewayFromAuthenticate(params);
+        if (isGatewayAuthMethod(params.methodId) || gateway.baseUrl) {
+          if (!gateway.baseUrl || !gateway.key) {
+            throw authRequired(
+              "authenticate gateway requires `_meta.gateway.baseUrl` and an Authorization header"
+            );
+          }
+          await saveGateway(
+            gateway.providerName ?? config.provider,
+            gateway.key,
+            gateway.baseUrl
           );
+          return;
+        }
+        const submitted = apiKeyFromAuthenticate(params);
+        const provider = submitted.provider ?? providerFromAuthMethodId(params.methodId) ?? config.provider;
+        if (submitted.key) {
+          await saveCredential(provider, submitted.key);
+          return;
+        }
+        if (await credentialPresent(provider)) return;
+        if (isBrowserAuthMethod(params.methodId) && shouldOfferLocalAuthPage()) {
+          const page = await startLocalAuthPage({
+            credentialName: primaryCredentialName(provider)
+          });
+          openLocalAuthPage(page.url);
+          try {
+            const key = await page.completed;
+            await saveCredential(provider, key);
+            return;
+          } finally {
+            page.close();
+          }
         }
+        await requireCredential(provider);
+      },
+      async logout(_params) {
+        await logoutStored();
       },
       async newSession(params) {
         assertOpen();
+        await requireCredential(config.provider);
         validateCwd(params.cwd);
         syncMcpServers(params.mcpServers, params.cwd);
         const sessionId = SessionId2(randomUUID());
         const presets = presetsService();
-        const presetId = presets === void 0 ? void 0 : (await presets.resolve(void 0)).id;
+        const presetId = (await presets.resolve(void 0)).id;
         const handle = await agents.create({
           sessionId,
           meta: { cwd: params.cwd, ...presetId !== void 0 ? { agentPreset: presetId } : {} },
@@ -1539,6 +1773,7 @@ async function apply(ctx, config = {}) {
       },
       async loadSession(params) {
         assertOpen();
+        await requireCredential(config.provider);
         validateCwd(params.cwd);
         syncMcpServers(params.mcpServers, params.cwd);
         requirePersistence();
@@ -1598,10 +1833,6 @@ async function apply(ctx, config = {}) {
           return { stopReason: "end_turn" };
         };
         if (commandMatch?.[1] === "status") return respond(await statusText(record));
-        if (commandMatch?.[1] === "login") {
-          return respond(await loginText(trimmed.slice(commandMatch[0].length)));
-        }
-        if (commandMatch?.[1] === "logout") return respond(await logoutText());
         if (commandMatch?.[1] === "model") {
           return respond(
             await modelCommandText(
@@ -1612,40 +1843,26 @@ async function apply(ctx, config = {}) {
           );
         }
         if (commandMatch !== null && commandMatch[1] !== void 0) {
-          const commandsSvc = ctx.get("commands");
-          if (commandsSvc !== void 0) {
-            let execution;
-            try {
-              execution = await commandsSvc.execute(
-                record.agent,
-                trimmed,
-                new AbortController().signal
-              );
-            } catch (error) {
-              return respond(`\u26A0 /${commandMatch[1]} failed: ${errorChain2(error)}`);
-            }
-            if (execution !== void 0) {
-              const { result } = execution;
-              const text = result.text ?? (result.kind === "success" ? `/${commandMatch[1]} \u2713` : `/${commandMatch[1]} failed`);
-              syncPermissionState(record, params.sessionId);
-              publishCommands(params.sessionId, record);
-              publishConfigOptions(params.sessionId, record);
-              return respond(result.kind === "error" ? `\u26A0 ${text}` : text);
-            }
+          let execution;
+          try {
+            execution = await commandRuntime.execute(
+              record.agent,
+              trimmed,
+              new AbortController().signal
+            );
+          } catch (error) {
+            return respond(`\u26A0 /${commandMatch[1]} failed: ${errorChain2(error)}`);
+          }
+          if (execution !== void 0) {
+            const { result } = execution;
+            const text = result.text ?? (result.kind === "success" ? `/${commandMatch[1]} \u2713` : `/${commandMatch[1]} failed`);
+            syncPermissionState(record, params.sessionId);
+            publishCommands(params.sessionId, record);
+            publishConfigOptions(params.sessionId, record);
+            return respond(result.kind === "error" ? `\u26A0 ${text}` : text);
           }
         }
-        if (!await credentialPresent()) {
-          return respond(
-            [
-              "No DeepSeek credential is configured, so this prompt was not sent to the model.",
-              "",
-              "Configure one of:",
-              "- `/login <api-key>` \u2014 store a key in the harness credential store right here,",
-              "- the dsh Web UI (`dsh web`, Settings \u2192 Models),",
-              "- `DEEPSEEK_API_KEY` in the environment that launches this agent."
-            ].join("\n")
-          );
-        }
+        await requireCredential(record.provider ?? config.provider);
         if (agents.get(record.agent.id) !== record.agent) {
           throw internalError("prompt was not queued: the agent was disposed outside the bridge");
         }
@@ -1697,6 +1914,7 @@ async function apply(ctx, config = {}) {
             applyMode(record, params.sessionId, value);
             break;
           }
+          case "agent":
           case "preset": {
             await switchPreset(record, params.sessionId, value);
             break;
@@ -1749,14 +1967,7 @@ async function apply(ctx, config = {}) {
     };
   };
   function requirePersistence() {
-    const persistence = getPersistence();
-    if (persistence === void 0) {
-      throw internalError("session persistence is not composed; session history is unavailable");
-    }
-    return persistence;
-  }
-  function getPersistence() {
-    return ctx.get("sessionPersistence");
+    return sessionPersistence;
   }
   function validateCwd(cwd) {
     if (!isAbsolute(cwd)) throw invalidParams(`cwd must be an absolute path: ${cwd}`);
@@ -1861,13 +2072,10 @@ async function apply(ctx, config = {}) {
       settlePrompt(record, "cancelled");
     }
     quiescing = (async () => {
-      const subagents = ctx.get("subagents");
-      if (subagents !== void 0) {
-        try {
-          await subagents.drainContinuableDescendants(records.map((record) => record.agent));
-        } catch (error) {
-          logWarn(`continuable subagent teardown failed: ${String(error)}`);
-        }
+      try {
+        await subagents.drainContinuableDescendants(records.map((record) => record.agent));
+      } catch (error) {
+        logWarn(`continuable subagent teardown failed: ${String(error)}`);
       }
       const disposals = await Promise.allSettled(records.map((record) => record.dispose()));
       const failures = disposals.filter(