@toddzheng024/dscode-bundle 0.3.0 → 0.5.0

package/vendor/terminal/types/config.d.ts

@@ -0,0 +1,71 @@
+/** Validated configuration for the local PTY backend. */
+import z from '@deepseek-ai/schemastery';
+/** One supported interactive shell dialect. */
+export type ShellDialect = 'bash' | 'pwsh';
+/** Public plugin configuration. */
+export interface Config {
+    /** Backend registry type (default: `shell`). */
+    backendType?: string;
+    /** Interactive shell dialect (default: `bash`); selects the argv/env/startup defaults. */
+    shellDialect?: ShellDialect;
+    /** Interactive shell executable (default per dialect: `/bin/bash`, or the resolved pwsh). */
+    shellPath?: string;
+    /** Shell arguments (default per dialect: bash `--noprofile --norc -i`, pwsh `-NoLogo -NoProfile`). */
+    shellArgs?: string[];
+    /** Terminal rows. */
+    rows?: number;
+    /** Terminal columns. */
+    cols?: number;
+    /** Maximum retained logical lines. */
+    scrollbackLines?: number;
+    /** Maximum retained UTF-8 bytes. */
+    scrollbackMaxBytes?: number;
+    /** Maximum bytes returned by one read or settled viewport. */
+    maxReadBytes?: number;
+    /** Readiness polling interval. */
+    pollIntervalMs?: number;
+    /** Delay before Linux exact syscall probes. */
+    exactProbeAfterMs?: number;
+    /** Silence duration that yields `inferred_idle`. */
+    idleSilenceMs?: number;
+    /**
+     * Extra wait beyond `idleSilenceMs`, once a prompt marker was seen, for the shell to
+     * regain the foreground before `inferred_idle` settles; at least one `pollIntervalMs`.
+     */
+    handoffGraceMs?: number;
+    /** Absolute bound for one send and the complete pwsh startup sequence. */
+    timeoutMs?: number;
+    /** Grace before teardown escalates to `SIGKILL`. */
+    disposeGraceMs?: number;
+}
+/** Configuration after Schemastery defaults and dialect resolution. */
+export type ResolvedConfig = Omit<Required<Config>, 'shellDialect' | 'shellPath' | 'shellArgs'> & {
+    shellDialect: ShellDialect;
+    shellPath: string;
+    shellArgs: string[];
+};
+/** Bash dialect default executable. */
+export declare const DEFAULT_BASH_SHELL = "/bin/bash";
+/** Bash dialect default arguments (interactive, profile-free). */
+export declare const DEFAULT_BASH_ARGS: string[];
+/** Pwsh dialect default arguments (interactive host, profile-free). */
+export declare const DEFAULT_PWSH_ARGS: string[];
+/**
+ * Resolve the effective per-dialect shell specification. Defaulting is this
+ * explicit step: an unset or empty `shellPath`/`shellArgs` selects the
+ * dialect's defaults, while a non-empty explicit value always wins.
+ * (Schemastery materializes an absent optional array as `[]`, so emptiness —
+ * not just `undefined` — means "dialect default".)
+ * @param config - Schemastery-resolved plugin configuration.
+ * @returns the fully resolved configuration.
+ */
+export declare function resolveConfig(config: Config): ResolvedConfig;
+/** Schemastery config exposed by the plugin. */
+export declare const Config: z<Config>;
+/**
+ * Assert every effective numeric config field is a positive safe integer and bounds compose.
+ * @param config - Schemastery-resolved plugin configuration.
+ * @returns Narrows the input to the fully resolved configuration.
+ */
+export declare function validateConfig(config: Config): asserts config is ResolvedConfig;
+//# sourceMappingURL=config.d.ts.map

package/vendor/terminal/types/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Persistent shell PTY backend over the subprocess terminal primitive, shared
+ * sandbox policy, bounded output, and provider-owned session cleanup.
+ * @module @deepseek-ai/dsh-terminal-bash
+ */
+import { Context } from '@deepseek-ai/cordis';
+import type { TerminalBackend, TerminalBackendSpawnSpec } from '@deepseek-ai/dsh-terminal';
+import type { SubprocessTerminalHandle, SubprocessTerminalSpawnSpec } from '@deepseek-ai/dsh-subprocess';
+import { type Config, type ResolvedConfig } from './config.ts';
+import { LocalPtySession } from './session.ts';
+export { Config } from './config.ts';
+export type { Config as TerminalLocalConfig } from './config.ts';
+/** Cordis plugin name. */
+export declare const name = "terminal-bash";
+/** Required services: terminal registry, shared confinement policy, projection registry, and process substrate. */
+export declare const inject: string[];
+/**
+ * The pwsh prompt function that emits the shared OSC `133;D;` + BEL marker
+ * before every prompt, mirroring bash's PROMPT_COMMAND. `[char]27`/`[char]7`
+ * build the control bytes at runtime because raw ESC characters in submitted
+ * input are unreliable under PSReadLine.
+ */
+export declare const PWSH_PROMPT_SETUP: string;
+/** Local shell backend registered under the configured type. */
+export declare class BashTerminalBackend implements TerminalBackend {
+    private readonly ctx;
+    private readonly config;
+    private readonly spawnTerminal;
+    private readonly createSession;
+    readonly type: string;
+    constructor(ctx: Context, config: ResolvedConfig, spawnTerminal?: (spec: SubprocessTerminalSpawnSpec) => Promise<SubprocessTerminalHandle>, createSession?: (terminal: SubprocessTerminalHandle, config: ResolvedConfig) => LocalPtySession);
+    spawn(spec: TerminalBackendSpawnSpec): Promise<LocalPtySession>;
+}
+/** Register the local PTY backend. */
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/vendor/terminal/types/sanitize.d.ts

@@ -0,0 +1,47 @@
+/** Streaming terminal-control sanitizer for the line-oriented first release. */
+/** OSC marker emitted by the controlled bash before each prompt. */
+export declare const PROMPT_MARKER_PREFIX = "133;D;";
+/** Exact printable prompt emitted after the private marker. */
+export declare const CONTROLLED_PROMPT = "dsh> ";
+/** One sanitized chunk plus whether it contained the owned prompt marker. */
+export interface SanitizedChunk {
+    text: string;
+    prompt: boolean;
+    /** Printable text after the latest owned marker in this chunk. */
+    promptTail?: string;
+}
+/**
+ * Remove CSI/OSC/short escape sequences while preserving split-sequence carry.
+ * Full terminal emulation is deliberately deferred; ordinary line output and
+ * the private prompt marker are the supported contract.
+ */
+export declare class TerminalSanitizer {
+    private readonly maxPendingBytes;
+    private pending;
+    private discardMode;
+    private discardOscEscape;
+    private trailingCarriageReturn;
+    private trackingPromptTail;
+    constructor(maxPendingBytes: number);
+    /**
+     * Consume one decoded `node-pty` data chunk.
+     * @param chunk - decoded terminal data.
+     * @returns Printable text and whether the private prompt marker completed.
+     */
+    push(chunk: string): SanitizedChunk;
+    /**
+     * Flush a trailing printable fragment when the PTY exits.
+     * @returns Remaining printable text; incomplete escapes are discarded.
+     */
+    flush(): string;
+    private normalizeText;
+    private enforcePendingBound;
+    private discardPrefix;
+}
+/**
+ * Normalize CRLF and standalone carriage returns for line-oriented rendering.
+ * @param text - sanitized terminal text.
+ * @returns Line-normalized text with BEL removed.
+ */
+export declare function normalizeTerminalText(text: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/vendor/terminal/types/session.d.ts

@@ -0,0 +1,87 @@
+/** Persistent PTY session with bounded output, readiness, and terminal-protocol replies. */
+import type { SubprocessTerminalHandle } from '@deepseek-ai/dsh-subprocess';
+import type { TerminalBackendSession, TerminalReadRequest, TerminalReadResult, TerminalSendOperation, TerminalSendRequest, TerminalSessionStatus, TerminalSignal, TerminalSignalResult } from '@deepseek-ai/dsh-terminal';
+import type { ResolvedConfig } from './config.ts';
+/** Backend session wrapping one provider-owned terminal process. */
+export declare class LocalPtySession implements TerminalBackendSession {
+    private readonly terminal;
+    private readonly config;
+    motd: string;
+    readonly pid: number;
+    private readonly decoder;
+    /** Protocol state only; the sanitizer and bounded buffers own returned text. */
+    private readonly emulator;
+    private readonly emulatorData;
+    private readonly sanitizer;
+    private readonly scrollback;
+    private readonly outputEnded;
+    private readonly completion;
+    private statusValue;
+    private active;
+    private activeTimer;
+    private activeDeadlineTimer;
+    private activeAbort;
+    private interrupting;
+    private activeWrite;
+    private pollingReady;
+    private polling;
+    private promptSeen;
+    private promptTextSeen;
+    private promptTail;
+    private shellPgid;
+    private initializing;
+    private lastOutputAt;
+    private closing;
+    private closePromise;
+    private transportFailure;
+    private emulatorWrites;
+    private emulatorWriteDone;
+    private emulatorBuffer;
+    private emulatorWriting;
+    private responseWrites;
+    private pendingResponseWrites;
+    private emulatorClosed;
+    constructor(terminal: SubprocessTerminalHandle, config: ResolvedConfig);
+    /**
+     * Capture startup output through the same readiness contract as later sends.
+     * @param signal - optional cancellation while the shell reaches its first prompt.
+     * @returns Resolves after startup readiness; rejects on exit or readiness timeout.
+     */
+    initialize(signal?: AbortSignal): Promise<void>;
+    startSend(request: TerminalSendRequest): TerminalSendOperation;
+    private beginSend;
+    private resetReadinessEvidence;
+    read(request: TerminalReadRequest): TerminalReadResult;
+    signal(signal: TerminalSignal): Promise<TerminalSignalResult>;
+    status(): TerminalSessionStatus;
+    close(reason: string): Promise<void>;
+    private readonly onTerminalData;
+    private readonly onTerminalEnd;
+    private readonly onTerminalError;
+    private onData;
+    private onExit;
+    private onTransportFailure;
+    private appendOutput;
+    private schedulePoll;
+    private pollReadiness;
+    /** Wait until generated replies reach the provider before another send can publish. */
+    private drainTerminalProtocol;
+    /** Sample foreground state only after protocol replies are quiet for the entire inspection. */
+    private inspectForegroundAfterProtocol;
+    private protocolStateChanged;
+    private protocolWorkPending;
+    private queueEmulatorData;
+    private pumpEmulator;
+    private finishResponseWrite;
+    private releaseSettledActive;
+    private closeEmulator;
+    private settleActive;
+    private stopPolling;
+    private stopReadinessPolling;
+    private clearActive;
+    private failActive;
+    private interrupt;
+    private interruptOnce;
+    private closeOnce;
+}
+//# sourceMappingURL=session.d.ts.map

package/vendor/tui/dscode-clipboard-image/clipboard-image.swift

@@ -0,0 +1,56 @@
+import AppKit
+import Darwin
+import Foundation
+
+func fail(_ message: String, _ status: Int32) -> Never {
+    FileHandle.standardError.write(Data((message + "\n").utf8))
+    exit(status)
+}
+
+func pngData(from pasteboard: NSPasteboard) -> Data? {
+    if let direct = pasteboard.data(forType: .png) { return direct }
+    if let image = NSImage(pasteboard: pasteboard),
+       let tiff = image.tiffRepresentation,
+       let bitmap = NSBitmapImageRep(data: tiff) {
+        return bitmap.representation(using: .png, properties: [:])
+    }
+    return nil
+}
+
+if CommandLine.arguments.count == 2 && CommandLine.arguments[1] == "--self-test" {
+    guard let bitmap = NSBitmapImageRep(bitmapDataPlanes: nil, pixelsWide: 1, pixelsHigh: 1,
+                                       bitsPerSample: 8, samplesPerPixel: 4, hasAlpha: true,
+                                       isPlanar: false, colorSpaceName: .deviceRGB, bytesPerRow: 0,
+                                       bitsPerPixel: 0) else {
+        fail("could not create test image", 3)
+    }
+    bitmap.setColor(.red, atX: 0, y: 0)
+    guard let source = bitmap.representation(using: .png, properties: [:]) else {
+        fail("could not encode test image", 3)
+    }
+    let board = NSPasteboard(name: NSPasteboard.Name("dscode-image-self-test-\(UUID().uuidString)"))
+    board.clearContents()
+    guard board.setData(source, forType: .png), pngData(from: board) == source else {
+        fail("pasteboard image round trip failed", 3)
+    }
+    guard let tiff = bitmap.representation(using: .tiff, properties: [:]) else {
+        fail("could not create test TIFF", 3)
+    }
+    board.clearContents()
+    guard board.setData(tiff, forType: .tiff),
+          let converted = pngData(from: board),
+          converted.starts(with: [137, 80, 78, 71, 13, 10, 26, 10]) else {
+        fail("pasteboard TIFF conversion failed", 3)
+    }
+    exit(0)
+}
+
+guard CommandLine.arguments.count == 2 else { fail("missing output path", 3) }
+guard let data = pngData(from: NSPasteboard.general) else { fail("clipboard has no image", 2) }
+guard data.count <= 32 * 1024 * 1024 else { fail("clipboard image is too large", 4) }
+
+do {
+    try data.write(to: URL(fileURLWithPath: CommandLine.arguments[1]), options: .atomic)
+} catch {
+    fail("could not save clipboard image", 3)
+}

package/vendor/tui/dscode-clipboard-image/index.mjs

@@ -0,0 +1,70 @@
+import { execFile as execFileCallback } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { access, chmod, mkdir, mkdtemp, readFile, rename, rm } from 'node:fs/promises';
+import { rmSync } from 'node:fs';
+import { constants } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+const execFile = promisify(execFileCallback);
+const source = fileURLToPath(new URL('./clipboard-image.swift', import.meta.url));
+const cache = join(tmpdir(), `dscode-clipboard-helper-${process.getuid?.() ?? 'user'}`);
+const clipboardDirs = new Set();
+let compiler;
+let cleanupRegistered = false;
+
+async function helperBinary() {
+  if (process.platform !== 'darwin') throw Error('Clipboard image paste requires macOS');
+  if (compiler) return compiler;
+  compiler = (async () => {
+    const hash = createHash('sha256').update(await readFile(source)).update(process.arch).digest('hex').slice(0, 16);
+    const binary = join(cache, `clipboard-image-${hash}`);
+    try { await access(binary, constants.X_OK); return binary; } catch {}
+    await mkdir(cache, { recursive: true, mode: 0o700 });
+    const moduleCache = join(cache, 'swift-modules');
+    await mkdir(moduleCache, { recursive: true, mode: 0o700 });
+    const temporary = `${binary}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      await execFile('swiftc', [source, '-o', temporary], {
+        timeout: 120_000,
+        maxBuffer: 64 * 1024,
+        env: { ...process.env, CLANG_MODULE_CACHE_PATH: moduleCache, SWIFT_MODULE_CACHE_PATH: moduleCache },
+      });
+      await chmod(temporary, 0o700);
+      await rename(temporary, binary);
+    } catch {
+      await rm(temporary, { force: true });
+      throw Error('Clipboard image helper unavailable; install Xcode Command Line Tools');
+    }
+    return binary;
+  })();
+  try { return await compiler; } catch (error) { compiler = undefined; throw error; }
+}
+
+export async function readClipboardImage() {
+  const binary = await helperBinary();
+  const directory = await mkdtemp(join(tmpdir(), 'dscode-clipboard-image-'));
+  const path = join(directory, 'image.png');
+  try {
+    await execFile(binary, [path], { timeout: 10_000, maxBuffer: 1024 });
+  } catch (error) {
+    await rm(directory, { recursive: true, force: true });
+    if (error?.code === 2) throw Error('Clipboard has no image');
+    if (error?.code === 4) throw Error('Clipboard image is too large');
+    throw Error('Could not read clipboard image');
+  }
+  clipboardDirs.add(directory);
+  if (!cleanupRegistered) {
+    cleanupRegistered = true;
+    process.once('exit', () => { for (const dir of clipboardDirs) rmSync(dir, { recursive: true, force: true }); });
+  }
+  return path;
+}
+
+/** Exercise the compiled helper against a private named pasteboard. */
+export async function verifyClipboardImageHelper() {
+  const binary = await helperBinary();
+  await execFile(binary, ['--self-test'], { timeout: 10_000, maxBuffer: 1024 });
+}

package/vendor/tui/dscode-email/cli.mjs

@@ -0,0 +1,32 @@
+import { createEmailContacts } from './contacts.mjs';
+import { createGmailConnector } from './gmail.mjs';
+import { createImapConnector } from './imap.mjs';
+
+export async function runEmailClient(args, { connector = createGmailConnector(), imap = createImapConnector(), contacts = createEmailContacts(), output = console.log } = {}) {
+  const [command = 'status', ...rest] = args;
+  if (command === 'alias') {
+    const [action = 'list', name, address] = rest;
+    let result;
+    if (action === 'list' && rest.length <= 1) result = contacts.list();
+    else if (action === 'set' && rest.length === 3) result = await contacts.set(name, address);
+    else if (action === 'remove' && rest.length === 2) result = await contacts.remove(name);
+    else throw Error('Usage: dscode email alias list | set NAME ADDRESS | remove NAME');
+    if (result.busy === true) throw Error('Contacts are busy in another session. Retry shortly.');
+    output(JSON.stringify(result, null, 2)); return;
+  }
+  if (!['configure', 'connect', 'sync', 'status', 'imap-status', 'imap-sync'].includes(command) || (command === 'configure' ? rest.length !== 1 : rest.length !== 0)) throw Error('Usage: dscode email configure CLIENT_JSON | connect | sync | status | imap-status | imap-sync (IMAP setup: /email then i)');
+  if (command.startsWith('imap-')) connector = imap;
+  if (command === 'imap-status') { output(JSON.stringify(connector.status(), null, 2)); return; }
+  if (command === 'status') { output(JSON.stringify(connector.status(), null, 2)); return; }
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  process.once('SIGINT', abort); process.once('SIGTERM', abort);
+  try {
+    if (command === 'connect') output('Complete Gmail authorization in your browser. Ctrl+C cancels.');
+    const result = command === 'configure' ? await connector.configure(rest[0])
+      : command === 'connect' ? await connector.connect({ signal: controller.signal })
+      : await connector.sync({ signal: controller.signal, force: true });
+    if (result.busy) throw Error('Gmail is busy in another session. Retry shortly.');
+    output(command === 'configure' ? 'Google Desktop OAuth client saved privately. Open /email and press g to connect.' : JSON.stringify(result, null, 2));
+  } finally { process.off('SIGINT', abort); process.off('SIGTERM', abort); }
+}

package/vendor/tui/dscode-email/contacts.mjs

@@ -0,0 +1,36 @@
+import { join } from 'node:path';
+import { createEmailInbox } from './inbox.mjs';
+import { emailStore } from './store.mjs';
+
+export const emailAddress = value => typeof value === 'string' && value.length <= 254 && /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?\.[A-Za-z]{2,}$/.test(value);
+const aliasKey = value => {
+  if (typeof value !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(value)) throw Error('Alias must be 1..64 letters, digits, underscores or hyphens.');
+  return value.toLowerCase();
+};
+export function createEmailContacts({ directory = createEmailInbox().directory } = {}) {
+  const store = emailStore(join(directory, 'contacts'));
+  const list = () => store.read('aliases.json') ?? {};
+  return {
+    list,
+    resolve(value) {
+      if (emailAddress(value)) return { to: value };
+      const alias = aliasKey(value), entries = list();
+      const to = Object.hasOwn(entries, alias) ? entries[alias] : null;
+      if (!emailAddress(to)) throw Error('Unknown email alias: ' + alias + '. Add it with dscode email alias set NAME ADDRESS.');
+      return { alias, to };
+    },
+    async set(name, address) {
+      const alias = aliasKey(name);
+      if (!emailAddress(address)) throw Error('Specify one plain email address.');
+      return store.locked(async () => {
+        const entries = list();
+        Object.defineProperty(entries, alias, { value: address, enumerable: true, configurable: true, writable: true });
+        store.write('aliases.json', entries); return { alias, to: address };
+      });
+    },
+    async remove(name) {
+      const alias = aliasKey(name);
+      return store.locked(async () => { const entries = list(); delete entries[alias]; store.write('aliases.json', entries); return { removed: alias }; });
+    },
+  };
+}

package/vendor/tui/dscode-email/gmail-oauth.mjs

@@ -0,0 +1,69 @@
+import { createServer } from 'node:http';
+import { randomBytes, createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+
+export const GMAIL_SCOPES = ['gmail.readonly', 'gmail.labels', 'gmail.settings.basic'].map(scope => 'https://www.googleapis.com/auth/' + scope);
+export function readGoogleClient(path) {
+  let value;
+  try { value = JSON.parse(readFileSync(path, 'utf8')).installed; } catch { /* Report no content or secrets. */ }
+  if (!value || typeof value.client_id !== 'string' || !value.client_id.endsWith('.apps.googleusercontent.com')) throw Error('Set DSCODE_GMAIL_CLIENT_FILE to a Google Desktop OAuth client JSON file.');
+  return { client_id: value.client_id, ...(typeof value.client_secret === 'string' ? { client_secret: value.client_secret } : {}) };
+}
+
+export async function tokenRequest(params, { fetchImpl = fetch, signal } = {}) {
+  const response = await fetchImpl('https://oauth2.googleapis.com/token', {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(params).toString(), redirect: 'error',
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(20000)]) : AbortSignal.timeout(20000),
+  });
+  if (!response.ok) throw Error(response.status === 400 ? 'Google authorization expired or was rejected. Reconnect Gmail.' : 'Google token request failed. Retry later.');
+  const token = await response.json();
+  if (typeof token.access_token !== 'string' || !token.access_token || !Number.isFinite(token.expires_in) || token.expires_in <= 0) throw Error('Google returned an invalid access token.');
+  if (token.scope && !GMAIL_SCOPES.every(scope => token.scope.split(' ').includes(scope))) throw Error('Grant all three Gmail permissions, then reconnect.');
+  return { access_token: token.access_token, expiresAt: Date.now() + token.expires_in * 1000,
+    ...(typeof token.refresh_token === 'string' ? { refresh_token: token.refresh_token } : {}) };
+}
+
+export const openGoogleBrowser = url => new Promise((resolve, reject) => {
+  execFile(process.platform === 'darwin' ? 'open' : 'xdg-open', [url], { timeout: 10000 }, error => error ? reject(Error('Could not open the browser for Google login.')) : resolve());
+});
+
+export async function authorizeGoogle(client, { fetchImpl = fetch, openBrowser = openGoogleBrowser, signal, timeoutMs = 180000 } = {}) {
+  const verifier = randomBytes(32).toString('base64url'), state = randomBytes(32).toString('base64url');
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  signal?.addEventListener('abort', abort, { once: true });
+  const timer = setTimeout(abort, timeoutMs);
+  let resolveCode, rejectCode;
+  const codeResult = new Promise((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
+  codeResult.catch(() => {});
+  const server = createServer((req, res) => {
+    const url = new URL(req.url, 'http://127.0.0.1');
+    res.setHeader('Cache-Control', 'no-store'); res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    if (req.method !== 'GET' || url.pathname !== '/oauth/callback' || url.searchParams.get('state') !== state) { res.writeHead(400).end('Invalid callback.'); return; }
+    if (url.searchParams.has('error')) { res.end('Google authorization was declined. Return to DSCODE.'); rejectCode(Error('Google authorization was declined.')); return; }
+    const code = url.searchParams.get('code');
+    if (!code) { res.writeHead(400).end('Missing code.'); return; }
+    res.end('Authorization received. Return to DSCODE to see connection status.');
+    resolveCode(code);
+  });
+  controller.signal.addEventListener('abort', () => rejectCode(Error('Google login cancelled or timed out.')), { once: true });
+  try {
+    if (signal?.aborted) throw Error('Google login cancelled.');
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+    const redirect = 'http://127.0.0.1:' + server.address().port + '/oauth/callback';
+    const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
+    url.search = new URLSearchParams({ client_id: client.client_id, redirect_uri: redirect,
+      response_type: 'code', scope: GMAIL_SCOPES.join(' '), access_type: 'offline', prompt: 'consent select_account',
+      state, code_challenge: createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' }).toString();
+    await openBrowser(url.href);
+    const code = await codeResult;
+    const token = await tokenRequest({ ...client, code, redirect_uri: redirect, code_verifier: verifier, grant_type: 'authorization_code' }, { fetchImpl, signal: controller.signal });
+    if (!token.refresh_token) throw Error('Google did not grant offline access. Reconnect Gmail.');
+    return token;
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', abort);
+    server.close(); server.closeAllConnections();
+  }
+}

package/vendor/tui/dscode-email/gmail-store.mjs

@@ -0,0 +1,2 @@
+import { emailStore } from './store.mjs';
+export const gmailStore = directory => emailStore(directory, 'Gmail');