@toddzheng024/dscode-bundle 0.7.28 → 0.7.29

package/cordis.patch.yml

@@ -621,7 +621,11 @@
   disabled: true
 - id: tool-subagent-fork
   disabled: true
-- id: workflow-worker-thread
+# The workflow engine is preset-owned: DSCODE's delegation group mounts it inside an
+# entry-local `workflowEngine` realm, so the host row stays off. DSH 0.1.7 renamed this
+# row from `workflow-worker-thread`, and a patch addresses rows by id — an id that no
+# longer exists silently patches nothing, which is how the host engine came back.
+- id: workflow-ptc
   disabled: true
 - id: tool-workflow
   disabled: true
@@ -638,10 +642,18 @@
 # preset became a single-tool composition), so this patch no longer lists it.
 
 - insert:
-    # Code Mode is a core execution capability, not a Web component. DSH 0.1.7
-    # renamed the worker-thread runtime to the Node PTC runtime.
-    - id: ptc-runtime
-      name: '@deepseek-ai/dsh-ptc-runtime-node'
+    # The account login's browser callback: `deepseekAccount` registers /oauth/callback on
+    # `ctx.webServer` for the lifetime of one attempt, so the terminal needs an HTTP
+    # transport of its own. Loopback only and an OS-assigned port, and no route exists
+    # until a login runs — the provider's route is the only one this profile registers,
+    # because the Web shell's frontend and API rows stay in the web-app bundle.
+    # `DSCODE_ACCOUNT_LOGIN=0` removes the listener, and `/account` then says why.
+    - id: webserver
+      name: '@deepseek-ai/dsh-host-webserver'
+      disabled: !!js process.env.DSCODE_ACCOUNT_LOGIN === '0'
+      config:
+        host: 127.0.0.1
+        port: 0
 
     # Cross-session @mentions: bounded read-only snapshots of other sessions
     # as sourced model context. Opt-in upstream; the TUI's completion menu
@@ -897,6 +909,8 @@
           keyboardPolicy: activate
           pointerInputPolicy: targeted
           cursorVisualization: visible
+    - id: dscode-account
+      name: "@toddzheng024/dscode-bundle/account"
     - id: dscode-hooks
       name: "@deepseek-ai/dsh-hooks-codex"
       inject:

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.28",
+  "version": "0.7.29",
   "type": "module",
   "license": "MIT",
   "author": "Todd Zheng",
@@ -60,6 +60,7 @@
     "./tui-tools": "./plugins/tui-tools/index.mjs",
     "./triggers": "./plugins/triggers/index.mjs",
     "./computer-use": "./plugins/computer-use/index.mjs",
+    "./account": "./plugins/account/index.mjs",
     "./command-goal": "./vendor/command-goal/index.js"
   },
   "dependencies": {

package/plugins/account/index.mjs

@@ -0,0 +1,178 @@
+/**
+ * `/account`: the DeepSeek account login, from the terminal.
+ *
+ * DSH 0.1.7 added an account plane beside API keys: `deepseekAccount` signs in through the
+ * system browser with PKCE, keeps the grant in the local credential store, and the DeepSeek
+ * route resolves it for the configured inference origin — so a signed-in user needs no
+ * `DEEPSEEK_API_KEY` at all. Upstream drives that plane from its Web settings page; this
+ * command is DSCODE's terminal equivalent.
+ *
+ * The provider registers `/oauth/callback` on the Host webserver for the lifetime of one
+ * attempt, which is why the TUI profile composes a loopback webserver (see
+ * `packages/tui/cordis.patch.yml`). Without it the command says so instead of starting an
+ * attempt the browser could never complete.
+ *
+ * Tokens never pass through here: the service's view is the client-safe projection, and
+ * `resolveToken` stays Host-only inside the LLM route.
+ *
+ * @module dscode-account
+ */
+
+import { execFile } from 'node:child_process';
+import { readLanguage, t } from '../i18n/messages.mjs';
+import { ACTIVE_PHASES, TERMINAL_PHASES, callbackOrigin, outcomeLines, signInBlocked, statusLines } from './state.mjs';
+
+export const name = 'dscode-account';
+export const inject = ['commands'];
+
+/** Upper bound for one terminal-driven attempt; the provider applies its own deadline too. */
+const ATTEMPT_WAIT_MS = 300000;
+
+const ok = text => ({ kind: 'success', text });
+const fail = text => ({ kind: 'error', text });
+
+/** Open a URL in the user's browser, reporting failure instead of throwing. */
+export function openBrowser(url, { platform = process.platform, run = execFile } = {}) {
+  return new Promise(resolve => {
+    if (platform === 'win32') { resolve(false); return; }
+    run(platform === 'darwin' ? 'open' : 'xdg-open', [url], { timeout: 10000 }, error => resolve(!error));
+  });
+}
+
+/**
+ * Follow one attempt until `done(view)` accepts it, the attempt is replaced, or the wait
+ * runs out.
+ *
+ * `watch()` yields the current state first and then on every change, so an already
+ * settled attempt returns immediately and a cancelled one does not hang. Both the
+ * caller's signal and the bounded wait end the iteration.
+ *
+ * @param account - the account service.
+ * @param id - the attempt this wait belongs to; a different attempt ends the wait.
+ * @param done - predicate over each view; true stops the wait.
+ * @param signal - the command's cancellation.
+ * @returns the last view seen.
+ */
+export async function followAttempt(account, id, done, signal, { timeoutMs = ATTEMPT_WAIT_MS } = {}) {
+  const deadline = AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]);
+  let last = await account.getState();
+  if (done(last)) return last;
+  try {
+    for await (const view of account.watch(deadline)) {
+      last = view;
+      const attempt = view.attempt;
+      if (attempt === null || attempt.id !== id) break;
+      if (done(view)) break;
+    }
+  } catch { /* an aborted watch leaves the last view in place */ }
+  return last;
+}
+
+/** A view whose attempt carries the browser URL, or has already settled without one. */
+export function authorizeReady(view, id) {
+  const attempt = view.attempt;
+  if (attempt === null || attempt.id !== id) return true;
+  return attempt.authorizeUrl !== undefined || TERMINAL_PHASES.includes(attempt.phase);
+}
+
+/** A view whose attempt will not change again. */
+export function settled(view, id) {
+  const attempt = view.attempt;
+  if (attempt === null || attempt.id !== id) return true;
+  return TERMINAL_PHASES.includes(attempt.phase);
+}
+
+/**
+ * Run one browser sign-in to settlement.
+ *
+ * Kept apart from the command so the whole flow — waiting for the URL, opening the
+ * browser, following the attempt, reading the result — is drivable with a fake service
+ * and a fake opener.
+ *
+ * @param service - the account service.
+ * @param origin - the loopback callback origin.
+ * @param locale - DSCODE interface language.
+ * @param signal - the command's cancellation.
+ * @param open - browser opener returning whether it launched.
+ * @returns the lines to print and whether the sign-in succeeded.
+ */
+export async function runSignIn({ service, origin, locale, signal, open = openBrowser }) {
+  // An attempt already in flight is returned unchanged rather than replaced, so this also
+  // covers "resume the sign-in you started a moment ago".
+  const started = await service.startSignIn(locale, origin, 'desktop');
+  const attempt = started.attempt;
+  if (attempt === null || attempt === undefined) return { ok: false, lines: [t(locale, 'account.startFailed')] };
+  const lines = [t(locale, 'account.starting')];
+  // The browser URL is not part of `startSignIn`'s answer: the provider returns as soon as
+  // the attempt exists and publishes the URL once `auth_init` replies, so it is awaited
+  // before anything is opened.
+  const ready = await followAttempt(service, attempt.id, view => authorizeReady(view, attempt.id), signal);
+  const url = ready.attempt?.id === attempt.id ? ready.attempt.authorizeUrl : undefined;
+  if (url !== undefined) {
+    lines.push(await open(url) ? t(locale, 'account.browserOpened') : t(locale, 'account.browserManual'));
+    lines.push(url);
+  }
+  const final = settled(ready, attempt.id) ? ready : await followAttempt(service, attempt.id, view => settled(view, attempt.id), signal);
+  const details = final.status === 'credential-stored' ? await readDetails(service) : undefined;
+  return {
+    ok: final.attempt?.phase === 'succeeded' || final.status === 'credential-stored',
+    lines: [...lines, '', ...outcomeLines(final, details, locale)],
+  };
+}
+
+export function apply(ctx) {
+  const language = () => readLanguage();
+  const account = () => ctx.get('deepseekAccount');
+
+  ctx.commands.register({
+    name: 'account',
+    description: 'Sign in to a DeepSeek account through the browser, or read its status (/account [login|cancel|logout])',
+    input: { hint: '[login|cancel|logout]' },
+    handler: async ({ rawInput, signal }) => {
+      const locale = language();
+      const service = account();
+      const argument = String(rawInput ?? '').trim().toLowerCase();
+      if (service === undefined) return fail(t(locale, 'account.unavailable'));
+
+      if (argument === '' || argument === 'status') {
+        const view = await service.getState();
+        const details = view.status === 'credential-stored' ? await readDetails(service) : undefined;
+        return ok(statusLines(view, details, locale).join('\n'));
+      }
+
+      if (argument === 'logout' || argument === 'sign-out' || argument === 'signout') {
+        const view = await service.signOut();
+        return ok(statusLines(view, undefined, locale).join('\n'));
+      }
+
+      if (argument === 'cancel') {
+        const current = await service.getState();
+        const attempt = current.attempt;
+        if (attempt === null || !ACTIVE_PHASES.includes(attempt.phase)) return ok(t(locale, 'account.nothingToCancel'));
+        const view = await service.cancelSignIn(attempt.id);
+        return ok(outcomeLines(view, undefined, locale).join('\n'));
+      }
+
+      if (argument !== 'login' && argument !== 'signin' && argument !== 'sign-in') {
+        return fail(t(locale, 'account.usage'));
+      }
+
+      const origin = callbackOrigin(ctx.get('webServer'));
+      const blocked = signInBlocked(service, origin, locale);
+      if (blocked !== undefined) return fail(blocked);
+
+      const result = await runSignIn({ service, origin, locale, signal });
+      ctx.logger?.info?.(`account: sign-in ${result.ok ? 'succeeded' : 'did not complete'}`);
+      return (result.ok ? ok : fail)(result.lines.join('\n'));
+    },
+  });
+}
+
+/** Read identity and balance, letting either failure render on its own. */
+async function readDetails(service) {
+  const [profile, balance] = await Promise.all([
+    service.getProfile().catch(() => ({ status: 'failed' })),
+    service.getBalance().catch(() => ({ status: 'failed' })),
+  ]);
+  return { profile: profile ?? undefined, balance: balance ?? undefined };
+}

package/plugins/account/state.mjs

@@ -0,0 +1,123 @@
+/**
+ * Pure rendering and validation for the DeepSeek account surface.
+ *
+ * The account service (`@deepseek-ai/dsh-deepseek-account`) owns the login protocol: a
+ * system-browser sign-in with PKCE, a callback the provider registers on the Host
+ * webserver, and a grant kept in the local credential store. Nothing here touches that
+ * protocol — it turns one `AccountView` (plus the optional profile and balance reads)
+ * into the lines `/account` prints, so the command stays a thin driver and every rule
+ * below is testable without a Host.
+ *
+ * Credentials never reach this module: `AccountView` is the client-safe projection and
+ * carries no token.
+ *
+ * @module dscode-account/state
+ */
+
+import { t } from '../i18n/messages.mjs';
+
+/** Attempt phases that will not change again without a new sign-in. */
+export const TERMINAL_PHASES = Object.freeze(['succeeded', 'cancelled', 'expired', 'failed']);
+
+/** Phases during which a sign-in is still moving. */
+export const ACTIVE_PHASES = Object.freeze(['initializing', 'waiting-browser', 'exchanging', 'committing']);
+
+/**
+ * The browser-reachable callback origin for one sign-in.
+ *
+ * The provider accepts exactly `http://127.0.0.1:<port>` (or localhost/[::1]) with a
+ * non-zero explicit port and no path, because that is the loopback redirect the browser
+ * is sent back to. An unmounted or unbound webserver has no origin, and the caller
+ * reports that rather than starting an attempt that cannot complete.
+ *
+ * @param webServer - the Host webserver service, or undefined when none is composed.
+ * @returns the origin, or undefined when no login can be served.
+ */
+export function callbackOrigin(webServer) {
+  const port = webServer?.port;
+  if (!Number.isInteger(port) || port <= 0) return undefined;
+  return `http://127.0.0.1:${port}`;
+}
+
+/** One wallet as `12.34 CNY`, keeping the server's decimal string exactly. */
+export function formatWallet(wallet) {
+  return `${wallet.balance} ${wallet.currency}`;
+}
+
+/**
+ * The balance line, or undefined when the deployment reported none.
+ *
+ * Recharge and bonus wallets stay separate: upstream keeps them apart because a bonus
+ * wallet is not spendable credit in the same sense, and a failed query supplies neither.
+ */
+export function balanceLine(balance, locale) {
+  if (balance === undefined || balance === null) return undefined;
+  if (balance.status !== 'ready') return t(locale, 'account.balanceFailed');
+  const wallets = balance.value.map(formatWallet).join(', ');
+  const bonus = balance.bonusWallets.map(formatWallet).join(', ');
+  if (wallets === '' && bonus === '') return t(locale, 'account.balanceEmpty');
+  const parts = [wallets === '' ? undefined : wallets, bonus === '' ? undefined : t(locale, 'account.bonus', { wallets: bonus })];
+  return t(locale, 'account.balance', { wallets: parts.filter(Boolean).join(' · ') });
+}
+
+/** The identity line, or undefined when the deployment reported none. */
+export function profileLine(profile, locale) {
+  if (profile === undefined || profile === null) return undefined;
+  if (profile.status !== 'ready') return t(locale, 'account.profileFailed');
+  const { name, contact, id } = profile.value;
+  const identity = [name, contact].filter(value => typeof value === 'string' && value !== '').join(' · ');
+  return t(locale, 'account.profile', { identity: identity === '' ? (id ?? t(locale, 'account.unknownIdentity')) : identity });
+}
+
+/** One line for the latest attempt, including a terminal outcome, or undefined when there was none. */
+export function attemptLine(attempt, locale) {
+  if (attempt === null || attempt === undefined) return undefined;
+  const phase = t(locale, `account.phase.${attempt.phase}`);
+  if (attempt.errorCode === undefined) return t(locale, 'account.attempt', { phase });
+  return t(locale, 'account.attemptFailed', { phase, reason: t(locale, `account.error.${attempt.errorCode}`) });
+}
+
+/**
+ * Render `/account` with no argument: stored-credential status, the identity and balance
+ * when they were read, the latest attempt, and the platform's own pages.
+ *
+ * `credential-stored` is deliberately not a claim that the server still accepts the
+ * grant — upstream stores no expiry — so the wording says what is on this machine.
+ *
+ * @param view - client-safe account state.
+ * @param details - optional profile and balance reads; absent when signed out or unread.
+ * @param locale - DSCODE interface language.
+ * @returns the lines to print, in order.
+ */
+export function statusLines(view, details, locale) {
+  const signedIn = view.status === 'credential-stored';
+  const lines = [t(locale, signedIn ? 'account.signedIn' : 'account.signedOut')];
+  if (signedIn) {
+    for (const line of [profileLine(details?.profile, locale), balanceLine(details?.balance, locale)]) if (line !== undefined) lines.push(line);
+  }
+  const attempt = attemptLine(view.attempt, locale);
+  if (attempt !== undefined) lines.push(attempt);
+  lines.push(t(locale, 'account.links', { usage: view.links.usageUrl, topUp: view.links.topUpUrl }));
+  lines.push(t(locale, signedIn ? 'account.hintSignedIn' : 'account.hintSignedOut'));
+  return lines;
+}
+
+/**
+ * Why a sign-in cannot start, or undefined when it can.
+ *
+ * @param account - the account service, or undefined when the deployment composes none.
+ * @param origin - the resolved callback origin from {@link callbackOrigin}.
+ * @param locale - DSCODE interface language.
+ */
+export function signInBlocked(account, origin, locale) {
+  if (account === undefined) return t(locale, 'account.unavailable');
+  if (origin === undefined) return t(locale, 'account.noCallback');
+  return undefined;
+}
+
+/** The lines printed once an attempt settles. */
+export function outcomeLines(view, details, locale) {
+  const phase = view.attempt?.phase;
+  if (phase === 'succeeded') return statusLines(view, details, locale);
+  return [attemptLine(view.attempt, locale) ?? t(locale, 'account.signedOut')];
+}

package/plugins/dscode/index.mjs

@@ -30,7 +30,7 @@ const DELEGATION_TOOLS = ['subagent', 'subagent_fork', 'workflow', 'ralph'];
 // repository there instead of pointing at a path that does not exist.
 const DOCS_DIR = fileURLToPath(new URL('../../docs/', import.meta.url));
 const DOCS_REPO = 'https://github.com/qiz029/dscode/blob/main/docs/';
-export const DOCS_SECTION = `To answer questions about DSCODE itself - what it supports, how a feature is configured, what a command does - treat the bundled user guides as the source of truth instead of guessing: ${existsSync(DOCS_DIR) ? `${DOCS_DIR} plus the repository root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, email.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, demo.md, triggers.md)` : `the repository documentation at ${DOCS_REPO} plus the root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, email.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, demo.md, triggers.md)`}. Read the relevant guide before answering rather than relying on memory of an earlier session. docs/CONTEXT-HANDOFF.md, docs/session-messaging-design.md, docs/cloud-webapp-host.md, docs/triggers-design.md, docs/verification.md, docs/maintainability.md and docs/vendored-tui-upgrade.md are internal development records, not user documentation: never quote them to a user or treat them as a specification. When the guides do not cover something, describe only what the running installation actually does and say plainly that it is not documented.`;
+export const DOCS_SECTION = `To answer questions about DSCODE itself - what it supports, how a feature is configured, what a command does - treat the bundled user guides as the source of truth instead of guessing: ${existsSync(DOCS_DIR) ? `${DOCS_DIR} plus the repository root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, email.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, demo.md, triggers.md)` : `the repository documentation at ${DOCS_REPO} plus the root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, email.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, demo.md, triggers.md)`}. Read the relevant guide before answering rather than relying on memory of an earlier session. docs/CONTEXT-HANDOFF.md, docs/session-messaging-design.md, docs/cloud-webapp-host.md, docs/triggers-design.md, docs/verification.md, docs/maintainability.md and docs/vendored-tui-upgrade.md are internal development records, not user documentation: never quote them to a user or treat them as a specification. When the guides do not cover something, describe only what the running installation actually does and say plainly that it is not documented.`;
 
 export function apply(ctx) {
   ctx.systemPrompt.section({ name: 'dscode:shell-policy', order: 1050, text: SHELL_POLICY });

package/plugins/i18n/messages.mjs

@@ -53,6 +53,40 @@ export const MESSAGES = {
     'doctor.noRoute': 'No model route is available, so the model analysis could not run.',
     'doctor.scope': 'Evidence scope: {traces} recent sessions, {logs} warnings/errors; conversation text, tool arguments and tool output were not read.',
     'doctor.failed': 'Model analysis did not finish: {error}.',
+    'account.signedIn': 'DeepSeek account: signed in on this machine (the stored grant is not re-checked here).',
+    'account.signedOut': 'DeepSeek account: signed out. The DeepSeek route falls back to an API key.',
+    'account.profile': 'Identity: {identity}',
+    'account.profileFailed': 'Identity: could not be read just now.',
+    'account.unknownIdentity': 'no display name',
+    'account.balance': 'Balance: {wallets}',
+    'account.bonus': 'bonus {wallets}',
+    'account.balanceFailed': 'Balance: could not be read just now.',
+    'account.balanceEmpty': 'Balance: no wallet reported.',
+    'account.attempt': 'Last sign-in: {phase}',
+    'account.attemptFailed': 'Last sign-in: {phase} ({reason})',
+    'account.phase.initializing': 'starting',
+    'account.phase.waiting-browser': 'waiting for the browser',
+    'account.phase.exchanging': 'exchanging the code',
+    'account.phase.committing': 'saving the grant',
+    'account.phase.succeeded': 'signed in',
+    'account.phase.cancelled': 'cancelled',
+    'account.phase.expired': 'expired',
+    'account.phase.failed': 'failed',
+    'account.error.network': 'the platform could not be reached',
+    'account.error.protocol': 'the platform answered unexpectedly',
+    'account.error.expired': 'the attempt timed out',
+    'account.error.storage': 'the credential store refused the grant',
+    'account.links': 'Usage: {usage} · Top-up: {topUp}',
+    'account.hintSignedIn': '/account logout signs out on this machine.',
+    'account.hintSignedOut': '/account login opens the browser to sign in.',
+    'account.unavailable': 'This deployment composes no DeepSeek account service.',
+    'account.noCallback': 'Account login needs the loopback callback server; it is disabled (DSCODE_ACCOUNT_LOGIN=0).',
+    'account.usage': 'Usage: /account [login|cancel|logout]',
+    'account.startFailed': 'The sign-in did not start.',
+    'account.nothingToCancel': 'No sign-in is in progress.',
+    'account.starting': 'Signing in to DeepSeek through the browser…',
+    'account.browserOpened': 'The browser was opened. Finish the sign-in there; it lands back on this machine.',
+    'account.browserManual': 'Open this URL to finish the sign-in:',
   },
   'zh-CN': {
     'activity.replying': '正在回复', 'activity.thinking': '正在思考', 'activity.running': '正在执行',
@@ -83,6 +117,40 @@ export const MESSAGES = {
     'doctor.noRoute': '没有可用的模型路由，无法运行模型分析。',
     'doctor.scope': '证据范围：{traces} 个近期会话、{logs} 条 warning/error；未读取对话正文、工具参数或工具输出。',
     'doctor.failed': '模型分析未完成：{error}。',
+    'account.signedIn': 'DeepSeek 账号：本机已登录（此处不重新校验凭据是否仍被服务端接受）。',
+    'account.signedOut': 'DeepSeek 账号：未登录。DeepSeek 路由将回退到 API key。',
+    'account.profile': '身份：{identity}',
+    'account.profileFailed': '身份：暂时读取失败。',
+    'account.unknownIdentity': '无显示名',
+    'account.balance': '余额：{wallets}',
+    'account.bonus': '赠额 {wallets}',
+    'account.balanceFailed': '余额：暂时读取失败。',
+    'account.balanceEmpty': '余额：未返回任何钱包。',
+    'account.attempt': '最近一次登录：{phase}',
+    'account.attemptFailed': '最近一次登录：{phase}（{reason}）',
+    'account.phase.initializing': '正在开始',
+    'account.phase.waiting-browser': '等待浏览器',
+    'account.phase.exchanging': '正在兑换授权码',
+    'account.phase.committing': '正在保存凭据',
+    'account.phase.succeeded': '已登录',
+    'account.phase.cancelled': '已取消',
+    'account.phase.expired': '已过期',
+    'account.phase.failed': '失败',
+    'account.error.network': '无法连接平台',
+    'account.error.protocol': '平台返回异常',
+    'account.error.expired': '尝试超时',
+    'account.error.storage': '凭据存储拒绝写入',
+    'account.links': '用量：{usage} · 充值：{topUp}',
+    'account.hintSignedIn': '/account logout 在本机退出登录。',
+    'account.hintSignedOut': '/account login 打开浏览器登录。',
+    'account.unavailable': '当前部署没有挂载 DeepSeek 账号服务。',
+    'account.noCallback': '账号登录需要回环回调服务，它已被关闭（DSCODE_ACCOUNT_LOGIN=0）。',
+    'account.usage': '用法：/account [login|cancel|logout]',
+    'account.startFailed': '登录没有启动。',
+    'account.nothingToCancel': '当前没有正在进行的登录。',
+    'account.starting': '正在通过浏览器登录 DeepSeek……',
+    'account.browserOpened': '已打开浏览器，请在那里完成登录，完成后会回到本机。',
+    'account.browserManual': '打开这个地址完成登录：',
   },
   'zh-TW': {
     'activity.replying': '正在回覆', 'activity.thinking': '正在思考', 'activity.running': '正在執行',
@@ -113,6 +181,40 @@ export const MESSAGES = {
     'doctor.noRoute': '沒有可用的模型路由，無法執行模型分析。',
     'doctor.scope': '證據範圍：{traces} 個近期工作階段、{logs} 筆 warning/error；未讀取對話內容、工具參數或工具輸出。',
     'doctor.failed': '模型分析未完成：{error}。',
+    'account.signedIn': 'DeepSeek 帳號：本機已登入（此處不重新驗證憑證是否仍被服務端接受）。',
+    'account.signedOut': 'DeepSeek 帳號：未登入。DeepSeek 路由將回退到 API key。',
+    'account.profile': '身分：{identity}',
+    'account.profileFailed': '身分：暫時讀取失敗。',
+    'account.unknownIdentity': '無顯示名稱',
+    'account.balance': '餘額：{wallets}',
+    'account.bonus': '贈額 {wallets}',
+    'account.balanceFailed': '餘額：暫時讀取失敗。',
+    'account.balanceEmpty': '餘額：未回傳任何錢包。',
+    'account.attempt': '最近一次登入：{phase}',
+    'account.attemptFailed': '最近一次登入：{phase}（{reason}）',
+    'account.phase.initializing': '正在開始',
+    'account.phase.waiting-browser': '等待瀏覽器',
+    'account.phase.exchanging': '正在兌換授權碼',
+    'account.phase.committing': '正在儲存憑證',
+    'account.phase.succeeded': '已登入',
+    'account.phase.cancelled': '已取消',
+    'account.phase.expired': '已過期',
+    'account.phase.failed': '失敗',
+    'account.error.network': '無法連線平台',
+    'account.error.protocol': '平台回應異常',
+    'account.error.expired': '嘗試逾時',
+    'account.error.storage': '憑證儲存拒絕寫入',
+    'account.links': '用量：{usage} · 充值：{topUp}',
+    'account.hintSignedIn': '/account logout 在本機登出。',
+    'account.hintSignedOut': '/account login 開啟瀏覽器登入。',
+    'account.unavailable': '目前部署沒有掛載 DeepSeek 帳號服務。',
+    'account.noCallback': '帳號登入需要回環回呼服務，它已被關閉（DSCODE_ACCOUNT_LOGIN=0）。',
+    'account.usage': '用法：/account [login|cancel|logout]',
+    'account.startFailed': '登入沒有啟動。',
+    'account.nothingToCancel': '目前沒有進行中的登入。',
+    'account.starting': '正在透過瀏覽器登入 DeepSeek……',
+    'account.browserOpened': '已開啟瀏覽器，請在那裡完成登入，完成後會回到本機。',
+    'account.browserManual': '開啟這個網址完成登入：',
   },
   ja: {
     'activity.replying': '応答中', 'activity.thinking': '思考中', 'activity.running': '実行中',
@@ -143,6 +245,40 @@ export const MESSAGES = {
     'doctor.noRoute': '利用できるモデルルートがないため、モデル分析を実行できません。',
     'doctor.scope': '根拠の範囲：直近のセッション {traces} 件、warning/error {logs} 件。会話本文、ツール引数、ツール出力は読んでいません。',
     'doctor.failed': 'モデル分析が完了しませんでした：{error}。',
+    'account.signedIn': 'DeepSeek アカウント：このマシンでサインイン済み（保存済み認可の有効性はここでは再確認しません）。',
+    'account.signedOut': 'DeepSeek アカウント：サインアウト。DeepSeek ルートは API キーにフォールバックします。',
+    'account.profile': 'アカウント：{identity}',
+    'account.profileFailed': 'アカウント：今は取得できませんでした。',
+    'account.unknownIdentity': '表示名なし',
+    'account.balance': '残高：{wallets}',
+    'account.bonus': 'ボーナス {wallets}',
+    'account.balanceFailed': '残高：今は取得できませんでした。',
+    'account.balanceEmpty': '残高：ウォレットの報告がありません。',
+    'account.attempt': '直近のサインイン：{phase}',
+    'account.attemptFailed': '直近のサインイン：{phase}（{reason}）',
+    'account.phase.initializing': '開始中',
+    'account.phase.waiting-browser': 'ブラウザ待ち',
+    'account.phase.exchanging': 'コード交換中',
+    'account.phase.committing': '認可を保存中',
+    'account.phase.succeeded': 'サインイン済み',
+    'account.phase.cancelled': 'キャンセル',
+    'account.phase.expired': '期限切れ',
+    'account.phase.failed': '失敗',
+    'account.error.network': 'プラットフォームに接続できません',
+    'account.error.protocol': 'プラットフォームの応答が不正です',
+    'account.error.expired': 'タイムアウトしました',
+    'account.error.storage': '認証情報ストアが保存を拒否しました',
+    'account.links': '使用量：{usage} · チャージ：{topUp}',
+    'account.hintSignedIn': '/account logout でこのマシンからサインアウトします。',
+    'account.hintSignedOut': '/account login でブラウザを開いてサインインします。',
+    'account.unavailable': 'この構成には DeepSeek アカウントサービスがありません。',
+    'account.noCallback': 'アカウントサインインにはループバックのコールバックサーバーが必要ですが、無効です（DSCODE_ACCOUNT_LOGIN=0）。',
+    'account.usage': '使い方：/account [login|cancel|logout]',
+    'account.startFailed': 'サインインを開始できませんでした。',
+    'account.nothingToCancel': '進行中のサインインはありません。',
+    'account.starting': 'ブラウザで DeepSeek にサインインしています……',
+    'account.browserOpened': 'ブラウザを開きました。そこでサインインを完了すると、このマシンに戻ります。',
+    'account.browserManual': 'この URL を開いてサインインを完了してください：',
   },
   ko: {
     'activity.replying': '응답 중', 'activity.thinking': '생각 중', 'activity.running': '실행 중',
@@ -173,6 +309,40 @@ export const MESSAGES = {
     'doctor.noRoute': '사용 가능한 모델 경로가 없어 모델 분석을 실행할 수 없습니다.',
     'doctor.scope': '근거 범위: 최근 세션 {traces}개, warning/error {logs}건. 대화 본문, 도구 인수, 도구 출력은 읽지 않았습니다.',
     'doctor.failed': '모델 분석이 완료되지 않았습니다: {error}.',
+    'account.signedIn': 'DeepSeek 계정: 이 기기에서 로그인됨(저장된 인증이 여전히 유효한지는 여기서 다시 확인하지 않습니다).',
+    'account.signedOut': 'DeepSeek 계정: 로그아웃 상태. DeepSeek 경로는 API 키로 대체됩니다.',
+    'account.profile': '계정: {identity}',
+    'account.profileFailed': '계정: 지금은 읽을 수 없습니다.',
+    'account.unknownIdentity': '표시 이름 없음',
+    'account.balance': '잔액: {wallets}',
+    'account.bonus': '보너스 {wallets}',
+    'account.balanceFailed': '잔액: 지금은 읽을 수 없습니다.',
+    'account.balanceEmpty': '잔액: 보고된 지갑이 없습니다.',
+    'account.attempt': '최근 로그인: {phase}',
+    'account.attemptFailed': '최근 로그인: {phase} ({reason})',
+    'account.phase.initializing': '시작 중',
+    'account.phase.waiting-browser': '브라우저 대기 중',
+    'account.phase.exchanging': '코드 교환 중',
+    'account.phase.committing': '인증 저장 중',
+    'account.phase.succeeded': '로그인됨',
+    'account.phase.cancelled': '취소됨',
+    'account.phase.expired': '만료됨',
+    'account.phase.failed': '실패',
+    'account.error.network': '플랫폼에 연결할 수 없습니다',
+    'account.error.protocol': '플랫폼 응답이 올바르지 않습니다',
+    'account.error.expired': '시간이 초과되었습니다',
+    'account.error.storage': '자격 증명 저장소가 저장을 거부했습니다',
+    'account.links': '사용량: {usage} · 충전: {topUp}',
+    'account.hintSignedIn': '/account logout 으로 이 기기에서 로그아웃합니다.',
+    'account.hintSignedOut': '/account login 으로 브라우저를 열어 로그인합니다.',
+    'account.unavailable': '이 구성에는 DeepSeek 계정 서비스가 없습니다.',
+    'account.noCallback': '계정 로그인에는 루프백 콜백 서버가 필요하지만 비활성화되어 있습니다(DSCODE_ACCOUNT_LOGIN=0).',
+    'account.usage': '사용법: /account [login|cancel|logout]',
+    'account.startFailed': '로그인이 시작되지 않았습니다.',
+    'account.nothingToCancel': '진행 중인 로그인이 없습니다.',
+    'account.starting': '브라우저로 DeepSeek에 로그인하고 있습니다……',
+    'account.browserOpened': '브라우저를 열었습니다. 거기서 로그인을 완료하면 이 기기로 돌아옵니다.',
+    'account.browserManual': '이 URL을 열어 로그인을 완료하세요:',
   },
   es: {
     'activity.replying': 'Respondiendo', 'activity.thinking': 'Pensando', 'activity.running': 'Ejecutando',
@@ -203,6 +373,40 @@ export const MESSAGES = {
     'doctor.noRoute': 'No hay una ruta de modelo disponible, así que el análisis con modelo no se pudo ejecutar.',
     'doctor.scope': 'Alcance de la evidencia: {traces} sesiones recientes, {logs} warnings/errores; no se leyó el texto de la conversación, los argumentos ni la salida de las herramientas.',
     'doctor.failed': 'El análisis con modelo no terminó: {error}.',
+    'account.signedIn': 'Cuenta DeepSeek: sesión iniciada en esta máquina (aquí no se vuelve a comprobar la concesión guardada).',
+    'account.signedOut': 'Cuenta DeepSeek: sin sesión. La ruta DeepSeek recurre a una clave de API.',
+    'account.profile': 'Identidad: {identity}',
+    'account.profileFailed': 'Identidad: no se pudo leer ahora.',
+    'account.unknownIdentity': 'sin nombre visible',
+    'account.balance': 'Saldo: {wallets}',
+    'account.bonus': 'bonificación {wallets}',
+    'account.balanceFailed': 'Saldo: no se pudo leer ahora.',
+    'account.balanceEmpty': 'Saldo: ninguna cartera informada.',
+    'account.attempt': 'Último inicio de sesión: {phase}',
+    'account.attemptFailed': 'Último inicio de sesión: {phase} ({reason})',
+    'account.phase.initializing': 'iniciando',
+    'account.phase.waiting-browser': 'esperando el navegador',
+    'account.phase.exchanging': 'canjeando el código',
+    'account.phase.committing': 'guardando la concesión',
+    'account.phase.succeeded': 'sesión iniciada',
+    'account.phase.cancelled': 'cancelado',
+    'account.phase.expired': 'caducado',
+    'account.phase.failed': 'fallido',
+    'account.error.network': 'no se pudo contactar con la plataforma',
+    'account.error.protocol': 'la plataforma respondió de forma inesperada',
+    'account.error.expired': 'el intento caducó',
+    'account.error.storage': 'el almacén de credenciales rechazó la concesión',
+    'account.links': 'Uso: {usage} · Recarga: {topUp}',
+    'account.hintSignedIn': '/account logout cierra la sesión en esta máquina.',
+    'account.hintSignedOut': '/account login abre el navegador para iniciar sesión.',
+    'account.unavailable': 'Esta composición no incluye el servicio de cuenta DeepSeek.',
+    'account.noCallback': 'El inicio de sesión necesita el servidor de retorno en loopback; está desactivado (DSCODE_ACCOUNT_LOGIN=0).',
+    'account.usage': 'Uso: /account [login|cancel|logout]',
+    'account.startFailed': 'El inicio de sesión no comenzó.',
+    'account.nothingToCancel': 'No hay ningún inicio de sesión en curso.',
+    'account.starting': 'Iniciando sesión en DeepSeek a través del navegador…',
+    'account.browserOpened': 'Se abrió el navegador. Termina ahí el inicio de sesión y volverá a esta máquina.',
+    'account.browserManual': 'Abre esta URL para terminar el inicio de sesión:',
   },
 };