@tokennotincluded/dsh-lmm-provider 0.1.0-alpha.3

package/README.md

@@ -0,0 +1,64 @@
+# LMM provider for DSH
+
+Use the models available to your [LMM](https://api.lmm.best) account directly in DeepSeek Harness. Authentication uses browser OAuth with PKCE and a loopback callback. No API key is pasted into DSH.
+
+This package is an alpha tested with DSH `0.1.5-rc.2`. It requires Node.js `22.19.0` or newer in the supported Node 22 / Node 24+ lines.
+
+## Official DSH Desktop
+
+Open **Plugins** in the Desktop application and add `@tokennotincluded/dsh-lmm-provider@alpha`. The official Desktop application owns an isolated `desktop` profile; installing into a CLI `web` profile does not install the plugin in Desktop. If an older local, Git or release archive copy of this package is already installed, remove that package in Desktop Plugins first, then add the npm package. The Desktop manager permits one dependency with this package name per profile, so two sources cannot run together there. Restart Desktop if the manager asks for it.
+
+In **Settings → Models**, choose **Sign in with LMM**. Use **Open LMM authorization** if it opens your normal browser. If the link does nothing or opens a browser without your LMM login, choose **Copy link** and paste it into the browser where you are already signed in. On the LMM authorization page, choose **Continue** when already signed in. The **Sign in** link is for a browser without an active LMM session. Review the account and permissions, choose **Allow access**, and wait for DSH to show **Sign-in complete**. If the browser does not return to DSH automatically, use **Return to DSH** on the completion page.
+
+Keep Desktop open throughout the attempt. The authorization link is short lived and tied to the local callback listener, so start a fresh attempt if it expires. A failed attempt now shows a credential-free reason in the card.
+
+## DSH CLI / Web profile
+
+Install the npm package in the profile you run:
+
+```sh
+dsh plugin --profile web add @tokennotincluded/dsh-lmm-provider@alpha
+```
+
+The DSH package manager also keys this dependency by package name. To switch from a local, Git or archive installation, remove `@tokennotincluded/dsh-lmm-provider` from that profile, then add the npm package. Credential records are stored separately from the package dependency.
+
+### Install from source
+
+```sh
+npm install -g @deepseek-ai/dsh@0.1.5-rc.2
+git clone --recurse-submodules https://github.com/TokenNotIncluded/dsh-lmm-provider.git
+cd dsh-lmm-provider
+npm ci
+npm run build
+dsh plugin --profile web add .
+```
+
+The submodule is required by the build. If the repository was cloned without it, run `git submodule update --init --recursive` before building. Keep the checkout after installation: DSH links local plugin directories.
+
+The bundle includes the authorization service and the Web Models-page login card. Install it separately in each profile that needs LMM. A headless profile can use the credential after a Web login when both profiles share the same `DSH_HOME`:
+
+```sh
+dsh plugin --profile headless add /absolute/path/to/dsh-lmm-provider
+```
+
+## Sign in from the Web profile
+
+1. Switch to your project directory, start `dsh web`, and open Settings → Models.
+2. Find the **LMM** card and select **Sign in with LMM**.
+3. Open the authorization link in the browser where you are signed in to LMM. Click **Continue** on the LMM page, review and approve access, then return to DSH.
+4. The card reports **Sign-in complete** only after DSH observes the saved credential. Select an LMM model in your conversation.
+
+Cancel stops the pending login; closing Settings also cancels that page's active attempt. A sign-in attempt expires after five minutes. Prompt answers and OAuth credentials are never returned in status responses. The Web controls use DSH's existing authenticated API transport and its Host/Origin checks.
+
+**Sign out** removes the local credential. It does not revoke the server grant; revoke the authorization in your LMM account when needed. Model access, groups, capabilities, and prices come from the account-scoped LMM catalog. Token refresh is serialized by DSH and additionally fenced by a credential-free refresh journal under `DSH_HOME`.
+
+## Development
+
+```sh
+npm ci
+npm test
+npm run typecheck
+npm run pack:check
+```
+
+The package ships both the Host adapter and the browser bundle. Tests cover credential isolation, OAuth client identity, loader dependency metadata, authorization prompts, cancellation, and secret-free responses. A successful build or installation alone is not proof of live OAuth and model invocation; verify those against an authorized test account before relying on a new release.

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+- insert:
+    - id: authorization
+      name: '@deepseek-ai/dsh-authorization'
+    - id: lmm-model-provider
+      name: '@tokennotincluded/dsh-lmm-provider'

package/lib/client.js

@@ -0,0 +1,211 @@
+window.__ModuleLoader__.load({id:"@tokennotincluded/dsh-lmm-provider",factory:(require)=>{var module={exports:{}};var exports=module.exports;
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.tsx
+var client_exports = {};
+__export(client_exports, {
+  apply: () => apply,
+  inject: () => inject,
+  safeLoginUrl: () => safeLoginUrl
+});
+module.exports = __toCommonJS(client_exports);
+var import_react = require("react");
+var import_jsx_runtime = require("react/jsx-runtime");
+var buttonStyle = { padding: "8px 14px", border: "1px solid currentColor", borderRadius: 6, background: "transparent", color: "inherit", cursor: "pointer" };
+function LoginCard({ call }) {
+  const [signedIn, setSignedIn] = (0, import_react.useState)(false);
+  const [busy, setBusy] = (0, import_react.useState)(false);
+  const [view, setView] = (0, import_react.useState)();
+  const [answer, setAnswer] = (0, import_react.useState)("");
+  const [error, setError] = (0, import_react.useState)("");
+  const [copyState, setCopyState] = (0, import_react.useState)("idle");
+  const active = (0, import_react.useRef)();
+  const refresh = (0, import_react.useCallback)(async () => {
+    const status = await call("status");
+    setSignedIn(status.signedIn);
+    setBusy(status.busy);
+  }, [call]);
+  (0, import_react.useEffect)(() => {
+    let disposed = false;
+    void refresh().catch(() => {
+      if (!disposed) setError("Cannot read LMM sign-in status. Reopen Settings to retry.");
+    });
+    return () => {
+      disposed = true;
+    };
+  }, [refresh]);
+  (0, import_react.useEffect)(() => () => {
+    if (active.current) void call("cancel", { attempt: active.current }).catch(() => {
+    });
+  }, [call]);
+  (0, import_react.useEffect)(() => {
+    if (view?.state !== "pending") return;
+    let disposed = false;
+    let timer;
+    const poll = async () => {
+      try {
+        const next = await call("poll", { attempt: view.attempt });
+        if (disposed) return;
+        setView(next);
+        if (next.state === "pending") timer = setTimeout(() => void poll(), 750);
+        else {
+          active.current = void 0;
+          setBusy(false);
+          await refresh();
+        }
+      } catch {
+        if (!disposed) {
+          setError("Sign-in connection was interrupted. Cancel and try again.");
+          setBusy(false);
+        }
+      }
+    };
+    timer = setTimeout(() => void poll(), 300);
+    return () => {
+      disposed = true;
+      clearTimeout(timer);
+    };
+  }, [view?.attempt, view?.state, call, refresh]);
+  (0, import_react.useEffect)(() => {
+    setAnswer("");
+  }, [view?.prompt?.id]);
+  const loginUrl = view?.state === "pending" ? [...view.notices].reverse().find((notice) => notice.url && safeLoginUrl(notice.url))?.url : void 0;
+  const start = async () => {
+    setError("");
+    setCopyState("idle");
+    setBusy(true);
+    try {
+      const next = await call("begin");
+      active.current = next.attempt;
+      setView(next);
+    } catch (cause) {
+      setBusy(false);
+      setError(cause instanceof Error ? cause.message : "Sign-in could not start.");
+    }
+  };
+  const cancel = async () => {
+    if (view) {
+      await call("cancel", { attempt: view.attempt });
+      active.current = void 0;
+      setView(void 0);
+      await refresh();
+    }
+  };
+  const submit = async () => {
+    if (!view?.prompt) return;
+    try {
+      setView(await call("answer", { attempt: view.attempt, prompt: view.prompt.id, value: answer }));
+      setAnswer("");
+    } catch {
+      setError("This question expired. Wait for the current sign-in step.");
+    }
+  };
+  const signOut = async () => {
+    try {
+      await call("logout");
+      setView(void 0);
+      await refresh();
+    } catch {
+      setError("Sign-out failed. Try again.");
+    }
+  };
+  const copyLoginUrl = async () => {
+    if (!loginUrl) return;
+    try {
+      await navigator.clipboard.writeText(loginUrl);
+      setCopyState("copied");
+    } catch {
+      setCopyState("manual");
+    }
+  };
+  const prompt = view?.prompt;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { "aria-label": "LMM", style: { marginTop: 24, padding: 20, border: "1px solid #8886", borderRadius: 8 }, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { style: { margin: "0 0 8px" }, children: "LMM" }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: signedIn ? "Signed in with LMM. Choose an LMM model in your conversation." : "Connect your LMM account in the browser. No API key is needed." }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 10 }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: buttonStyle, disabled: busy, onClick: () => void start(), children: "Sign in with LMM" }),
+      signedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: buttonStyle, disabled: busy, onClick: () => void signOut(), children: "Sign out" }),
+      view?.state === "pending" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: buttonStyle, onClick: () => void cancel().catch(() => setError("Cancellation failed. Try again.")), children: "Cancel" })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { "aria-live": "polite", children: [
+      view?.notices.map((notice, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { children: [
+        notice.message,
+        notice.code && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("code", { children: [
+          " ",
+          notice.code
+        ] })
+      ] }, i)),
+      loginUrl && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { children: [
+          "Open the authorization link in the browser where you are already signed in to LMM. If the Desktop window cannot open it, copy the link and paste it into that browser. On the LMM page, choose ",
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: "Continue" }),
+          " if you are already signed in; use ",
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: "Sign in" }),
+          " only if that browser is signed out."
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { href: loginUrl, target: "_blank", rel: "noopener noreferrer", children: "Open LMM authorization" }),
+        " ",
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: buttonStyle, onClick: () => void copyLoginUrl(), children: "Copy link" }),
+        copyState === "copied" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { role: "status", children: " Link copied." }),
+        copyState === "manual" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          " Select and copy this link: ",
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { value: loginUrl, readOnly: true, onFocus: (event) => event.currentTarget.select(), style: { width: "100%" } })
+        ] })
+      ] }),
+      view?.state === "authorized" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Sign-in complete." }),
+      view?.state === "cancelled" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Sign-in cancelled." }),
+      view?.state === "failed" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", children: view.error ?? "Sign-in failed. Try again." }),
+      error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", children: error })
+    ] }),
+    prompt && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: (event) => {
+      event.preventDefault();
+      void submit();
+    }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+        prompt.message,
+        prompt.kind === "select" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("select", { value: answer, onChange: (e) => setAnswer(e.target.value), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "", children: "Select\u2026" }),
+          prompt.options?.map((option) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: option.id, children: option.label }, option.id))
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: prompt.kind === "secret" ? "password" : "text", value: answer, placeholder: prompt.placeholder, autoComplete: "off", onChange: (e) => setAnswer(e.target.value) })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: buttonStyle, disabled: !answer, type: "submit", children: "Continue" })
+    ] }),
+    signedIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { children: "Sign out removes this local login. Revoke account access on LMM when needed." })
+  ] });
+}
+function safeLoginUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname === "api.lmm.best" && url.port === "" && url.pathname === "/api/oauth2/authorize" && url.username === "" && url.password === "";
+  } catch {
+    return false;
+  }
+}
+var inject = ["slots", "connection"];
+function apply(ctx) {
+  const call = async (action, payload = {}) => {
+    const result = await ctx.connection.rpc.call("/api", "lmm-auth/" + action, payload);
+    if (!result.ok) throw new Error(result.error.message);
+    return result.value;
+  };
+  ctx.slots.inject("settings.models.footer", () => ctx.slots.register({ name: "settings.models.footer", id: "lmm-sign-in", order: 20, inject: () => ({ call }) }, LoginCard));
+}
+
+return module.exports;}});