@vibedev-si/dsh-vibedev 0.2.1 → 0.2.3

package/README.md

@@ -29,7 +29,7 @@
 
 - **VibeDev 应用**：已内置本插件，不用另装。VibeDev 账号就是应用的主账号：侧边栏最底下一行和设置里的第一项都是它，DeepSeek 账号作为第二个账号显示在它上方。
 
-新版本在 npm 上发布后的 24 小时内，只写包名可能装到上一个版本（pnpm 默认不装发布未满一天的版本），想马上用新版就写明版本号，例如 `@vibedev-si/dsh-vibedev@0.2.1`。
+新版本在 npm 上发布后的 24 小时内，只写包名可能装到上一个版本（pnpm 默认不装发布未满一天的版本），想马上用新版就写明版本号，例如 `@vibedev-si/dsh-vibedev@0.2.3`。
 
 ## 登录 VibeDev
 
@@ -37,6 +37,8 @@
 
 「设置 → VibeDev 账号」里能看到当前账号、余额和 VibeDev 模型的数量，可以充值、查看用量明细、退出登录。登录会自动续期；退出后 VibeDev 的模型会从选择器里消失，DeepSeek 账号不受影响。
 
+0.2.3 起修复了重启后再次要求登录的问题：启动时凭据服务未就绪或临时读取失败，会在服务就绪后恢复，不把空结果永久缓存；正常关闭应用保留登录。过去写到本地备用文件的会话在宿主凭据服务可用后迁入，宿主已有记录优先，显式退出会清理备用会话。VibeDev 应用内置的插件需要随应用升级到修复版；单独安装在 DeepSeek Harness 中的插件可直接升级。
+
 ## VibeDev 的模型
 
 - 模型列表来自 VibeDev 网关，按你的账号下发，所以**未登录时不显示**，登录后立即出现，不用重启。
@@ -128,10 +130,12 @@ Sign in to VibeDev in DeepSeek Harness, next to the DeepSeek account:
 
 Everything is paid from your VibeDev balance; the DeepSeek account stays DeepSeek Harness's own, and the two do not affect each other. To create an account, register at [vibedev.jzsaas.com](https://vibedev.jzsaas.com). This plugin was renamed from `dsh-media`.
 
-**Install**: install `@vibedev-si/dsh-vibedev` by package name on the Plugins page (the `@vibedev-si/` scope is required), or from the [VibeDev Plugin Center](https://github.com/VibeDev-Si/dsh-ecosystem); from the command line, `dsh plugin add @vibedev-si/dsh-vibedev`, or `dsh plugin --profile desktop add @vibedev-si/dsh-vibedev` for the desktop app (quit it fully first). The VibeDev app ships with the plugin built in, and there the VibeDev account is the main account (the bottom row of the sidebar and the first Settings section), with the DeepSeek account as the second one. Within 24 hours of a release, name the version (e.g. `@vibedev-si/dsh-vibedev@0.2.1`): pnpm does not install versions younger than a day by default.
+**Install**: install `@vibedev-si/dsh-vibedev` by package name on the Plugins page (the `@vibedev-si/` scope is required), or from the [VibeDev Plugin Center](https://github.com/VibeDev-Si/dsh-ecosystem); from the command line, `dsh plugin add @vibedev-si/dsh-vibedev`, or `dsh plugin --profile desktop add @vibedev-si/dsh-vibedev` for the desktop app (quit it fully first). The VibeDev app ships with the plugin built in, and there the VibeDev account is the main account (the bottom row of the sidebar and the first Settings section), with the DeepSeek account as the second one. Within 24 hours of a release, name the version (e.g. `@vibedev-si/dsh-vibedev@0.2.3`): pnpm does not install versions younger than a day by default.
 
 **Signing in**: choose "Sign in to VibeDev" at the bottom of the sidebar or in Settings → VibeDev account. The VibeDev sign-in page opens in your system browser: you type your password on VibeDev's own page, never in the plugin. Settings → VibeDev account shows the account, the balance and how many VibeDev models are listed, and lets you top up, see usage and sign out.
 
+**Sign-in persistence (0.2.3)**: an early empty or failed startup read is retried when storage becomes ready, and committed credential changes restore the account and model route. A late read cannot overwrite a newly saved sign-in. Normal app exit keeps the sign-in. A session saved in the local fallback is migrated into an available host store without overwriting an existing host record; signing out clears the fallback as well. A built-in copy is upgraded by updating VibeDev, while a separately installed plugin can be upgraded directly.
+
 **Models**: the list comes from the VibeDev gateway for your account, so nothing is listed before you sign in; models appear right after, without a restart. Using a VibeDev model while signed out, or after the sign-in has ended, asks you to sign in; a used-up balance says so with the top-up link. These messages are separate from the DeepSeek account's. An expired access token is renewed and the request sent again, without repeating any output.
 
 **Web search**: the plugin registers the web search provider `vibedev-gateway`, signed in with your VibeDev account. Registering does not select it: DeepSeek Harness keeps its own search unless the profile sets `searchProvider: vibedev-gateway` on the `web` row (the VibeDev app does). Searching is free, but the gateway refuses every request, searches included, while the balance is zero.
@@ -150,6 +154,12 @@ Everything is paid from your VibeDev balance; the DeepSeek account stays DeepSee
 
 **Third-party code**: the model route in `src/llm/` is ported from the VibeDev app; `context.ts`, `replay.ts` and `stream.ts` are copied from DeepSeek Harness's `@deepseek-ai/dsh-llm-pi-ai` (MIT). The licences of the bundled pi-ai, Anthropic SDK, OpenAI SDK and their dependencies are in `THIRD-PARTY-NOTICES.txt`.
 
+## Maintainer releases
+
+Build, typecheck and test locally, pack the tested archive, tag the matching source version, and publish a GitHub Release with `vibedev-si-dsh-vibedev-<version>.tgz` attached. `.github/workflows/publish.yml` publishes that exact archive with npm OIDC; it does not rebuild the package. The job checks the source/tag/archive identities and Release asset digest, refuses an existing version with different bytes, and skips an identical already-published version. It verifies the complete npm tarball after publication. For a manual retry of an unpublished version, run the workflow on the version's tag ref.
+
+Configure npm Trusted Publisher with GitHub owner `VibeDev-Si`, repository `dsh-vibedev`, workflow `publish.yml`, no environment, and **Allow npm publish**. Enable **Allow npm dist-tag** as well to use the manual `dist-tag` operation for `latest` or `next`. No npm token is stored in this repository. Trusted publishing does not authorize `npm deprecate`; that maintenance operation still uses interactive authentication.
+
 ## License
 
 MIT

package/THIRD-PARTY-NOTICES.txt

@@ -1,4 +1,4 @@
-THIRD-PARTY NOTICES · @vibedev-si/dsh-vibedev 0.2.1
+THIRD-PARTY NOTICES · @vibedev-si/dsh-vibedev 0.2.3
 
 This package bundles code from the projects below. Each is used under the licence that
 follows its name; the licence texts are reproduced as the projects ship them.

package/lib/auth/credentials.d.ts

@@ -36,6 +36,7 @@ export declare class CredentialChain {
      */
     reject(credential: GatewayCredential): Promise<void>;
 }
+export declare const GRANT_KEY: import("@deepseek-ai/dsh-credentials").CredentialKey;
 /**
  * Grant storage: the host's credential store when one is loaded (a grant
  * record the store keeps verbatim), else a private file in the state

package/lib/auth/login.d.ts

@@ -88,7 +88,9 @@ export declare function openInBrowser(url: string): Promise<boolean>;
 export declare class PluginLogin {
     private readonly options;
     private grant;
-    private loaded;
+    private reading;
+    private revision;
+    private readFailureReported;
     private refreshing;
     private pending;
     private readonly listeners;
@@ -98,7 +100,10 @@ export declare class PluginLogin {
      * @param options - gateway origin, storage and test seams.
      */
     constructor(options: PluginLoginOptions);
+    private readStored;
     private load;
+    /** Re-read after the credential provider becomes ready or its record changes, without starting a browser sign-in. */
+    restore(): Promise<void>;
     /** Take a grant as current and tell listeners when it changed. */
     private adopt;
     private save;

package/lib/index.js

@@ -569,27 +569,77 @@ function grantStorage(stateDir, credentials) {
 	const deviceFile = join(stateDir, "device.json");
 	let device;
 	const readFileGrant = async () => {
-		const parsed = await readFile(sessionFile, "utf8").then((text) => JSON.parse(text), () => void 0);
+		let text;
+		try {
+			text = await readFile(sessionFile, "utf8");
+		} catch (error) {
+			if (error.code === "ENOENT") return void 0;
+			throw error;
+		}
+		const parsed = JSON.parse(text);
 		return isGrant(parsed) ? parsed : void 0;
 	};
 	const writeFileGrant = (grant) => writeFileAtomic(sessionFile, new TextEncoder().encode(grant === void 0 ? "null" : JSON.stringify(grant)), { mode: 384 });
+	const clearFileGrant = async () => {
+		try {
+			await stat(sessionFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		await writeFileGrant(void 0);
+	};
+	const clearFileGrantQuietly = async () => {
+		try {
+			await clearFileGrant();
+		} catch {}
+	};
+	const readHostGrant = async (store) => {
+		const stored = await store.readRecord(GRANT_KEY);
+		if (stored !== void 0) {
+			const grant = stored.kind === "grant" && isGrant(stored.payload) ? stored.payload : void 0;
+			if (grant !== void 0) await clearFileGrantQuietly();
+			return grant;
+		}
+		try {
+			if ((await stat(sessionFile)).size <= 4) return void 0;
+		} catch (error) {
+			if (error.code === "ENOENT") return void 0;
+			throw error;
+		}
+		let adopted;
+		await store.modifyRecord(GRANT_KEY, async (current) => {
+			if (current !== void 0) {
+				adopted = current.kind === "grant" && isGrant(current.payload) ? current.payload : void 0;
+				return;
+			}
+			adopted = await readFileGrant();
+			return adopted === void 0 ? void 0 : {
+				kind: "grant",
+				payload: adopted
+			};
+		});
+		if (adopted !== void 0) await clearFileGrantQuietly();
+		return adopted;
+	};
 	return {
 		async read() {
 			const store = credentials();
-			if (store !== void 0) {
-				const stored = await store.readRecord(GRANT_KEY);
-				return stored?.kind === "grant" && isGrant(stored.payload) ? stored.payload : void 0;
-			}
-			return readFileGrant();
+			return store === void 0 ? readFileGrant() : readHostGrant(store);
 		},
 		async write(grant) {
 			const store = credentials();
 			if (store !== void 0) {
-				if (grant === void 0) await store.deleteRecord(GRANT_KEY);
-				else await store.modifyRecord(GRANT_KEY, () => Promise.resolve({
-					kind: "grant",
-					payload: grant
-				}));
+				if (grant === void 0) {
+					await clearFileGrant();
+					await store.deleteRecord(GRANT_KEY);
+				} else {
+					await store.modifyRecord(GRANT_KEY, () => Promise.resolve({
+						kind: "grant",
+						payload: grant
+					}));
+					await clearFileGrantQuietly();
+				}
 				return;
 			}
 			await writeFileGrant(grant);
@@ -597,6 +647,7 @@ function grantStorage(stateDir, credentials) {
 		async update(change) {
 			const store = credentials();
 			if (store !== void 0) {
+				await readHostGrant(store);
 				let remove = false;
 				await store.modifyRecord(GRANT_KEY, async (current) => {
 					const result = await change(current?.kind === "grant" && isGrant(current.payload) ? current.payload : void 0);
@@ -606,7 +657,10 @@ function grantStorage(stateDir, credentials) {
 					};
 					remove = result.kind === "delete";
 				});
-				if (remove) await store.deleteRecord(GRANT_KEY);
+				if (remove) {
+					await clearFileGrant();
+					await store.deleteRecord(GRANT_KEY);
+				}
 				return;
 			}
 			const result = await change(await readFileGrant());
@@ -709,7 +763,9 @@ const PAGE = (title, body) => `<!doctype html><html><head><meta charset="utf-8">
 var PluginLogin = class {
 	options;
 	grant;
-	loaded;
+	reading;
+	revision = 0;
+	readFailureReported = false;
 	refreshing;
 	pending;
 	listeners = /* @__PURE__ */ new Set();
@@ -723,14 +779,36 @@ var PluginLogin = class {
 		this.now = options.now ?? Date.now;
 		this.origin = options.origin.trim().replace(/\/+$/, "");
 	}
+	readStored(notify) {
+		if (this.reading !== void 0) return this.reading;
+		const revision = this.revision;
+		this.reading = this.options.storage.read().then((grant) => {
+			this.readFailureReported = false;
+			if (this.revision !== revision) return;
+			if (notify) this.adopt(grant);
+			else {
+				this.grant = grant;
+				this.revision++;
+			}
+		}, () => {
+			if (!this.readFailureReported) this.options.log?.("dsh-vibedev: stored sign-in is temporarily unreadable; it will be checked again");
+			this.readFailureReported = true;
+		}).finally(() => {
+			this.reading = void 0;
+		});
+		return this.reading;
+	}
 	load() {
-		this.loaded ??= this.options.storage.read().then((grant) => {
-			this.grant = grant;
-		}, () => void 0);
-		return this.loaded;
+		return this.grant === void 0 ? this.readStored(false) : Promise.resolve();
+	}
+	/** Re-read after the credential provider becomes ready or its record changes, without starting a browser sign-in. */
+	async restore() {
+		await this.reading;
+		await this.readStored(true);
 	}
 	/** Take a grant as current and tell listeners when it changed. */
 	adopt(grant) {
+		this.revision++;
 		const changed = this.grant?.accessToken !== grant?.accessToken;
 		this.grant = grant;
 		if (!changed) return;
@@ -7168,6 +7246,15 @@ function apply(ctx, config) {
 		client: config.client.trim() || "vibedev-plugin",
 		openBrowser: (url) => config.openBrowserOnSignIn ? openInBrowser(url) : Promise.resolve(false)
 	});
+	ctx.inject(["credentials"], (scoped) => {
+		scoped.on("credentials/record-updated", (key) => {
+			if (key === GRANT_KEY) login.restore();
+		});
+		scoped.effect(async () => {
+			await login.restore();
+			return () => {};
+		}, "dsh-vibedev: restore stored sign-in");
+	});
 	const chain = new CredentialChain({
 		origin,
 		plugin: login,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibedev-si/dsh-vibedev",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "VibeDev 账号与模型：在 DeepSeek Harness 里登录 VibeDev，与 DeepSeek 账号并存，使用 VibeDev 网关的模型（Claude、GPT 等），并生成图片、视频、音乐和播客 · VibeDev account and models for DeepSeek Harness: sign in to VibeDev next to the DeepSeek account and use the VibeDev gateway's models (Claude, GPT and more), plus image, video, music and podcast generation",
   "type": "module",
   "main": "lib/index.js",