dsh-coding-subscription-oauth 0.5.0

package/src/oauth-import-routes.ts

@@ -0,0 +1,314 @@
+/**
+ * Same-origin Web API for allowlisted CLI OAuth source discovery and
+ * two-phase import into destination stores. Preview tickets live only in the
+ * process-local session; `peekPreview` supplies ticket.kind as the destination
+ * authority before the store lock. Persist happens inside that lock.
+ * @module dsh-coding-subscription-oauth/oauth-import-routes
+ */
+
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { readJsonRequest, requestErrorStatus } from "./http-json.ts";
+import {
+	createOAuthImportSession,
+	isOAuthSourceError,
+	isOAuthSourceKind,
+	type OAuthImportCommitAction,
+	type OAuthImportCommitResult,
+	type OAuthImportPreview,
+	type OAuthImportSession,
+	type OAuthImportSessionOptions,
+	type OAuthSourceCredential,
+	type OAuthSourceDiscovery,
+	OAuthSourceError,
+	type OAuthSourceErrorCode,
+	type OAuthSourceKind,
+	type OAuthSourcePathOptions,
+} from "./oauth-sources.ts";
+import { safeMessage } from "./redact.ts";
+import { isTrustedLoopbackWebRequest } from "./web-origin.ts";
+import { registerWebRouteSetupAtomically } from "./web-routes.ts";
+
+export const OAUTH_IMPORT_SOURCES_PATH = "/plugins/dsh-grok-build/oauth/sources";
+export const OAUTH_IMPORT_PREVIEW_PATH = "/plugins/dsh-grok-build/oauth/sources/preview";
+export const OAUTH_IMPORT_COMMIT_PATH = "/plugins/dsh-grok-build/oauth/sources/commit";
+export const OAUTH_IMPORT_CANCEL_PATH = "/plugins/dsh-grok-build/oauth/sources/cancel";
+
+export interface OAuthImportRouteContext {
+	webServer: {
+		register(route: {
+			kind: "exact";
+			path: string;
+			handler: (request: IncomingMessage, response: ServerResponse) => void | Promise<void>;
+		}): () => void;
+	};
+	effect?(setup: () => () => void | Promise<void>, label?: string): void;
+}
+
+export interface OAuthImportDestinationStore {
+	readonly filename: string;
+	modify(
+		providerId: string,
+		fn: (current: OAuthSourceCredential | undefined) => Promise<OAuthSourceCredential | undefined>,
+	): Promise<OAuthSourceCredential | undefined>;
+}
+
+export interface OAuthImportDestination {
+	providerId: string;
+	store: OAuthImportDestinationStore;
+}
+
+export type OAuthImportDestinations = { [K in OAuthSourceKind]: OAuthImportDestination };
+
+export interface OAuthImportAppliedEvent {
+	kind: OAuthSourceKind;
+	action: Extract<OAuthImportCommitAction, "imported" | "overwritten">;
+}
+
+export interface OAuthImportRouteOptions extends OAuthImportSessionOptions, OAuthSourcePathOptions {
+	onImported?: (event: OAuthImportAppliedEvent) => void | Promise<void>;
+}
+
+export interface OAuthImportSourcesResponse {
+	sources: OAuthSourceDiscovery[];
+}
+
+export interface OAuthImportCancelResult {
+	ok: true;
+	cancelled: boolean;
+}
+
+/** Register same-origin CLI source import routes when the Web server is composed. */
+export function registerOAuthImportRoutes(
+	ctx: OAuthImportRouteContext,
+	destinations: OAuthImportDestinations,
+	options: OAuthImportRouteOptions = {},
+): () => void {
+	const importer = createOAuthImportSession({
+		...(options.now === undefined ? {} : { now: options.now }),
+		...(options.ttlMs === undefined ? {} : { ttlMs: options.ttlMs }),
+	});
+	const pathOptions: OAuthSourcePathOptions = {
+		...(options.home === undefined ? {} : { home: options.home }),
+		...(options.env === undefined ? {} : { env: options.env }),
+	};
+
+	const attach = (): (() => void) =>
+		registerWebRouteSetupAtomically(ctx.webServer, (webServer) => [
+			webServer.register({
+				kind: "exact",
+				path: OAUTH_IMPORT_SOURCES_PATH,
+				handler: async (req, res) => {
+					if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+					if (!isTrustedLoopbackWebRequest(req)) return json(res, 403, { error: "forbidden" });
+					try {
+						json(res, 200, await discoverSources(importer, pathOptions));
+					} catch (error: unknown) {
+						writeError(res, error);
+					}
+				},
+			}),
+			webServer.register({
+				kind: "exact",
+				path: OAUTH_IMPORT_PREVIEW_PATH,
+				handler: async (req, res) => {
+					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+					if (!isTrustedLoopbackWebRequest(req)) return json(res, 403, { error: "forbidden" });
+					try {
+						const kind = readExactKind(await readJsonRequest(req));
+						if (kind === undefined) {
+							return json(res, 400, { error: "kind must be grok, codex, kimi, or claude" });
+						}
+						json(res, 200, await previewSource(importer, destinations[kind], kind, pathOptions));
+					} catch (error: unknown) {
+						writeError(res, error);
+					}
+				},
+			}),
+			webServer.register({
+				kind: "exact",
+				path: OAUTH_IMPORT_COMMIT_PATH,
+				handler: async (req, res) => {
+					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+					if (!isTrustedLoopbackWebRequest(req)) return json(res, 403, { error: "forbidden" });
+					try {
+						const parsed = readCommitBody(await readJsonRequest(req));
+						if (parsed.error !== undefined) {
+							return json(res, 400, { error: parsed.error });
+						}
+						const claim = importer.peekPreview(parsed.previewId);
+						if (claim.kind !== parsed.kind) {
+							throw new OAuthSourceError("unsupported", "oauth import: kind does not match the preview");
+						}
+						json(
+							res,
+							200,
+							await commitSource(
+								importer,
+								destinations[claim.kind],
+								{ ...parsed, kind: claim.kind },
+								pathOptions,
+								options.onImported,
+							),
+						);
+					} catch (error: unknown) {
+						writeError(res, error);
+					}
+				},
+			}),
+			webServer.register({
+				kind: "exact",
+				path: OAUTH_IMPORT_CANCEL_PATH,
+				handler: async (req, res) => {
+					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+					if (!isTrustedLoopbackWebRequest(req)) return json(res, 403, { error: "forbidden" });
+					try {
+						const previewId = readPreviewId(await readJsonRequest(req));
+						if (previewId === undefined) {
+							return json(res, 400, { error: "previewId must be a non-empty string" });
+						}
+						json(res, 200, { ok: true, cancelled: importer.cancel(previewId) } satisfies OAuthImportCancelResult);
+					} catch (error: unknown) {
+						writeError(res, error);
+					}
+				},
+			}),
+		]);
+
+	if (typeof ctx.effect === "function") {
+		ctx.effect(attach, "dsh-coding-subscription-oauth: OAuth source import routes");
+		return () => undefined;
+	}
+	return attach();
+}
+
+async function discoverSources(
+	importer: OAuthImportSession,
+	pathOptions: OAuthSourcePathOptions,
+): Promise<OAuthImportSourcesResponse> {
+	return { sources: await importer.discover(pathOptions) };
+}
+
+async function previewSource(
+	importer: OAuthImportSession,
+	destination: OAuthImportDestination,
+	kind: OAuthSourceKind,
+	pathOptions: OAuthSourcePathOptions,
+): Promise<OAuthImportPreview> {
+	return importer.preview({
+		kind,
+		...pathOptions,
+		destination: { path: destination.store.filename },
+	});
+}
+
+async function commitSource(
+	importer: OAuthImportSession,
+	destination: OAuthImportDestination,
+	input: { kind: OAuthSourceKind; previewId: string; confirmOverwrite?: boolean },
+	pathOptions: OAuthSourcePathOptions,
+	onImported: OAuthImportRouteOptions["onImported"],
+): Promise<OAuthImportCommitResult> {
+	let result: OAuthImportCommitResult | undefined;
+	await destination.store.modify(destination.providerId, async (current) => {
+		const outcome = await importer.commit({
+			previewId: input.previewId,
+			kind: input.kind,
+			...(input.confirmOverwrite === undefined ? {} : { confirmOverwrite: input.confirmOverwrite }),
+			...pathOptions,
+			destination: { path: destination.store.filename },
+		});
+		result = outcome.result;
+		return outcome.takePersist() ?? current;
+	});
+	if (result === undefined) {
+		throw new Error("oauth import: destination store did not complete commit");
+	}
+	if (result.action === "imported" || result.action === "overwritten") {
+		try {
+			await onImported?.({ kind: input.kind, action: result.action });
+		} catch {
+			// Adapter notification is advisory; persist already succeeded.
+		}
+	}
+	return result;
+}
+
+function json(res: ServerResponse, status: number, value: unknown): void {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff",
+	});
+	res.end(JSON.stringify(value));
+}
+
+function writeError(res: ServerResponse, error: unknown): void {
+	const status = oauthImportErrorStatus(error);
+	const payload: { error: string; code?: OAuthSourceErrorCode } = {
+		error: status >= 500 ? "request failed" : safeMessage(error),
+	};
+	if (isOAuthSourceError(error)) payload.code = error.code;
+	json(res, status, payload);
+}
+
+export function oauthImportErrorStatus(error: unknown): number {
+	if (isOAuthSourceError(error)) {
+		switch (error.code) {
+			case "not_found":
+			case "preview_invalid":
+				return 404;
+			case "too_large":
+				return 413;
+			case "preview_expired":
+				return 410;
+			case "source_changed":
+			case "destination_changed":
+			case "confirm_required":
+			case "unsafe_destination":
+				return 409;
+			case "unsafe_source":
+			case "invalid_document":
+			case "unsupported":
+				return 400;
+		}
+	}
+	return requestErrorStatus(error, 500);
+}
+
+function readExactKind(body: unknown): OAuthSourceKind | undefined {
+	const record = asRecord(body);
+	if (record === undefined) return undefined;
+	const kind = record["kind"];
+	return typeof kind === "string" && isOAuthSourceKind(kind) ? kind : undefined;
+}
+
+function readPreviewId(body: unknown): string | undefined {
+	const record = asRecord(body);
+	if (record === undefined) return undefined;
+	const previewId = record["previewId"];
+	return typeof previewId === "string" && previewId.length > 0 ? previewId : undefined;
+}
+
+function readCommitBody(
+	body: unknown,
+): { kind: OAuthSourceKind; previewId: string; confirmOverwrite?: boolean; error?: undefined } | { error: string } {
+	const kind = readExactKind(body);
+	if (kind === undefined) return { error: "kind must be grok, codex, kimi, or claude" };
+	const previewId = readPreviewId(body);
+	if (previewId === undefined) return { error: "previewId must be a non-empty string" };
+	const record = asRecord(body);
+	if (record === undefined) return { error: "request body must be a JSON object" };
+	if (!("confirmOverwrite" in record) || record["confirmOverwrite"] === undefined) {
+		return { kind, previewId };
+	}
+	if (typeof record["confirmOverwrite"] !== "boolean") {
+		return { error: "confirmOverwrite must be a boolean" };
+	}
+	return { kind, previewId, confirmOverwrite: record["confirmOverwrite"] };
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+	return typeof value === "object" && value !== null && !Array.isArray(value)
+		? (value as Record<string, unknown>)
+		: undefined;
+}

package/src/oauth-providers.ts

@@ -0,0 +1,152 @@
+/**
+ * Native pi-ai OAuth providers and their stable Harness route aliases.
+ * @module dsh-coding-subscription-oauth/oauth-providers
+ */
+
+import type { Api, ApiKeyAuth, Provider } from "@earendil-works/pi-ai";
+import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { kimiCodingProvider } from "@earendil-works/pi-ai/providers/kimi-coding";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import {
+	CLAUDE_CODE_OAUTH_AUTH_FILENAME,
+	CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME,
+	CLAUDE_CODE_OAUTH_ROUTE,
+	CLAUDE_PI_PROVIDER,
+	CODEX_OAUTH_AUTH_FILENAME,
+	CODEX_OAUTH_MODELS_CACHE_FILENAME,
+	CODEX_OAUTH_ROUTE,
+	CODEX_PI_PROVIDER,
+	type CodingOAuthProviderSlug,
+	KIMI_CODE_OAUTH_AUTH_FILENAME,
+	KIMI_CODE_OAUTH_MODELS_CACHE_FILENAME,
+	KIMI_CODE_OAUTH_ROUTE,
+	KIMI_PI_PROVIDER,
+} from "./ids.ts";
+
+export type SubscriptionProviderSlug = Exclude<CodingOAuthProviderSlug, "grok">;
+export type SubscriptionLoginMethod = "browser" | "device";
+
+export interface OAuthProviderDefinition {
+	slug: SubscriptionProviderSlug;
+	route: string;
+	nativeProviderId: string;
+	displayName: string;
+	authFilename: string;
+	modelsCacheFilename: string;
+	loginMethods: readonly SubscriptionLoginMethod[];
+	recommendedLoginMethod: SubscriptionLoginMethod;
+	providerFactory(): Provider<Api>;
+	requestProvider(selectedIds?: readonly string[]): Provider<Api>;
+}
+
+function requestTokenAuth(name: string, bearerHeader: boolean): ApiKeyAuth {
+	return {
+		name,
+		resolve: async ({ credential }) => {
+			const token = credential?.key?.trim();
+			if (token === undefined || token.length === 0) return undefined;
+			return bearerHeader
+				? { auth: { headers: { Authorization: `Bearer ${token}` } }, source: "OAuth bridge" }
+				: { auth: { apiKey: token }, source: "OAuth bridge" };
+		},
+	};
+}
+
+function selectedProvider(
+	base: Provider<Api>,
+	selectedIds: readonly string[] | undefined,
+	apiKey: ApiKeyAuth | undefined,
+): Provider<Api> {
+	const selected = selectedIds === undefined || selectedIds.length === 0 ? undefined : new Set(selectedIds);
+	return {
+		...base,
+		auth: apiKey === undefined ? base.auth : { ...base.auth, apiKey },
+		getModels: () => {
+			const models = base.getModels();
+			return selected === undefined ? models : models.filter((model) => selected.has(model.id));
+		},
+	};
+}
+
+/** Remove the transport-only `apiKey` carrier without reintroducing it as an explicit undefined. */
+function withoutApiKey<T extends { apiKey?: unknown }>(options: T): T {
+	const { apiKey: _dropped, ...rest } = options;
+	return rest as T;
+}
+
+/**
+ * PiAiAdapter's api-key resolver seam necessarily populates `options.apiKey`.
+ * Kimi OAuth is header-owned Bearer auth, so remove that transport-only carrier
+ * after Models has derived Authorization and before the Anthropic client sees
+ * it (otherwise the SDK also emits an invalid x-api-key header).
+ */
+function stripApiKeyBeforeStream(provider: Provider<Api>): Provider<Api> {
+	return {
+		...provider,
+		stream: (model, context, options) =>
+			provider.stream(model, context, options === undefined ? undefined : withoutApiKey(options)),
+		streamSimple: (model, context, options) =>
+			provider.streamSimple(model, context, options === undefined ? undefined : withoutApiKey(options)),
+	};
+}
+
+function asProvider(factory: () => Provider): () => Provider<Api> {
+	return factory as () => Provider<Api>;
+}
+
+const createCodexProvider = asProvider(openaiCodexProvider);
+const createKimiProvider = asProvider(kimiCodingProvider);
+const createClaudeProvider = asProvider(anthropicProvider);
+
+export const CODEX_OAUTH_PROVIDER: OAuthProviderDefinition = {
+	slug: "codex",
+	route: CODEX_OAUTH_ROUTE,
+	nativeProviderId: CODEX_PI_PROVIDER,
+	displayName: "OpenAI Codex (ChatGPT Plus/Pro)",
+	authFilename: CODEX_OAUTH_AUTH_FILENAME,
+	modelsCacheFilename: CODEX_OAUTH_MODELS_CACHE_FILENAME,
+	loginMethods: ["device", "browser"],
+	recommendedLoginMethod: "device",
+	providerFactory: createCodexProvider,
+	requestProvider: (selectedIds) =>
+		selectedProvider(createCodexProvider(), selectedIds, requestTokenAuth("OpenAI Codex OAuth token", false)),
+};
+
+export const KIMI_CODE_OAUTH_PROVIDER: OAuthProviderDefinition = {
+	slug: "kimi",
+	route: KIMI_CODE_OAUTH_ROUTE,
+	nativeProviderId: KIMI_PI_PROVIDER,
+	displayName: "Kimi Code (subscription)",
+	authFilename: KIMI_CODE_OAUTH_AUTH_FILENAME,
+	modelsCacheFilename: KIMI_CODE_OAUTH_MODELS_CACHE_FILENAME,
+	loginMethods: ["device"],
+	recommendedLoginMethod: "device",
+	providerFactory: createKimiProvider,
+	requestProvider: (selectedIds) =>
+		stripApiKeyBeforeStream(
+			selectedProvider(createKimiProvider(), selectedIds, requestTokenAuth("Kimi Code OAuth token", true)),
+		),
+};
+
+export const CLAUDE_CODE_OAUTH_PROVIDER: OAuthProviderDefinition = {
+	slug: "claude",
+	route: CLAUDE_CODE_OAUTH_ROUTE,
+	nativeProviderId: CLAUDE_PI_PROVIDER,
+	displayName: "Claude Code (Pro/Max)",
+	authFilename: CLAUDE_CODE_OAUTH_AUTH_FILENAME,
+	modelsCacheFilename: CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME,
+	loginMethods: ["browser"],
+	recommendedLoginMethod: "browser",
+	providerFactory: createClaudeProvider,
+	requestProvider: (selectedIds) => selectedProvider(createClaudeProvider(), selectedIds, undefined),
+};
+
+export const OAUTH_PROVIDER_DEFINITIONS = [
+	CODEX_OAUTH_PROVIDER,
+	KIMI_CODE_OAUTH_PROVIDER,
+	CLAUDE_CODE_OAUTH_PROVIDER,
+] as const;
+
+export function oauthProviderDefinition(slug: string): OAuthProviderDefinition | undefined {
+	return OAUTH_PROVIDER_DEFINITIONS.find((provider) => provider.slug === slug);
+}

package/src/oauth-session.ts

@@ -0,0 +1,183 @@
+/**
+ * Persistent OAuth session and static model selection for one subscription provider.
+ * @module dsh-coding-subscription-oauth/oauth-session
+ */
+
+import { mkdir, readFile, rm } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import type {
+	Api,
+	AuthInteraction,
+	Credential,
+	Model,
+	MutableModels,
+	OAuthCredential,
+	Provider,
+} from "@earendil-works/pi-ai";
+import { createModels } from "@earendil-works/pi-ai";
+import type { OAuthProviderDefinition } from "./oauth-providers.ts";
+import { OAuthCredentialFileStore, oauthCredentialPath } from "./store.ts";
+
+const MODELS_CACHE_VERSION = 1;
+
+interface ModelsCacheDocument {
+	version: typeof MODELS_CACHE_VERSION;
+	selected: string[];
+}
+
+function isENOENT(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | null)?.code === "ENOENT";
+}
+
+function parseIdList(value: unknown): string[] {
+	if (!Array.isArray(value)) return [];
+	return [...new Set(value.filter((id): id is string => typeof id === "string" && id.length > 0))];
+}
+
+function parseCache(text: string): string[] | undefined {
+	let value: unknown;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		return undefined;
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+	const document = value as Record<string, unknown>;
+	if (document["version"] !== MODELS_CACHE_VERSION) return undefined;
+	const selected = parseIdList(document["selected"]);
+	return selected.length === 0 ? undefined : selected;
+}
+
+export function oauthModelsCachePath(basename: string, dshHome?: string): string {
+	return resolve(join(resolveDshHome(dshHome), basename));
+}
+
+export interface OAuthProviderStatus {
+	authenticated: boolean;
+	expiresAt?: number;
+}
+
+export class OAuthProviderSession {
+	readonly store: OAuthCredentialFileStore;
+	readonly models: MutableModels;
+	private readonly catalog: readonly Model<Api>[];
+	private readonly cacheFile: string;
+	private selectedIds: string[] | undefined;
+
+	constructor(
+		readonly definition: OAuthProviderDefinition,
+		onCatalogChange?: () => void,
+		store: OAuthCredentialFileStore = new OAuthCredentialFileStore(
+			definition.nativeProviderId,
+			oauthCredentialPath(definition.authFilename),
+			definition.route,
+		),
+		cacheFile: string = oauthModelsCachePath(definition.modelsCacheFilename),
+	) {
+		this.store = store;
+		this.cacheFile = resolve(cacheFile);
+		const provider = definition.providerFactory();
+		this.catalog = [...provider.getModels()];
+		this.models = createModels({ credentials: store });
+		this.models.setProvider(provider);
+		this.onCatalogChange = onCatalogChange;
+	}
+
+	private onCatalogChange: (() => void) | undefined;
+
+	availableModels(): Model<Api>[] {
+		return [...this.catalog];
+	}
+
+	selectedModelIds(): string[] | undefined {
+		return this.selectedIds === undefined ? undefined : [...this.selectedIds];
+	}
+
+	visibleModels(): Model<Api>[] {
+		if (this.selectedIds === undefined || this.selectedIds.length === 0) return this.availableModels();
+		const byId = new Map(this.catalog.map((model) => [model.id, model]));
+		return this.selectedIds.flatMap((id) => {
+			const model = byId.get(id);
+			return model === undefined ? [] : [model];
+		});
+	}
+
+	provider(): Provider {
+		return this.definition.requestProvider(this.visibleModels().map((model) => model.id));
+	}
+
+	async loadCachedModels(): Promise<void> {
+		try {
+			this.selectedIds = parseCache(await readFile(this.cacheFile, "utf8"));
+		} catch (error) {
+			if (!isENOENT(error)) throw error;
+		}
+	}
+
+	async setSelectedModels(ids: readonly string[]): Promise<void> {
+		const available = new Set(this.catalog.map((model) => model.id));
+		const selected = [...new Set(ids.filter((id) => available.has(id)))];
+		this.selectedIds = selected.length === 0 ? undefined : selected;
+		await this.writeCache();
+		this.onCatalogChange?.();
+	}
+
+	async status(): Promise<OAuthProviderStatus> {
+		const credential = await this.store.read(this.definition.nativeProviderId);
+		if (credential?.type !== "oauth") return { authenticated: false };
+		return { authenticated: true, expiresAt: credential.expires };
+	}
+
+	async login(interaction: AuthInteraction): Promise<Credential> {
+		const credential = await this.models.login(this.definition.nativeProviderId, "oauth", interaction);
+		this.onCatalogChange?.();
+		return credential;
+	}
+
+	async resolveAccessToken(): Promise<string | undefined> {
+		const resolved = await this.models.getAuth(this.definition.nativeProviderId);
+		if (resolved === undefined) return undefined;
+		const credential = await this.store.read(this.definition.nativeProviderId);
+		return credential?.type === "oauth" ? credential.access : undefined;
+	}
+
+	/**
+	 * Backdate the stored token's expiry so the next `getAuth()` refreshes.
+	 * Called after an upstream 401 rejected a locally-valid token.
+	 */
+	async invalidateAccessToken(): Promise<void> {
+		await this.store.invalidate(this.definition.nativeProviderId);
+	}
+
+	async storedCredential(): Promise<OAuthCredential | undefined> {
+		const credential = await this.store.read(this.definition.nativeProviderId);
+		return credential?.type === "oauth" ? credential : undefined;
+	}
+
+	async logout(): Promise<void> {
+		try {
+			await this.models.logout(this.definition.nativeProviderId);
+			this.selectedIds = undefined;
+			await mkdir(dirname(this.cacheFile), { recursive: true, mode: 0o700 });
+			await rm(this.cacheFile, { force: true });
+		} finally {
+			// Credential deletion may succeed before cache cleanup fails. Always
+			// refresh discovery so an open selector cannot retain stale models.
+			this.onCatalogChange?.();
+		}
+	}
+
+	private async writeCache(): Promise<void> {
+		const document: ModelsCacheDocument = {
+			version: MODELS_CACHE_VERSION,
+			selected: this.selectedIds === undefined ? [] : [...this.selectedIds],
+		};
+		await mkdir(dirname(this.cacheFile), { recursive: true, mode: 0o700 });
+		await writeFileAtomic(this.cacheFile, `${JSON.stringify(document)}\n`, {
+			mode: 0o600,
+			dirMode: 0o700,
+		});
+	}
+}