dsh-coding-subscription-oauth 0.6.3 → 0.6.4

package/src/client/constants.ts

@@ -1,230 +1,230 @@
-/** Static tables for the Coding OAuth settings UI. */
-
-import {
-	CAPABILITY_SETTINGS_PATH,
-	CODING_OAUTH_LOGIN_CANCEL_PATH,
-	CODING_OAUTH_LOGIN_CODE_PATH,
-	CODING_OAUTH_LOGIN_PATH,
-	CODING_OAUTH_LOGOUT_PATH,
-	CODING_OAUTH_MODELS_PATH,
-	CODING_OAUTH_STATUS_PATH,
-	CODEX_USAGE_PATH as CORE_CODEX_USAGE_PATH,
-	GATEWAY_REVEAL_PATH as CORE_GATEWAY_REVEAL_PATH,
-	GATEWAY_ROTATE_PATH as CORE_GATEWAY_ROTATE_PATH,
-	GATEWAY_SETTINGS_PATH,
-	IMAGINE_CREDENTIAL_STATUS_PATH,
-	OAUTH_IMPORT_CANCEL_PATH,
-	OAUTH_IMPORT_COMMIT_PATH,
-	OAUTH_IMPORT_PREVIEW_PATH,
-	OAUTH_IMPORT_SOURCES_PATH,
-} from "dsh-coding-oauth-core/contracts";
-import type { GrokBuildSettingsKey } from "./locales.ts";
-import type {
-	CapabilityFlagKey,
-	CapabilityLimitKey,
-	ProviderCardDefinition,
-	SettingsTabId,
-	SourceCommitAction,
-	SourceConflict,
-	SourceKind,
-	SourcePreviewAction,
-	SourceReason,
-} from "./types.ts";
-
-export const STATUS_PATH = CODING_OAUTH_STATUS_PATH;
-export const LOGIN_PATH = CODING_OAUTH_LOGIN_PATH;
-export const LOGIN_CODE_PATH = CODING_OAUTH_LOGIN_CODE_PATH;
-export const LOGIN_CANCEL_PATH = CODING_OAUTH_LOGIN_CANCEL_PATH;
-export const LOGOUT_PATH = CODING_OAUTH_LOGOUT_PATH;
-export const MODELS_PATH = CODING_OAUTH_MODELS_PATH;
-export const SOURCES_PATH = OAUTH_IMPORT_SOURCES_PATH;
-export const SOURCES_PREVIEW_PATH = OAUTH_IMPORT_PREVIEW_PATH;
-export const SOURCES_COMMIT_PATH = OAUTH_IMPORT_COMMIT_PATH;
-export const SOURCES_CANCEL_PATH = OAUTH_IMPORT_CANCEL_PATH;
-export const CAPABILITIES_PATH = CAPABILITY_SETTINGS_PATH;
-export const CODEX_USAGE_PATH = CORE_CODEX_USAGE_PATH;
-export const IMAGINE_CREDENTIAL_PATH = IMAGINE_CREDENTIAL_STATUS_PATH;
-export const GATEWAY_PATH = GATEWAY_SETTINGS_PATH;
-export const GATEWAY_REVEAL_PATH = CORE_GATEWAY_REVEAL_PATH;
-export const GATEWAY_ROTATE_PATH = CORE_GATEWAY_ROTATE_PATH;
-export const POLL_INTERVAL_MS = 1_000;
-export const HOUR_MS = 60 * 60 * 1000;
-
-export const SOURCE_KINDS: readonly SourceKind[] = ["grok", "codex", "kimi", "claude"];
-export const SOURCE_REASONS: readonly SourceReason[] = ["missing", "unsafe", "invalid", "too_large"];
-export const SOURCE_CONFLICTS: readonly SourceConflict[] = [
-	"none",
-	"same_credential",
-	"same_account",
-	"different_account",
-	"unknown_account",
-	"unreadable_destination",
-	"unsafe_destination",
-];
-export const SOURCE_PREVIEW_ACTIONS: readonly SourcePreviewAction[] = ["import", "reuse", "overwrite", "blocked"];
-export const SOURCE_COMMIT_ACTIONS: readonly SourceCommitAction[] = ["imported", "unchanged", "overwritten"];
-
-export const SOURCE_DEFAULT_PATH: { readonly [K in SourceKind]: string } = {
-	grok: "~/.grok/auth.json",
-	codex: "~/.codex/auth.json",
-	kimi: "~/.kimi/credentials/kimi-code.json",
-	claude: "~/.claude/.credentials.json",
-};
-
-export const SOURCE_KIND_KEY: { readonly [K in SourceKind]: GrokBuildSettingsKey } = {
-	grok: "sourceKindGrok",
-	codex: "sourceKindCodex",
-	kimi: "sourceKindKimi",
-	claude: "sourceKindClaude",
-};
-
-export const SOURCE_REASON_KEY: { readonly [K in SourceReason]: GrokBuildSettingsKey } = {
-	missing: "sourceReasonMissing",
-	unsafe: "sourceReasonUnsafe",
-	invalid: "sourceReasonInvalid",
-	too_large: "sourceReasonTooLarge",
-};
-
-export const SOURCE_CONFLICT_KEY: { readonly [K in SourceConflict]: GrokBuildSettingsKey } = {
-	none: "sourceConflictNone",
-	same_credential: "sourceConflictSameCredential",
-	same_account: "sourceConflictSameAccount",
-	different_account: "sourceConflictDifferentAccount",
-	unknown_account: "sourceConflictUnknownAccount",
-	unreadable_destination: "sourceConflictUnreadableDestination",
-	unsafe_destination: "sourceConflictUnsafeDestination",
-};
-
-export const SOURCE_PREVIEW_ACTION_KEY: { readonly [K in SourcePreviewAction]: GrokBuildSettingsKey } = {
-	import: "sourceActionImport",
-	reuse: "sourceActionReuse",
-	overwrite: "sourceActionOverwrite",
-	blocked: "sourceActionBlocked",
-};
-
-export const SOURCE_COMMIT_ACTION_KEY: { readonly [K in SourceCommitAction]: GrokBuildSettingsKey } = {
-	imported: "sourceCommitImported",
-	unchanged: "sourceCommitUnchanged",
-	overwritten: "sourceCommitOverwritten",
-};
-
-export const CAPABILITY_TOGGLES: readonly {
-	key: CapabilityFlagKey;
-	label: GrokBuildSettingsKey;
-	hint: GrokBuildSettingsKey;
-	requiresImages?: true;
-}[] = [
-	{ key: "codexSearch", label: "capCodexSearch", hint: "capCodexSearchHint" },
-	{ key: "codexImages", label: "capCodexImages", hint: "capCodexImagesHint" },
-	{ key: "codexImageEdits", label: "capCodexImageEdits", hint: "capCodexImageEditsHint", requiresImages: true },
-	{
-		key: "codexImagesAnyModel",
-		label: "capCodexImagesAnyModel",
-		hint: "capCodexImagesAnyModelHint",
-		requiresImages: true,
-	},
-	{ key: "codexUsage", label: "capCodexUsage", hint: "capCodexUsageHint" },
-	{ key: "codexFast", label: "capCodexFast", hint: "capCodexFastHint" },
-	{ key: "grokImagineImage", label: "capGrokImagineImage", hint: "capGrokImagineImageHint" },
-	{ key: "grokImagineVideo", label: "capGrokImagineVideo", hint: "capGrokImagineVideoHint" },
-];
-
-export const CAPABILITY_LIMITS: readonly {
-	key: CapabilityLimitKey;
-	label: GrokBuildSettingsKey;
-	hint: GrokBuildSettingsKey;
-	min: number;
-	max: number;
-	scale: number;
-}[] = [
-	{ key: "searchResults", label: "capSearchResults", hint: "capSearchResultsHint", min: 1, max: 20, scale: 1 },
-	{ key: "imageCount", label: "capImageCount", hint: "capImageCountHint", min: 1, max: 4, scale: 1 },
-	{
-		key: "videoArtifactTtlMs",
-		label: "capVideoTtlHours",
-		hint: "capVideoTtlHoursHint",
-		min: 1,
-		max: 168,
-		scale: HOUR_MS,
-	},
-];
-
-export const IMAGINE_SOURCE_KEY: { readonly [source: string]: GrokBuildSettingsKey } = {
-	none: "imagineSourceNone",
-	env: "imagineSourceEnv",
-	environment: "imagineSourceEnv",
-	"xai-api-key": "imagineSourceEnv",
-	xai_api_key: "imagineSourceEnv",
-	"api-key": "imagineSourceApiKey",
-	api_key: "imagineSourceApiKey",
-	apikey: "imagineSourceApiKey",
-	key: "imagineSourceApiKey",
-	settings: "imagineSourceApiKey",
-	oauth: "imagineSourceOAuth",
-	"oauth-access": "imagineSourceOAuth",
-	"grok-cli-key": "imagineSourceCliKey",
-	"cli-key": "imagineSourceCliKey",
-};
-
-export const PROVIDERS: readonly ProviderCardDefinition[] = [
-	{
-		slug: "grok",
-		route: "grok-build",
-		titleKey: "grokTitle",
-		descriptionKey: "grokDescription",
-		methods: ["pkce", "device"],
-		recommended: "pkce",
-		remoteRecommended: "device",
-	},
-	{
-		slug: "codex",
-		route: "codex-oauth",
-		titleKey: "codexTitle",
-		descriptionKey: "codexDescription",
-		methods: ["device", "browser"],
-		recommended: "device",
-		remoteRecommended: "device",
-	},
-	{
-		slug: "kimi",
-		route: "kimi-code-oauth",
-		titleKey: "kimiTitle",
-		descriptionKey: "kimiDescription",
-		methods: ["device"],
-		recommended: "device",
-		remoteRecommended: "device",
-	},
-	{
-		slug: "claude",
-		route: "claude-code-oauth",
-		titleKey: "claudeTitle",
-		descriptionKey: "claudeDescription",
-		methods: ["browser"],
-		recommended: "browser",
-		remoteRecommended: "browser",
-	},
-];
-
-export const SETTINGS_TABS: readonly { id: SettingsTabId; label: GrokBuildSettingsKey }[] = [
-	{ id: "accounts", label: "tabAccounts" },
-	{ id: "gateway", label: "tabGateway" },
-	{ id: "capabilities", label: "tabCapabilities" },
-	{ id: "about", label: "tabAbout" },
-];
-
-export const GATEWAY_PORT_MIN = 1024;
-export const GATEWAY_PORT_MAX = 65_535;
-export const GATEWAY_RANDOM_PORT_MIN = 18_100;
-export const GATEWAY_RANDOM_PORT_MAX = 18_999;
-export const GATEWAY_RANDOM_RESERVED = new Set([22, 53, 3080, 7890, 9090, 18_080]);
-
-export const CONSUMED_PREVIEW_CODES = new Set([
-	"preview_invalid",
-	"preview_expired",
-	"source_changed",
-	"destination_changed",
-	"confirm_required",
-	"unsafe_destination",
-]);
-
-export const PLUGIN_VERSION = "0.6.3";
+/** Static tables for the Coding OAuth settings UI. */
+
+import {
+	CAPABILITY_SETTINGS_PATH,
+	CODING_OAUTH_LOGIN_CANCEL_PATH,
+	CODING_OAUTH_LOGIN_CODE_PATH,
+	CODING_OAUTH_LOGIN_PATH,
+	CODING_OAUTH_LOGOUT_PATH,
+	CODING_OAUTH_MODELS_PATH,
+	CODING_OAUTH_STATUS_PATH,
+	CODEX_USAGE_PATH as CORE_CODEX_USAGE_PATH,
+	GATEWAY_REVEAL_PATH as CORE_GATEWAY_REVEAL_PATH,
+	GATEWAY_ROTATE_PATH as CORE_GATEWAY_ROTATE_PATH,
+	GATEWAY_SETTINGS_PATH,
+	IMAGINE_CREDENTIAL_STATUS_PATH,
+	OAUTH_IMPORT_CANCEL_PATH,
+	OAUTH_IMPORT_COMMIT_PATH,
+	OAUTH_IMPORT_PREVIEW_PATH,
+	OAUTH_IMPORT_SOURCES_PATH,
+} from "dsh-coding-oauth-core/contracts";
+import type { GrokBuildSettingsKey } from "./locales.ts";
+import type {
+	CapabilityFlagKey,
+	CapabilityLimitKey,
+	ProviderCardDefinition,
+	SettingsTabId,
+	SourceCommitAction,
+	SourceConflict,
+	SourceKind,
+	SourcePreviewAction,
+	SourceReason,
+} from "./types.ts";
+
+export const STATUS_PATH = CODING_OAUTH_STATUS_PATH;
+export const LOGIN_PATH = CODING_OAUTH_LOGIN_PATH;
+export const LOGIN_CODE_PATH = CODING_OAUTH_LOGIN_CODE_PATH;
+export const LOGIN_CANCEL_PATH = CODING_OAUTH_LOGIN_CANCEL_PATH;
+export const LOGOUT_PATH = CODING_OAUTH_LOGOUT_PATH;
+export const MODELS_PATH = CODING_OAUTH_MODELS_PATH;
+export const SOURCES_PATH = OAUTH_IMPORT_SOURCES_PATH;
+export const SOURCES_PREVIEW_PATH = OAUTH_IMPORT_PREVIEW_PATH;
+export const SOURCES_COMMIT_PATH = OAUTH_IMPORT_COMMIT_PATH;
+export const SOURCES_CANCEL_PATH = OAUTH_IMPORT_CANCEL_PATH;
+export const CAPABILITIES_PATH = CAPABILITY_SETTINGS_PATH;
+export const CODEX_USAGE_PATH = CORE_CODEX_USAGE_PATH;
+export const IMAGINE_CREDENTIAL_PATH = IMAGINE_CREDENTIAL_STATUS_PATH;
+export const GATEWAY_PATH = GATEWAY_SETTINGS_PATH;
+export const GATEWAY_REVEAL_PATH = CORE_GATEWAY_REVEAL_PATH;
+export const GATEWAY_ROTATE_PATH = CORE_GATEWAY_ROTATE_PATH;
+export const POLL_INTERVAL_MS = 1_000;
+export const HOUR_MS = 60 * 60 * 1000;
+
+export const SOURCE_KINDS: readonly SourceKind[] = ["grok", "codex", "kimi", "claude"];
+export const SOURCE_REASONS: readonly SourceReason[] = ["missing", "unsafe", "invalid", "too_large"];
+export const SOURCE_CONFLICTS: readonly SourceConflict[] = [
+	"none",
+	"same_credential",
+	"same_account",
+	"different_account",
+	"unknown_account",
+	"unreadable_destination",
+	"unsafe_destination",
+];
+export const SOURCE_PREVIEW_ACTIONS: readonly SourcePreviewAction[] = ["import", "reuse", "overwrite", "blocked"];
+export const SOURCE_COMMIT_ACTIONS: readonly SourceCommitAction[] = ["imported", "unchanged", "overwritten"];
+
+export const SOURCE_DEFAULT_PATH: { readonly [K in SourceKind]: string } = {
+	grok: "~/.grok/auth.json",
+	codex: "~/.codex/auth.json",
+	kimi: "~/.kimi/credentials/kimi-code.json",
+	claude: "~/.claude/.credentials.json",
+};
+
+export const SOURCE_KIND_KEY: { readonly [K in SourceKind]: GrokBuildSettingsKey } = {
+	grok: "sourceKindGrok",
+	codex: "sourceKindCodex",
+	kimi: "sourceKindKimi",
+	claude: "sourceKindClaude",
+};
+
+export const SOURCE_REASON_KEY: { readonly [K in SourceReason]: GrokBuildSettingsKey } = {
+	missing: "sourceReasonMissing",
+	unsafe: "sourceReasonUnsafe",
+	invalid: "sourceReasonInvalid",
+	too_large: "sourceReasonTooLarge",
+};
+
+export const SOURCE_CONFLICT_KEY: { readonly [K in SourceConflict]: GrokBuildSettingsKey } = {
+	none: "sourceConflictNone",
+	same_credential: "sourceConflictSameCredential",
+	same_account: "sourceConflictSameAccount",
+	different_account: "sourceConflictDifferentAccount",
+	unknown_account: "sourceConflictUnknownAccount",
+	unreadable_destination: "sourceConflictUnreadableDestination",
+	unsafe_destination: "sourceConflictUnsafeDestination",
+};
+
+export const SOURCE_PREVIEW_ACTION_KEY: { readonly [K in SourcePreviewAction]: GrokBuildSettingsKey } = {
+	import: "sourceActionImport",
+	reuse: "sourceActionReuse",
+	overwrite: "sourceActionOverwrite",
+	blocked: "sourceActionBlocked",
+};
+
+export const SOURCE_COMMIT_ACTION_KEY: { readonly [K in SourceCommitAction]: GrokBuildSettingsKey } = {
+	imported: "sourceCommitImported",
+	unchanged: "sourceCommitUnchanged",
+	overwritten: "sourceCommitOverwritten",
+};
+
+export const CAPABILITY_TOGGLES: readonly {
+	key: CapabilityFlagKey;
+	label: GrokBuildSettingsKey;
+	hint: GrokBuildSettingsKey;
+	requiresImages?: true;
+}[] = [
+	{ key: "codexSearch", label: "capCodexSearch", hint: "capCodexSearchHint" },
+	{ key: "codexImages", label: "capCodexImages", hint: "capCodexImagesHint" },
+	{ key: "codexImageEdits", label: "capCodexImageEdits", hint: "capCodexImageEditsHint", requiresImages: true },
+	{
+		key: "codexImagesAnyModel",
+		label: "capCodexImagesAnyModel",
+		hint: "capCodexImagesAnyModelHint",
+		requiresImages: true,
+	},
+	{ key: "codexUsage", label: "capCodexUsage", hint: "capCodexUsageHint" },
+	{ key: "codexFast", label: "capCodexFast", hint: "capCodexFastHint" },
+	{ key: "grokImagineImage", label: "capGrokImagineImage", hint: "capGrokImagineImageHint" },
+	{ key: "grokImagineVideo", label: "capGrokImagineVideo", hint: "capGrokImagineVideoHint" },
+];
+
+export const CAPABILITY_LIMITS: readonly {
+	key: CapabilityLimitKey;
+	label: GrokBuildSettingsKey;
+	hint: GrokBuildSettingsKey;
+	min: number;
+	max: number;
+	scale: number;
+}[] = [
+	{ key: "searchResults", label: "capSearchResults", hint: "capSearchResultsHint", min: 1, max: 20, scale: 1 },
+	{ key: "imageCount", label: "capImageCount", hint: "capImageCountHint", min: 1, max: 4, scale: 1 },
+	{
+		key: "videoArtifactTtlMs",
+		label: "capVideoTtlHours",
+		hint: "capVideoTtlHoursHint",
+		min: 1,
+		max: 168,
+		scale: HOUR_MS,
+	},
+];
+
+export const IMAGINE_SOURCE_KEY: { readonly [source: string]: GrokBuildSettingsKey } = {
+	none: "imagineSourceNone",
+	env: "imagineSourceEnv",
+	environment: "imagineSourceEnv",
+	"xai-api-key": "imagineSourceEnv",
+	xai_api_key: "imagineSourceEnv",
+	"api-key": "imagineSourceApiKey",
+	api_key: "imagineSourceApiKey",
+	apikey: "imagineSourceApiKey",
+	key: "imagineSourceApiKey",
+	settings: "imagineSourceApiKey",
+	oauth: "imagineSourceOAuth",
+	"oauth-access": "imagineSourceOAuth",
+	"grok-cli-key": "imagineSourceCliKey",
+	"cli-key": "imagineSourceCliKey",
+};
+
+export const PROVIDERS: readonly ProviderCardDefinition[] = [
+	{
+		slug: "grok",
+		route: "grok-build",
+		titleKey: "grokTitle",
+		descriptionKey: "grokDescription",
+		methods: ["pkce", "device"],
+		recommended: "pkce",
+		remoteRecommended: "device",
+	},
+	{
+		slug: "codex",
+		route: "codex-oauth",
+		titleKey: "codexTitle",
+		descriptionKey: "codexDescription",
+		methods: ["device", "browser"],
+		recommended: "device",
+		remoteRecommended: "device",
+	},
+	{
+		slug: "kimi",
+		route: "kimi-code-oauth",
+		titleKey: "kimiTitle",
+		descriptionKey: "kimiDescription",
+		methods: ["device"],
+		recommended: "device",
+		remoteRecommended: "device",
+	},
+	{
+		slug: "claude",
+		route: "claude-code-oauth",
+		titleKey: "claudeTitle",
+		descriptionKey: "claudeDescription",
+		methods: ["browser"],
+		recommended: "browser",
+		remoteRecommended: "browser",
+	},
+];
+
+export const SETTINGS_TABS: readonly { id: SettingsTabId; label: GrokBuildSettingsKey }[] = [
+	{ id: "accounts", label: "tabAccounts" },
+	{ id: "gateway", label: "tabGateway" },
+	{ id: "capabilities", label: "tabCapabilities" },
+	{ id: "about", label: "tabAbout" },
+];
+
+export const GATEWAY_PORT_MIN = 1024;
+export const GATEWAY_PORT_MAX = 65_535;
+export const GATEWAY_RANDOM_PORT_MIN = 18_100;
+export const GATEWAY_RANDOM_PORT_MAX = 18_999;
+export const GATEWAY_RANDOM_RESERVED = new Set([22, 53, 3080, 7890, 9090, 18_080]);
+
+export const CONSUMED_PREVIEW_CODES = new Set([
+	"preview_invalid",
+	"preview_expired",
+	"source_changed",
+	"destination_changed",
+	"confirm_required",
+	"unsafe_destination",
+]);
+
+export const PLUGIN_VERSION = "0.6.4";

package/src/client/display.ts

@@ -1,61 +1,61 @@
-/** Pure display helpers for remote UX and CLI pull noise control. */
-
-import type { GrokBuildSettingsInjected, LoginMethod, ProviderCardDefinition, SourceStatus } from "./types.ts";
-
-const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-
-/** True when the Settings page is served from a non-loopback host (typical remote DSH). */
-export function isLikelyRemoteHost(hostname: string): boolean {
-	const normalized = hostname.trim().toLowerCase();
-	if (normalized.length === 0) return false;
-	if (LOOPBACK_HOSTS.has(normalized)) return false;
-	if (normalized.endsWith(".localhost")) return false;
-	return true;
-}
-
-export function preferredLoginMethod(definition: ProviderCardDefinition, remote: boolean): LoginMethod {
-	if (
-		remote &&
-		definition.remoteRecommended !== undefined &&
-		definition.methods.includes(definition.remoteRecommended)
-	) {
-		return definition.remoteRecommended;
-	}
-	return definition.recommended;
-}
-
-/** Put the recommended method first so the primary CTA is unambiguous. */
-export function orderedLoginMethods(definition: ProviderCardDefinition, remote: boolean): LoginMethod[] {
-	const preferred = preferredLoginMethod(definition, remote);
-	const rest = definition.methods.filter((method) => method !== preferred);
-	return definition.methods.includes(preferred) ? [preferred, ...rest] : [...definition.methods];
-}
-
-/** Per-card CLI “missing” copy is noisy on remote hosts; keep only actionable reasons. */
-export function shouldShowPerCardSourceReason(source: SourceStatus | undefined): boolean {
-	if (source === undefined || source.available) return false;
-	if (source.reason === undefined) return false;
-	return source.reason !== "missing";
-}
-
-export function allOfficialCliMissing(sources: readonly SourceStatus[] | undefined): boolean {
-	if (sources === undefined || sources.length === 0) return false;
-	return sources.every((source) => !source.available && (source.reason === undefined || source.reason === "missing"));
-}
-
-export function anyOfficialCliAvailable(sources: readonly SourceStatus[] | undefined): boolean {
-	return sources?.some((source) => source.available) === true;
-}
-
-export function methodLabel(
-	method: LoginMethod,
-	t: GrokBuildSettingsInjected["t"],
-	options?: { remote?: boolean; primary?: boolean },
-): string {
-	if (method === "device") {
-		if (options?.remote === true && options.primary === true) return t("deviceLoginRemote");
-		return t("deviceLogin");
-	}
-	if (method === "browser") return t("browserLogin");
-	return t("pkceLogin");
-}
+/** Pure display helpers for remote UX and CLI pull noise control. */
+
+import type { GrokBuildSettingsInjected, LoginMethod, ProviderCardDefinition, SourceStatus } from "./types.ts";
+
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+/** True when the Settings page is served from a non-loopback host (typical remote DSH). */
+export function isLikelyRemoteHost(hostname: string): boolean {
+	const normalized = hostname.trim().toLowerCase();
+	if (normalized.length === 0) return false;
+	if (LOOPBACK_HOSTS.has(normalized)) return false;
+	if (normalized.endsWith(".localhost")) return false;
+	return true;
+}
+
+export function preferredLoginMethod(definition: ProviderCardDefinition, remote: boolean): LoginMethod {
+	if (
+		remote &&
+		definition.remoteRecommended !== undefined &&
+		definition.methods.includes(definition.remoteRecommended)
+	) {
+		return definition.remoteRecommended;
+	}
+	return definition.recommended;
+}
+
+/** Put the recommended method first so the primary CTA is unambiguous. */
+export function orderedLoginMethods(definition: ProviderCardDefinition, remote: boolean): LoginMethod[] {
+	const preferred = preferredLoginMethod(definition, remote);
+	const rest = definition.methods.filter((method) => method !== preferred);
+	return definition.methods.includes(preferred) ? [preferred, ...rest] : [...definition.methods];
+}
+
+/** Per-card CLI “missing” copy is noisy on remote hosts; keep only actionable reasons. */
+export function shouldShowPerCardSourceReason(source: SourceStatus | undefined): boolean {
+	if (source === undefined || source.available) return false;
+	if (source.reason === undefined) return false;
+	return source.reason !== "missing";
+}
+
+export function allOfficialCliMissing(sources: readonly SourceStatus[] | undefined): boolean {
+	if (sources === undefined || sources.length === 0) return false;
+	return sources.every((source) => !source.available && (source.reason === undefined || source.reason === "missing"));
+}
+
+export function anyOfficialCliAvailable(sources: readonly SourceStatus[] | undefined): boolean {
+	return sources?.some((source) => source.available) === true;
+}
+
+export function methodLabel(
+	method: LoginMethod,
+	t: GrokBuildSettingsInjected["t"],
+	options?: { remote?: boolean; primary?: boolean },
+): string {
+	if (method === "device") {
+		if (options?.remote === true && options.primary === true) return t("deviceLoginRemote");
+		return t("deviceLogin");
+	}
+	if (method === "browser") return t("browserLogin");
+	return t("pkceLogin");
+}