dsh-oauth-login 0.2.4

package/src/auth.ts

@@ -0,0 +1,76 @@
+/** DSH-owned models.login() for every subscribed provider in the catalog. */
+
+import { createModels } from '@earendil-works/pi-ai'
+import { dirname, join } from 'node:path'
+import type { AuthInteraction } from '@earendil-works/pi-ai'
+import { requirePiLoginProvider } from './catalog.ts'
+import { OAuthProxyTransport } from './proxy-transport.ts'
+import { PROXY_SETTINGS_FILENAME } from './proxy-config.ts'
+import { catalogProvider } from './provider.ts'
+import type { PiLoginSession } from './session.ts'
+import { PiLoginCredentialStore } from './store.ts'
+
+export interface PiLoginAuthStatus {
+  providerId: string
+  authenticated: boolean
+  credentialType?: 'oauth' | 'api_key'
+  expiresAt?: Date
+}
+
+export async function loginPiProvider(
+  providerId: string,
+  interaction: AuthInteraction,
+  store: PiLoginCredentialStore = new PiLoginCredentialStore(),
+): Promise<void> {
+  const spec = requirePiLoginProvider(providerId)
+  const models = createModels({ credentials: store })
+  models.setProvider(catalogProvider(providerId))
+  const proxy = new OAuthProxyTransport(join(dirname(store.filename), PROXY_SETTINGS_FILENAME))
+  try { await proxy.run(() => models.login(providerId, spec.authType, interaction)) } finally { await proxy.dispose() }
+}
+
+export async function logoutPiProvider(
+  providerId: string,
+  store: PiLoginCredentialStore = new PiLoginCredentialStore(),
+): Promise<void> {
+  requirePiLoginProvider(providerId)
+  await store.delete(providerId)
+}
+
+export async function piLoginStatus(
+  store: PiLoginCredentialStore = new PiLoginCredentialStore(),
+  providerId?: string,
+): Promise<PiLoginAuthStatus[]> {
+  const ids = providerId === undefined ? (await store.list()).map(item => item.providerId) : [providerId]
+  const out: PiLoginAuthStatus[] = []
+  for (const id of ids) {
+    const credential = await store.read(id)
+    if (credential?.type === 'oauth') {
+      out.push({
+        providerId: id,
+        authenticated: true,
+        credentialType: 'oauth',
+        expiresAt: new Date(credential.expires),
+      })
+      continue
+    }
+    if (credential?.type === 'api_key' && typeof credential.key === 'string' && credential.key.length > 0) {
+      out.push({ providerId: id, authenticated: true, credentialType: 'api_key' })
+      continue
+    }
+    out.push({ providerId: id, authenticated: false })
+  }
+  return out
+}
+
+export async function loginPiProviderSession(
+  providerId: string,
+  interaction: AuthInteraction,
+  session: PiLoginSession,
+): Promise<void> {
+  const spec = requirePiLoginProvider(providerId)
+  await session.ensureTransport()
+  session.models.setProvider(catalogProvider(providerId))
+  await session.proxy.run(() => session.models.login(providerId, spec.authType, interaction))
+  if (providerId === 'openrouter') await session.openRouter.syncAuthentication('login')
+}

package/src/bin.ts

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+/** Standalone credential CLI. Never reads or writes official CLI auth files. */
+
+import { spawn } from 'node:child_process'
+import { realpathSync } from 'node:fs'
+import { createInterface } from 'node:readline/promises'
+import { fileURLToPath } from 'node:url'
+import type { AuthEvent, AuthPrompt } from '@earendil-works/pi-ai'
+import { PI_LOGIN_PROVIDERS, requirePiLoginProvider } from './catalog.ts'
+import {
+  loginPiProviderSession,
+  piLoginAuthPath,
+  piLoginStatus,
+  PiLoginSession,
+} from './index.ts'
+import { isSafeAuthUrl, safeMessage } from './redact.ts'
+
+type Action = 'login' | 'logout' | 'status'
+
+function openBrowser(rawUrl: string, providerId: string): void {
+  const spec = requirePiLoginProvider(providerId)
+  if (!isSafeAuthUrl(rawUrl, spec)) {
+    throw new Error(`refusing to open authorization URL outside ${spec.displayName} official hosts`)
+  }
+  const url = new URL(rawUrl)
+  const command = process.platform === 'win32'
+    ? { file: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url.href] }
+    : process.platform === 'darwin'
+      ? { file: 'open', args: [url.href] }
+      : { file: 'xdg-open', args: [url.href] }
+  try {
+    const child = spawn(command.file, command.args, {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+    })
+    child.on('error', () => {})
+    child.unref()
+  } catch {
+    // printed URL remains the fallback
+  }
+}
+
+function notify(event: AuthEvent, providerId: string, useBrowser: boolean): void {
+  switch (event.type) {
+    case 'auth_url':
+      process.stdout.write(`Open this URL to sign in:\n${event.url}\n`)
+      if (event.instructions !== undefined) process.stdout.write(`${event.instructions}\n`)
+      if (useBrowser) openBrowser(event.url, providerId)
+      break
+    case 'device_code':
+      process.stdout.write(`Open this URL to sign in:\n${event.verificationUri}\n`)
+      if (event.userCode.length > 0) process.stdout.write(`Enter code: ${event.userCode}\n`)
+      if (useBrowser) openBrowser(event.verificationUri, providerId)
+      break
+    case 'info':
+    case 'progress':
+      process.stdout.write(`${event.message}\n`)
+      break
+    default:
+      event satisfies never
+  }
+}
+
+async function answerPrompt(
+  prompt: AuthPrompt,
+  question: (text: string, options: { signal?: AbortSignal }) => Promise<string>,
+): Promise<string> {
+  if (prompt.type === 'select') {
+    const oauth = prompt.options.find(option => option.id === 'oauth' || option.id.includes('oauth'))
+    const browser = prompt.options.find(option => option.id.includes('browser'))
+    return oauth?.id ?? browser?.id ?? prompt.options[0]?.id ?? 'oauth'
+  }
+  const suffix = prompt.placeholder === undefined ? '' : ` (${prompt.placeholder})`
+  return question(`${prompt.message}${suffix}: `, {
+    ...prompt.signal === undefined ? {} : { signal: prompt.signal },
+  })
+}
+
+function printHelp(): void {
+  const ids = PI_LOGIN_PROVIDERS.map(provider => `    ${provider.id.padEnd(18)} ${provider.displayName}`).join('\n')
+  process.stdout.write([
+    'Usage: dsh-oauth-login <login|logout|status> [provider]',
+    '',
+    '  login [provider]   Subscription OAuth or official Plan API key',
+    '  logout [provider]  remove a dsh credential (or all if omitted)',
+    '  status [provider]  report non-secret credential state',
+    '',
+    'Providers:',
+    ids,
+    '',
+  ].join('\n'))
+}
+
+function resolveIds(raw: string | undefined): string[] {
+  if (raw === undefined) return PI_LOGIN_PROVIDERS.map(provider => provider.id)
+  return [requirePiLoginProvider(raw).id]
+}
+
+export async function run(argv: readonly string[]): Promise<number> {
+  if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
+    printHelp()
+    return 0
+  }
+  const [rawAction, rawProvider, ...rest] = argv
+  if (rawAction !== 'login' && rawAction !== 'logout' && rawAction !== 'status') {
+    process.stderr.write(`dsh-oauth-login: expected login, logout, or status; got ${JSON.stringify(rawAction)}\n`)
+    return 1
+  }
+  if (rest.length > 0) {
+    process.stderr.write(`dsh-oauth-login: unexpected extra arguments: ${rest.join(' ')}\n`)
+    return 1
+  }
+  const action: Action = rawAction
+  try {
+    const session = new PiLoginSession()
+    switch (action) {
+      case 'status': {
+        const ids = resolveIds(rawProvider)
+        let failed = false
+        process.stdout.write(`store: ${piLoginAuthPath()}\n`)
+        await session.refreshStoredGrants()
+        for (const id of ids) {
+          const [status] = await piLoginStatus(session.store, id)
+          const spec = requirePiLoginProvider(id)
+          if (status === undefined || !status.authenticated) {
+            process.stdout.write(`${spec.displayName}: signed out\n`)
+            failed = true
+            continue
+          }
+          const expires = status.expiresAt
+          const suffix = expires === undefined || Number.isNaN(expires.valueOf())
+            ? ''
+            : `; access expires ${expires.toISOString()}`
+          const models = session.visibleModels(id).map(model => model.id).slice(0, 8).join(', ')
+          process.stdout.write(`${spec.displayName}: signed in${suffix}\n`)
+          process.stdout.write(`  route: ${spec.route}\n`)
+          process.stdout.write(`  models: ${models}\n`)
+        }
+        return failed && rawProvider !== undefined ? 1 : 0
+      }
+      case 'logout': {
+        const ids = resolveIds(rawProvider)
+        for (const id of ids) {
+          await session.logout(id)
+          process.stdout.write(`${requirePiLoginProvider(id).displayName}: signed out\n`)
+        }
+        process.stdout.write('Official CLI auth files were not touched.\n')
+        return 0
+      }
+      case 'login': {
+        if (rawProvider === undefined) {
+          process.stderr.write('dsh-oauth-login: login requires a provider id (see --help)\n')
+          return 1
+        }
+        const id = requirePiLoginProvider(rawProvider).id
+        const spec = requirePiLoginProvider(id)
+        if (spec.authType === 'api_key' && spec.loginUrl !== undefined) {
+          process.stdout.write(`Create or copy the Plan API key here:\n${spec.loginUrl}\n`)
+          openBrowser(spec.loginUrl, id)
+        }
+        const readline = createInterface({ input: process.stdin, output: process.stdout })
+        try {
+          await loginPiProviderSession(id, {
+            prompt: prompt => answerPrompt(prompt, (text, options) => readline.question(text, options)),
+            notify: event => notify(event, id, true),
+          }, session)
+        } finally {
+          readline.close()
+        }
+        process.stdout.write(`${requirePiLoginProvider(id).displayName}: signed in\n`)
+        process.stdout.write(`store: ${piLoginAuthPath()}\n`)
+        process.stdout.write('Official CLI auth files were not read or written.\n')
+        return 0
+      }
+    }
+  } catch (error: unknown) {
+    process.stderr.write(`dsh-oauth-login: ${action} failed: ${safeMessage(error)}\n`)
+    return 1
+  }
+}
+
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === realpathSync(process.argv[1])) {
+  process.exitCode = await run(process.argv.slice(2))
+}

package/src/catalog.ts

@@ -0,0 +1,129 @@
+/** OAuth subscriptions Pi Agent exposes via /login. Radius is omitted (needs a gateway). */
+
+export interface PiLoginProvider {
+  /** pi-ai provider id used by models.login(). */
+  readonly id: string
+  /** Harness LLM route. Distinct from catalog routes and from other plugins. */
+  readonly route: string
+  /** Credential method this plugin deliberately exposes for this provider. */
+  readonly authType: 'oauth' | 'api_key'
+  /** Official account page opened before an interactive API-key prompt. */
+  readonly loginUrl?: string
+  readonly displayName: string
+  readonly shortName: string
+  readonly blurb: string
+  readonly blurbZh: string
+  /** HTTPS hosts this provider is allowed to open during login. */
+  readonly allowedHosts: readonly string[]
+  /** Extra allowed host suffixes (leading-dot match). */
+  readonly allowedSuffixes: readonly string[]
+  readonly preferredModels: readonly string[]
+}
+
+export const PI_LOGIN_PROVIDERS: readonly PiLoginProvider[] = [
+  {
+    id: 'openai-codex',
+    route: 'pi-openai-codex',
+    authType: 'oauth',
+    displayName: 'ChatGPT Codex',
+    shortName: 'Codex',
+    blurb: 'ChatGPT Plus/Pro Codex. Independent of official `codex login`.',
+    blurbZh: 'ChatGPT Plus/Pro 的 Codex。和官方 `codex login` 互不影响。',
+    allowedHosts: ['auth.openai.com', 'chatgpt.com', 'www.chatgpt.com'],
+    allowedSuffixes: ['.openai.com', '.chatgpt.com'],
+    preferredModels: ['gpt-5.4', 'gpt-5.3-codex', 'gpt-5.3-codex-spark'],
+  },
+  {
+    id: 'anthropic',
+    route: 'pi-anthropic',
+    authType: 'oauth',
+    displayName: 'Claude Pro/Max',
+    shortName: 'Claude',
+    blurb: 'Claude subscription. Independent of official Claude Code login.',
+    blurbZh: 'Claude 订阅。和官方 Claude Code 登录互不影响。',
+    allowedHosts: ['claude.ai', 'www.claude.ai', 'platform.claude.com'],
+    allowedSuffixes: ['.anthropic.com', '.claude.ai'],
+    preferredModels: ['claude-opus-4-6', 'claude-sonnet-4-6', 'claude-opus-4-5'],
+  },
+  {
+    id: 'xai',
+    route: 'pi-xai',
+    authType: 'oauth',
+    displayName: 'xAI Grok',
+    shortName: 'Grok',
+    blurb: 'SuperGrok / X Premium. Independent of official `grok` CLI.',
+    blurbZh: 'SuperGrok / X Premium。和官方 `grok` CLI 互不影响。',
+    allowedHosts: ['auth.x.ai', 'accounts.x.ai', 'x.ai', 'www.x.ai'],
+    allowedSuffixes: ['.x.ai'],
+    preferredModels: ['grok-4.6', 'grok-4.5', 'grok-4.3'],
+  },
+  {
+    id: 'github-copilot',
+    route: 'pi-github-copilot',
+    authType: 'oauth',
+    displayName: 'GitHub Copilot',
+    shortName: 'Copilot',
+    blurb: 'GitHub Copilot subscription via device code.',
+    blurbZh: 'GitHub Copilot 订阅，走 device code。',
+    allowedHosts: ['github.com', 'www.github.com', 'api.github.com'],
+    allowedSuffixes: ['.github.com', '.githubcopilot.com'],
+    preferredModels: ['gpt-5.4', 'claude-sonnet-4.6', 'claude-opus-4.6'],
+  },
+  {
+    id: 'openrouter',
+    route: 'pi-openrouter',
+    authType: 'oauth',
+    displayName: 'OpenRouter',
+    shortName: 'OpenRouter',
+    blurb: 'OpenRouter OAuth mints a key billed from your OpenRouter credits.',
+    blurbZh: 'OpenRouter OAuth 会签发一把钥匙，从你的 OpenRouter 余额扣费。',
+    allowedHosts: ['openrouter.ai', 'www.openrouter.ai'],
+    allowedSuffixes: ['.openrouter.ai'],
+    preferredModels: [],
+  },
+  {
+    id: 'kimi-coding',
+    route: 'pi-kimi-coding',
+    authType: 'oauth',
+    displayName: 'Kimi For Coding',
+    shortName: 'Kimi',
+    blurb: 'Kimi Code subscription.',
+    blurbZh: 'Kimi Code 订阅。',
+    allowedHosts: ['auth.kimi.com', 'kimi.com', 'www.kimi.com', 'api.kimi.com'],
+    allowedSuffixes: ['.kimi.com'],
+    preferredModels: ['kimi-for-coding', 'k3'],
+  },
+  {
+    id: 'zai-coding-cn',
+    route: 'pi-zai-coding-cn',
+    authType: 'api_key',
+    loginUrl: 'https://bigmodel.cn/coding-plan/personal/overview',
+    displayName: '智谱 GLM Coding Plan',
+    shortName: 'GLM',
+    blurb: 'Zhipu GLM Coding Plan (China) via its official Plan API key.',
+    blurbZh: '智谱 GLM Coding Plan 中国区套餐，使用套餐页签发的专用 API Key。',
+    allowedHosts: ['bigmodel.cn', 'www.bigmodel.cn', 'open.bigmodel.cn'],
+    allowedSuffixes: ['.bigmodel.cn'],
+    preferredModels: ['glm-5.3-flash', 'glm-5.3', 'glm-5.2', 'glm-5-turbo', 'glm-5.1', 'glm-4.7'],
+  },
+]
+
+export function piLoginProvider(id: string): PiLoginProvider | undefined {
+  return PI_LOGIN_PROVIDERS.find(provider => provider.id === id)
+}
+
+export function piLoginProviderByRoute(route: string): PiLoginProvider | undefined {
+  return PI_LOGIN_PROVIDERS.find(provider => provider.route === route)
+}
+
+export function requirePiLoginProvider(id: string): PiLoginProvider {
+  const provider = piLoginProvider(id)
+  if (provider === undefined) {
+    throw new Error(`dsh-oauth-login: unknown provider "${id}"`)
+  }
+  return provider
+}
+
+export function piLoginRoutes(): string[] {
+  return PI_LOGIN_PROVIDERS.map(provider => provider.route)
+}

package/src/client/OpenRouterSyncStatus.tsx

@@ -0,0 +1,66 @@
+import { useEffect, useState, useSyncExternalStore } from 'react'
+import type { OpenRouterCatalogClient } from './openrouter-store.ts'
+import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
+
+const CSS = [
+  '.dsh-or-sync{display:flex;flex-direction:column;gap:4px;padding:6px 8px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary);min-width:0}',
+  '.dsh-or-sync-row{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:4px 8px}',
+  '.dsh-or-sync-copy{min-width:0;overflow-wrap:anywhere}',
+  '.dsh-or-sync time{font-variant-numeric:tabular-nums}',
+  '.dsh-or-refresh{min-height:28px;padding:3px 8px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;cursor:pointer}',
+  '.dsh-or-refresh:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}',
+  '.dsh-or-refresh:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:1px}',
+  '.dsh-or-refresh:disabled{opacity:.55;cursor:default}',
+  '.dsh-or-sync-error{color:color-mix(in srgb,var(--dsw-alias-state-warn-label) 50%,var(--dsw-alias-label-primary))}',
+].join('\n')
+
+export interface OpenRouterSyncStatusProps {
+  catalog: OpenRouterCatalogClient
+  ts: TranslateNS<'model-search'>
+  details?: boolean
+}
+
+export function OpenRouterSyncStatus({ catalog, ts, details = false }: OpenRouterSyncStatusProps) {
+  const state = useSyncExternalStore(catalog.subscribe, catalog.getSnapshot)
+  const [now, setNow] = useState(Date.now)
+  const data = state.data
+  const retryAt = data?.retryAt ?? 0
+  useEffect(() => {
+    setNow(Date.now())
+    if (retryAt <= Date.now()) return
+    const timer = setTimeout(() => { setNow(Date.now()) }, retryAt - Date.now() + 20)
+    return () => { clearTimeout(timer) }
+  }, [retryAt])
+  const cooling = retryAt > now
+  const working = state.loading || data?.refreshing === true
+  const unavailable = state.error !== null || data?.error !== null && data?.error !== undefined
+  const timestamp = data?.lastUpdatedAt
+  return (
+    <div className="dsh-or-sync" data-ud-check={details ? 'openrouter-settings-sync' : 'openrouter-menu-sync'} data-ud-min-gap="4">
+      <style>{CSS}</style>
+      <div className="dsh-or-sync-row">
+        <span className="dsh-or-sync-copy" role="status" aria-live="polite">
+          {working ? ts('syncing') : data?.connected ? ts('syncSchedule') : ts('syncSignIn')}
+        </span>
+        <button type="button" className="dsh-or-refresh"
+          disabled={working || cooling || data?.connected !== true}
+          onClick={() => { void catalog.load(true) }}
+        >{working ? ts('syncing') : cooling ? ts('syncCooldown') : ts('syncRefresh')}</button>
+      </div>
+      {timestamp != null && (
+        <span className="dsh-or-sync-copy">{ts('syncUpdated')}{' '}
+          <time dateTime={new Date(timestamp).toISOString()}>{new Date(timestamp).toLocaleString()}</time>
+          {data?.stale ? ' · ' + ts('syncStale') : ''}
+        </span>
+      )}
+      {timestamp == null && data?.connected && <span>{ts('syncBuiltin')}</span>}
+      {unavailable && <span role="status" className="dsh-or-sync-copy dsh-or-sync-error">
+        {ts(state.error === 'restart' ? 'syncRestart' : data?.error === 'save' ? 'syncSaveError' : 'syncError')}
+      </span>}
+      {details && <>
+        <span>{ts('freeHelp')}</span>
+        <span>{ts('forcedPluginWarning')}</span>
+      </>}
+    </div>
+  )
+}