dsh-oauth-login 0.2.4

package/src/hosted-capture.ts

@@ -0,0 +1,41 @@
+/** Per-request bag for hosted Responses output that pi-ai drops. */
+
+import { AsyncLocalStorage } from 'node:async_hooks'
+
+export interface HostedImage {
+  id?: string
+  base64: string
+}
+
+export interface HostedCapture {
+  images: HostedImage[]
+}
+
+export const hostedCapture = new AsyncLocalStorage<HostedCapture>()
+
+export function currentHostedCapture(): HostedCapture | undefined {
+  return hostedCapture.getStore()
+}
+
+/** Keep ALS alive across each iterator step so the OpenAI SDK fetch inherits it. */
+export function iterateInCapture<T>(
+  capture: HostedCapture,
+  source: AsyncIterable<T>,
+): AsyncIterable<T> {
+  return {
+    [Symbol.asyncIterator]() {
+      const iterator = source[Symbol.asyncIterator]()
+      return {
+        next: () => hostedCapture.run(capture, () => iterator.next()),
+        return: (value?: unknown) => hostedCapture.run(
+          capture,
+          () => iterator.return?.(value) ?? Promise.resolve({ done: true as const, value: undefined }),
+        ),
+        throw: (error?: unknown) => hostedCapture.run(
+          capture,
+          () => iterator.throw?.(error) ?? Promise.reject(error),
+        ),
+      }
+    },
+  }
+}

package/src/hosted-images.ts

@@ -0,0 +1,154 @@
+/**
+ * Receive hosted image_generation_call results as durable DSH ImageBlocks.
+ * pi-ai 0.82.1 drops those items; the UI already renders assistant images.
+ */
+
+import type { ImageAttachmentRef, ImageMediaType, SaveImageAttachment } from '@deepseek-ai/dsh-attachment'
+import type { Message, StreamChunk } from '@deepseek-ai/dsh-llm'
+import type { HostedCapture, HostedImage } from './hosted-capture.ts'
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function sniffImageMediaType(bytes: Uint8Array): ImageMediaType | undefined {
+  if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return 'image/jpeg'
+  if (bytes.length >= 8 && bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47) {
+    return 'image/png'
+  }
+  if (bytes.length >= 6 && bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46) return 'image/gif'
+  if (
+    bytes.length >= 12
+    && bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50
+  ) {
+    return 'image/webp'
+  }
+  return undefined
+}
+
+function stripDataUrl(value: string): string {
+  const match = /^data:image\/[a-zA-Z0-9.+-]+;base64,(.+)$/s.exec(value.trim())
+  return match?.[1] ?? value.trim()
+}
+
+function base64FromUnknown(value: unknown): string | undefined {
+  if (typeof value === 'string' && value.length > 0) return stripDataUrl(value)
+  if (!isRecord(value)) return undefined
+  if (typeof value.b64_json === 'string' && value.b64_json.length > 0) return stripDataUrl(value.b64_json)
+  if (typeof value.base64 === 'string' && value.base64.length > 0) return stripDataUrl(value.base64)
+  if (typeof value.result === 'string' && value.result.length > 0) return stripDataUrl(value.result)
+  return undefined
+}
+
+function pushImage(into: HostedImage[], id: string | undefined, base64: string): void {
+  if (id !== undefined && into.some(existing => existing.id === id)) return
+  if (id === undefined && into.some(existing => existing.base64 === base64)) return
+  into.push(id === undefined ? { base64 } : { id, base64 })
+}
+
+export function collectHostedImageFromItem(item: unknown, into: HostedImage[]): void {
+  if (!isRecord(item) || item.type !== 'image_generation_call') return
+  if (item.status !== undefined && item.status !== 'completed') return
+  const base64 = base64FromUnknown(item.result)
+  if (base64 === undefined) return
+  pushImage(into, typeof item.id === 'string' ? item.id : undefined, base64)
+}
+
+export function collectHostedImagesFromEvent(event: unknown, into: HostedImage[]): void {
+  if (!isRecord(event) || typeof event.type !== 'string') return
+
+  if (event.type === 'response.output_item.done') {
+    collectHostedImageFromItem(event.item, into)
+    return
+  }
+
+  if (event.type.startsWith('response.image_generation_call.')) {
+    collectHostedImageFromItem(event.item, into)
+    if (event.type.endsWith('.completed')) {
+      const base64 = base64FromUnknown(event.result)
+      if (base64 !== undefined) {
+        const id = typeof event.item_id === 'string'
+          ? event.item_id
+          : isRecord(event.item) && typeof event.item.id === 'string' ? event.item.id : undefined
+        pushImage(into, id, base64)
+      }
+    }
+    return
+  }
+
+  if (event.type !== 'response.completed' && event.type !== 'response.incomplete') return
+  const output = isRecord(event.response) ? event.response.output : undefined
+  if (!Array.isArray(output)) return
+  for (const item of output) collectHostedImageFromItem(item, into)
+}
+
+export function decodeHostedImage(base64: string): { data: Uint8Array, mediaType: ImageMediaType } | undefined {
+  let data: Uint8Array
+  try {
+    data = Uint8Array.from(Buffer.from(base64, 'base64'))
+  } catch {
+    return undefined
+  }
+  if (data.length === 0) return undefined
+  const mediaType = sniffImageMediaType(data)
+  return mediaType === undefined ? undefined : { data, mediaType }
+}
+
+function extensionFor(mediaType: ImageMediaType): string {
+  switch (mediaType) {
+    case 'image/jpeg': return 'jpg'
+    case 'image/png': return 'png'
+    case 'image/webp': return 'webp'
+    case 'image/gif': return 'gif'
+  }
+}
+
+/**
+ * pi-ai replay cannot represent assistant ImageBlocks. Drop them before the
+ * next request so replay metadata still lines up with remaining content.
+ */
+export function stripAssistantImages(messages: readonly Message[]): Message[] {
+  return messages.map(message => {
+    if (message.role !== 'assistant') return message
+    const content = message.content.filter(block => block.type !== 'image')
+    return content.length === message.content.length ? message : { ...message, content }
+  })
+}
+
+export async function* injectHostedImages(
+  source: AsyncIterable<StreamChunk>,
+  capture: HostedCapture,
+  save: (input: SaveImageAttachment) => Promise<ImageAttachmentRef>,
+): AsyncGenerator<StreamChunk> {
+  let maxIndex = -1
+  const tail: StreamChunk[] = []
+
+  for await (const chunk of source) {
+    if ('index' in chunk && typeof chunk.index === 'number') maxIndex = Math.max(maxIndex, chunk.index)
+    if (chunk.type === 'usage' || chunk.type === 'finish') {
+      tail.push(chunk)
+      continue
+    }
+    yield chunk
+  }
+
+  for (const image of capture.images) {
+    const decoded = decodeHostedImage(image.base64)
+    if (decoded === undefined) continue
+    try {
+      const attachment = await save({
+        data: decoded.data,
+        mediaType: decoded.mediaType,
+        name: `generated.${extensionFor(decoded.mediaType)}`,
+      })
+      const index = maxIndex + 1
+      maxIndex = index
+      yield { type: 'block-start', index, blockType: 'image' }
+      yield { type: 'block-end', index, block: { type: 'image', attachment } }
+    } catch {
+      // Keep the text answer when the attachment store rejects the raster.
+    }
+  }
+
+  yield* tail
+}

package/src/http.ts

@@ -0,0 +1,241 @@
+/** Proxy-aware HTTP transport for OAuth and subscribed-provider requests. */
+
+import { execFile } from 'node:child_process'
+import { connect } from 'node:net'
+import { EnvHttpProxyAgent, install, setGlobalDispatcher } from 'undici'
+import { installHostedOutputFetch } from './responses-tap.ts'
+
+const originalFetch = globalThis.fetch
+let installedFetch: typeof globalThis.fetch | undefined
+
+const DEFAULT_LOOPBACK_PROXY_CANDIDATES = [
+  'http://127.0.0.1:7890',
+  'http://127.0.0.1:45678',
+  'http://127.0.0.1:7891',
+  'http://127.0.0.1:8080',
+  'http://127.0.0.1:8888',
+] as const
+
+const PROXY_ENV_KEYS = [
+  'HTTPS_PROXY',
+  'https_proxy',
+  'HTTP_PROXY',
+  'http_proxy',
+  'ALL_PROXY',
+  'all_proxy',
+] as const
+
+export type OAuthProxyResolution =
+  | { source: 'environment' }
+  | { source: 'explicit' | 'system' | 'loopback', proxyUrl: string }
+  | { source: 'direct' }
+
+export interface OAuthProxyDiscoveryOptions {
+  env?: NodeJS.ProcessEnv
+  platform?: NodeJS.Platform
+  readSystemProxy?: () => Promise<string | undefined>
+  probe?: (proxyUrl: string) => Promise<boolean>
+  candidates?: readonly string[]
+}
+
+function normalizeProxyUrl(value: string): string {
+  const trimmed = value.trim()
+  if (trimmed.length === 0) throw new Error('dsh-oauth-login: proxy URL is empty')
+
+  const url = new URL(trimmed.includes('://') ? trimmed : `http://${trimmed}`)
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`dsh-oauth-login: unsupported proxy protocol "${url.protocol}"`)
+  }
+  if (url.hostname.length === 0) throw new Error('dsh-oauth-login: proxy URL has no host')
+
+  url.pathname = '/'
+  url.search = ''
+  url.hash = ''
+  return url.toString()
+}
+
+function inheritedProxy(env: NodeJS.ProcessEnv): string | undefined {
+  for (const key of PROXY_ENV_KEYS) {
+    const value = env[key]
+    if (value !== undefined && value.trim().length > 0) return value
+  }
+  return undefined
+}
+
+function scutilValue(output: string, key: string): string | undefined {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const match = output.match(new RegExp(`^\\s*${escaped}\\s*:\\s*(.+?)\\s*$`, 'm'))
+  return match?.[1]
+}
+
+function parseMacOSSystemProxy(output: string): string | undefined {
+  for (const kind of ['HTTPS', 'HTTP'] as const) {
+    if (scutilValue(output, `${kind}Enable`) !== '1') continue
+    const host = scutilValue(output, `${kind}Proxy`)
+    const port = Number(scutilValue(output, `${kind}Port`))
+    if (host === undefined || host.length === 0 || !Number.isInteger(port) || port <= 0 || port > 65535) {
+      continue
+    }
+    const formattedHost = host.includes(':') && !host.startsWith('[') ? `[${host}]` : host
+    return normalizeProxyUrl(`http://${formattedHost}:${port}`)
+  }
+  return undefined
+}
+
+async function readMacOSSystemProxy(): Promise<string | undefined> {
+  return await new Promise((resolve) => {
+    execFile(
+      '/usr/sbin/scutil',
+      ['--proxy'],
+      { encoding: 'utf8', timeout: 1_500, maxBuffer: 128 * 1024 },
+      (error, stdout) => resolve(error === null ? parseMacOSSystemProxy(stdout) : undefined),
+    )
+  })
+}
+
+function isLoopbackProxy(proxyUrl: string): boolean {
+  const hostname = new URL(proxyUrl).hostname.replace(/^\[(.*)\]$/, '$1').toLowerCase()
+  return hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1'
+}
+
+/**
+ * Verify that a candidate is an HTTP CONNECT proxy. The probe contains no
+ * OAuth code, credential, token, cookie, or geographic metadata.
+ */
+async function probeHttpConnectProxy(proxyUrl: string): Promise<boolean> {
+  const url = new URL(proxyUrl)
+  if (url.protocol !== 'http:') return false
+
+  const port = Number(url.port || '80')
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return false
+
+  return await new Promise((resolve) => {
+    const socket = connect({ host: url.hostname, port })
+    let settled = false
+    let response = ''
+
+    const finish = (accepted: boolean) => {
+      if (settled) return
+      settled = true
+      socket.destroy()
+      resolve(accepted)
+    }
+
+    socket.setTimeout(800)
+    socket.once('connect', () => {
+      socket.write(
+        'CONNECT auth.openai.com:443 HTTP/1.1\r\n'
+        + 'Host: auth.openai.com:443\r\n'
+        + 'Connection: close\r\n\r\n',
+      )
+    })
+    socket.on('data', (chunk) => {
+      response += chunk.toString('latin1')
+      const lineEnd = response.indexOf('\r\n')
+      if (lineEnd >= 0) finish(/^HTTP\/1\.[01] 200(?:\s|$)/.test(response.slice(0, lineEnd)))
+      else if (response.length > 16 * 1024) finish(false)
+    })
+    socket.once('timeout', () => finish(false))
+    socket.once('error', () => finish(false))
+    socket.once('end', () => finish(/^HTTP\/1\.[01] 200(?:\s|$)/.test(response)))
+  })
+}
+
+export async function resolveOAuthProxy(
+  options: OAuthProxyDiscoveryOptions = {},
+): Promise<OAuthProxyResolution> {
+  const env = options.env ?? process.env
+  if (inheritedProxy(env) !== undefined) return { source: 'environment' }
+
+  const explicit = env.DSH_OAUTH_PROXY
+  if (explicit !== undefined && explicit.trim().length > 0) {
+    return { source: 'explicit', proxyUrl: normalizeProxyUrl(explicit) }
+  }
+
+  const probe = options.probe ?? probeHttpConnectProxy
+  const platform = options.platform ?? process.platform
+  if (platform === 'darwin') {
+    const systemProxy = await (options.readSystemProxy ?? readMacOSSystemProxy)()
+    if (systemProxy !== undefined) {
+      const normalized = normalizeProxyUrl(systemProxy)
+      if (await probe(normalized)) return { source: 'system', proxyUrl: normalized }
+    }
+  }
+
+  const candidates = options.candidates ?? DEFAULT_LOOPBACK_PROXY_CANDIDATES
+  const normalizedCandidates = candidates.flatMap((candidate) => {
+    try {
+      const normalized = normalizeProxyUrl(candidate)
+      return isLoopbackProxy(normalized) ? [normalized] : []
+    } catch {
+      return []
+    }
+  })
+  const results = await Promise.all(normalizedCandidates.map(async candidate => {
+    try {
+      return await probe(candidate)
+    } catch {
+      return false
+    }
+  }))
+  const selected = results.findIndex(Boolean)
+  if (selected >= 0) return { source: 'loopback', proxyUrl: normalizedCandidates[selected] }
+
+  return { source: 'direct' }
+}
+
+function noProxyValue(env: NodeJS.ProcessEnv): string {
+  const entries = new Set(
+    (env.NO_PROXY ?? env.no_proxy ?? '')
+      .split(/[\s,]+/)
+      .filter(Boolean),
+  )
+  entries.add('localhost')
+  entries.add('127.0.0.1')
+  entries.add('::1')
+  return [...entries].join(',')
+}
+
+function inheritedProxyOptions(env: NodeJS.ProcessEnv): { httpProxy: string, httpsProxy: string } {
+  const allProxy = env.ALL_PROXY ?? env.all_proxy ?? ''
+  return {
+    httpProxy: env.HTTP_PROXY ?? env.http_proxy ?? allProxy,
+    httpsProxy: env.HTTPS_PROXY ?? env.https_proxy ?? allProxy,
+  }
+}
+
+export async function createOAuthHttpTransport(
+  options: OAuthProxyDiscoveryOptions = {},
+): Promise<{ dispatcher: EnvHttpProxyAgent; resolution: OAuthProxyResolution }> {
+  const env = options.env ?? process.env
+  const resolution = await resolveOAuthProxy({ ...options, env })
+  const selectedProxy = 'proxyUrl' in resolution ? resolution.proxyUrl : undefined
+  const inherited = inheritedProxyOptions(env)
+  const dispatcher = new EnvHttpProxyAgent({
+    allowH2: false,
+    httpProxy: selectedProxy ?? inherited.httpProxy,
+    httpsProxy: selectedProxy ?? inherited.httpsProxy,
+    noProxy: noProxyValue(env),
+  })
+  return { dispatcher, resolution }
+}
+
+export function installOAuthHttpGlobals(): void {
+  const shouldInstallFetch = installedFetch === undefined
+    ? globalThis.fetch === originalFetch
+    : globalThis.fetch === installedFetch
+  if (shouldInstallFetch) {
+    install()
+    installedFetch = globalThis.fetch
+  }
+  installHostedOutputFetch()
+}
+
+export async function configureOAuthHttpTransport(
+  options: OAuthProxyDiscoveryOptions = {},
+): Promise<OAuthProxyResolution> {
+  const { dispatcher, resolution } = await createOAuthHttpTransport(options)
+  setGlobalDispatcher(dispatcher)
+  installOAuthHttpGlobals()
+  return resolution
+}

package/src/ids.ts

@@ -0,0 +1,17 @@
+/** Basename of the DSH-owned multi-provider OAuth document. */
+export const PI_LOGIN_AUTH_FILENAME = '.dsh-oauth-auth.json'
+
+/** Legacy DSH filename accepted during the one-time storage migration. */
+export const LEGACY_PI_LOGIN_AUTH_FILENAME = '.pi-login-auth.json'
+
+/** Prefix for harness routes so they never collide with catalog / other plugins. */
+export const PI_LOGIN_ROUTE_PREFIX = 'pi-'
+
+/** Provider idle ceiling used by every composite route. */
+export const PI_LOGIN_STREAM_IDLE_TIMEOUT_MS = 300_000
+
+/** RC8 request-level image payload ceiling; matches the official pi-ai default. */
+export const PI_LOGIN_MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024
+
+/** Startup line `dshx verify` looks for. */
+export const PI_LOGIN_BOOT_MARKER = '[my-plugins/dsh-oauth-login] loaded'

package/src/index.ts

@@ -0,0 +1,183 @@
+/**
+ * DSH-owned multi-provider subscription login for DeepSeek Harness.
+ * Independent store. Never touches Pi Agent or official CLI auth files.
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-attachment'
+import type {} from '@deepseek-ai/dsh-host-webserver'
+import type { AdapterRegistrationHandle } from '@deepseek-ai/dsh-llm'
+import { createPiLoginAdapter } from './adapter.ts'
+import { registerPiLoginAuthRoutes } from './auth-routes.ts'
+import { piLoginProviderByRoute, piLoginRoutes } from './catalog.ts'
+import { maskDshWebAssembly, nativePlanForRoute } from './native-tools.ts'
+import { OAUTH_REFRESH_POLL_MS } from './oauth-refresh.ts'
+import type { Config } from './plugin-config.ts'
+import { PiLoginSession } from './session.ts'
+import { PiLoginCredentialStore } from './store.ts'
+
+type NativeAssembly = {
+  tools: { name: string }[]
+  sections: { name: string; text: string }[]
+}
+
+type NativeAssembleContext = {
+  agent?: { options?: { provider?: string; model?: string } }
+}
+
+declare module '@deepseek-ai/cordis' {
+  interface Events {
+    'system-prompt/assemble'(
+      assembly: NativeAssembly,
+      context: NativeAssembleContext,
+      next: () => Promise<NativeAssembly>,
+    ): Promise<NativeAssembly>
+  }
+}
+
+export { createPiLoginAdapter } from './adapter.ts'
+export type { PiLoginAdapterOptions } from './adapter.ts'
+export {
+  loginPiProvider,
+  loginPiProviderSession,
+  logoutPiProvider,
+  piLoginStatus,
+} from './auth.ts'
+export type { PiLoginAuthStatus } from './auth.ts'
+export {
+  registerPiLoginAuthRoutes,
+  PI_LOGIN_AUTH_CANCEL_PATH,
+  PI_LOGIN_AUTH_COMPLETE_PATH,
+  PI_LOGIN_AUTH_LOGIN_PATH,
+  PI_LOGIN_AUTH_LOGOUT_PATH,
+  PI_LOGIN_AUTH_STATUS_PATH,
+} from './auth-routes.ts'
+export type {
+  LoginChallenge,
+  LoginInputChallenge,
+  PiLoginProviderStatus,
+} from './auth-routes.ts'
+export { PI_LOGIN_PROVIDERS, piLoginProvider, piLoginRoutes } from './catalog.ts'
+export type { PiLoginProvider } from './catalog.ts'
+export {
+  defaultReasoningEffortFor,
+  extraModelsFor,
+  OX_ALPHA_DEFAULT_EFFORT,
+  OX_ALPHA_MODEL_ID,
+} from './extra-models.ts'
+export {
+  applyNativeToolsToPayload,
+  DEFAULT_NATIVE_TOOL_POLICY,
+  filterHostedServerToolTraces,
+  filterXaiServerToolTraces,
+  isHostedSearchReasoningReplay,
+  isHostedServerToolCall,
+  isXaiServerXSearchCall,
+  nativePlan,
+  nativePlanForRoute,
+  prepareNativeToolRequest,
+} from './native-tools.ts'
+export {
+  collectHostedImagesFromEvent,
+  decodeHostedImage,
+  injectHostedImages,
+  sniffImageMediaType,
+  stripAssistantImages,
+} from './hosted-images.ts'
+export type { NativeToolPlan, NativeToolPolicy } from './native-tools.ts'
+export {
+  grantNeedsRefresh,
+  OAUTH_REFRESH_POLL_MS,
+  OAUTH_REFRESH_SOON_MS,
+} from './oauth-refresh.ts'
+export { Config } from './plugin-config.ts'
+export type { Config as PluginConfig } from './plugin-config.ts'
+export {
+  LEGACY_PI_LOGIN_AUTH_FILENAME,
+  PI_LOGIN_AUTH_FILENAME,
+  PI_LOGIN_BOOT_MARKER,
+  PI_LOGIN_ROUTE_PREFIX,
+  PI_LOGIN_STREAM_IDLE_TIMEOUT_MS,
+} from './ids.ts'
+export {
+  hintFailure,
+  hintForCode,
+  QUOTA_HINT,
+  RATE_LIMIT_HINT,
+  TRANSIENT_HINT,
+  TRANSIENT_MODEL_CODES,
+  withModelErrorHint,
+} from './model-error-hint.ts'
+export { catalogProvider, harnessModels, harnessProvider, preferredModel } from './provider.ts'
+export { isSafeAuthUrl, safeMessage } from './redact.ts'
+export { PiLoginSession } from './session.ts'
+export { PiLoginCredentialStore, piLoginAuthPath } from './store.ts'
+
+export const name = 'llm-oauth-login'
+export const inject = ['llm']
+
+/**
+ * Publish only the routes that currently hold a plugin-owned credential.
+ * Logging out must drop that route from the model picker immediately.
+ */
+async function syncAuthenticatedRoutes(
+  session: PiLoginSession,
+  registration: AdapterRegistrationHandle,
+): Promise<void> {
+  registration.replace(await session.authenticatedRoutes())
+}
+
+export function apply(ctx: Context, config: Config): void {
+  console.log('[my-plugins/dsh-oauth-login] loaded')
+  const native = {
+    enabled: config.nativeTools !== false,
+    image: config.nativeImage !== false,
+  }
+  const session = new PiLoginSession(new PiLoginCredentialStore(), native)
+  // Initial registration needs ≥1 route; replace() may then empty the set.
+  const registration = ctx.llm.registerAdapter(
+    piLoginRoutes(),
+    createPiLoginAdapter(session, () => ctx.get('attachments'), {
+      streamIdleTimeoutMs: config.streamIdleTimeoutMs,
+      retryPolicy: config.retryPolicy,
+    }),
+  )
+  const refreshRoutes = (): Promise<void> => syncAuthenticatedRoutes(session, registration)
+  void refreshRoutes()
+  ctx.effect(() => {
+    const stop = session.openRouter.subscribe(() => {
+      void refreshRoutes().catch(() => { /* The next directory load retries. */ })
+    })
+    void session.openRouter.syncAuthentication().catch(() => {
+      console.warn('[dsh-oauth-login] OpenRouter catalog initialization failed; keeping built-in models')
+    })
+    return async () => {
+      stop()
+      session.openRouter.dispose()
+      await session.proxy.dispose()
+    }
+  }, 'dsh-oauth-login: OpenRouter catalog')
+  ctx.effect(() => {
+    const timer = setInterval(() => {
+      void session.refreshStoredGrants().catch(() => { /* Next auth poll retries. */ })
+    }, OAUTH_REFRESH_POLL_MS)
+    void session.refreshStoredGrants().catch(() => { /* Next auth poll retries. */ })
+    return () => clearInterval(timer)
+  }, 'dsh-oauth-login: refresh oauth grants')
+  ctx.inject(['webServer', 'connection'], webCtx => {
+    registerPiLoginAuthRoutes(webCtx, session, { onAuthChanged: refreshRoutes })
+  })
+  ctx.inject(['systemPrompt'], promptCtx => {
+    promptCtx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      const assembled = await next()
+      const route = context.agent?.options?.provider
+      const modelId = context.agent?.options?.model
+      const spec = route === undefined ? undefined : piLoginProviderByRoute(route)
+      const api = spec === undefined || modelId === undefined
+        ? undefined
+        : session.visibleModels(spec.id).find(model => model.id === modelId)?.api
+      const plan = nativePlanForRoute(route, api, session.native)
+      return plan === undefined ? assembled : maskDshWebAssembly(assembled, plan)
+    })
+  })
+}

package/src/invariant.ts

@@ -0,0 +1,12 @@
+import type { Context } from '@deepseek-ai/cordis'
+import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+
+const PACKAGE_NAME = 'dsh-oauth-login'
+
+export const name = 'pi-login-invariant'
+export const inject = ['invariants']
+
+const install: InvariantInstaller = () => {}
+
+export const apply = (ctx: Context): Promise<() => void> =>
+  Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install))