dsh-oauth-login 0.2.4

package/lib/invariant.d.ts

@@ -0,0 +1,7 @@
+import { Context } from "@deepseek-ai/cordis";
+//#region src/invariant.d.ts
+declare const name = "pi-login-invariant";
+declare const inject: string[];
+declare const apply: (ctx: Context) => Promise<() => void>;
+//#endregion
+export { apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,8 @@
+//#region src/invariant.ts
+const PACKAGE_NAME = "dsh-oauth-login";
+const name = "pi-login-invariant";
+const inject = ["invariants"];
+const install = () => {};
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/package.json

@@ -0,0 +1,180 @@
+{
+  "name": "dsh-oauth-login",
+  "description": "DSH-owned subscription login powered by Pi AI adapters: OAuth plus official Plan API keys, with an independent credential store.",
+  "version": "0.2.4",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aa2246740/dsh-oauth-login.git"
+  },
+  "homepage": "https://github.com/aa2246740/dsh-oauth-login#readme",
+  "bugs": {
+    "url": "https://github.com/aa2246740/dsh-oauth-login/issues"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "oauth",
+    "zhipu",
+    "glm",
+    "coding-plan",
+    "pi-agent",
+    "codex",
+    "openrouter"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "bin": {
+    "dsh-oauth-login": "lib/bin.js"
+  },
+  "scripts": {
+    "build": "npm run typecheck && tsdown",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.client.json",
+    "check": "npm run typecheck && npm run test && npm run build",
+    "link:harness": "node scripts/link-harness-dependencies.mjs"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "cordis.patch.yml",
+    "INSTALL.md",
+    "INSTALL.zh.md",
+    "README.md",
+    "README.en.md",
+    "README.zh.md",
+    "SECURITY.md",
+    "LICENSE",
+    "docs/screenshots",
+    "docs/openrouter-sync.md",
+    "docs/network-proxy.md"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "undici": "^8.5.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-model-selection",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-session",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-locale"
+      ],
+      "platform": "web"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-atomic-write": "*",
+    "@deepseek-ai/dsh-attachment": "*",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-rc.3 <0.1.6",
+    "@deepseek-ai/dsh-home-paths": "*",
+    "@deepseek-ai/dsh-host-webserver": "*",
+    "@deepseek-ai/dsh-invariants": "*",
+    "@deepseek-ai/dsh-llm": "*",
+    "@deepseek-ai/dsh-llm-pi-ai": "*",
+    "@deepseek-ai/schemastery": "^3.18.2",
+    "@earendil-works/pi-ai": "^0.85.1",
+    "react": "^18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-ai": {
+      "optional": true
+    },
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-atomic-write": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-attachment": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-home-paths": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-host-webserver": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-invariants": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm-pi-ai": {
+      "optional": true
+    },
+    "@deepseek-ai/schemastery": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-api-session-controller": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-atomic-write": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-authorization": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-ui-session": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-credentials": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-fs": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-home-paths": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-timeout": "0.1.5-rc.3",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.3",
+    "@deepseek-ai/schemastery": "3.18.2",
+    "@earendil-works/pi-ai": "0.85.1",
+    "@types/node": "^22.20.0",
+    "@types/react": "~18.3.1",
+    "@types/semver": "7.7.1",
+    "react": "^18.2.0",
+    "semver": "^7.7.2",
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  }
+}

package/src/adapter.ts

@@ -0,0 +1,207 @@
+/** One PiAiAdapter covering every Pi-login harness route. */
+
+import { LlmError, ReasoningEffortId, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
+import { defaultProviderAuthContext } from '@earendil-works/pi-ai'
+import type {
+  GenerateOptions,
+  LlmResolvedModelInfo,
+  PreparedAdapterCall,
+  RetryPolicyConfig,
+  StreamChunk,
+} from '@deepseek-ai/dsh-llm'
+import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
+import type {
+  PiAiAdapterOptions as BasePiAiAdapterOptions,
+  ResolvedPiAiProviderProfile,
+} from '@deepseek-ai/dsh-llm-pi-ai'
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment'
+import { PI_LOGIN_PROVIDERS, piLoginProviderByRoute } from './catalog.ts'
+import { defaultReasoningEffortFor } from './extra-models.ts'
+import { iterateInCapture } from './hosted-capture.ts'
+import type { HostedCapture } from './hosted-capture.ts'
+import { injectHostedImages, stripAssistantImages } from './hosted-images.ts'
+import {
+  PI_LOGIN_MAX_REQUEST_IMAGE_BYTES,
+  PI_LOGIN_STREAM_IDLE_TIMEOUT_MS,
+} from './ids.ts'
+import { hintFailure, withModelErrorHint } from './model-error-hint.ts'
+import type { PiLoginSession } from './session.ts'
+import { openRouterDefaultEffort } from './openrouter-models.ts'
+import { OPENROUTER_ROUTE } from './openrouter-types.ts'
+import { filterHostedServerToolTraces, nativePlanForRoute } from './native-tools.ts'
+import type { NativeToolPolicy } from './native-tools.ts'
+
+export interface PiLoginAdapterOptions {
+  streamIdleTimeoutMs?: number
+  retryPolicy?: RetryPolicyConfig
+}
+
+/** Keep provider failures routable for both direct and snapshot-prepared requests. */
+async function* withFailureHints(source: AsyncIterable<StreamChunk>, provider: string): AsyncIterable<StreamChunk> {
+  try {
+    for await (const chunk of source) {
+      if (chunk.type === 'finish' && chunk.reason.kind === 'error') {
+        yield { ...chunk, reason: { ...chunk.reason, failure: hintFailure(chunk.reason.failure, provider) } }
+      } else {
+        yield chunk
+      }
+    }
+  } catch (error: unknown) {
+    throw withModelErrorHint(error, provider)
+  }
+}
+
+/**
+ * Official Pi adapter plus bounded provider compatibility and Chat copy.
+ * `dsh-llm-retry` owns the attempt budget and routes on `code`. Finish chunks
+ * and thrown errors receive the same route-specific correction and hint.
+ */
+class PiLoginAdapter extends PiAiAdapter {
+  constructor(
+    config: BasePiAiAdapterOptions,
+    private readonly native: NativeToolPolicy,
+    private readonly resolveAttachments: () => AttachmentStore | undefined,
+    private readonly session: PiLoginSession,
+  ) {
+    super(config)
+  }
+
+  override resolveModel(
+    provider: string,
+    model: string,
+    signal?: AbortSignal,
+  ): Promise<LlmResolvedModelInfo> {
+    return super.resolveModel(provider, model, signal).then((info) => {
+      const defaultEffort = this.defaultEffort(provider, model)
+      if (defaultEffort === undefined || info.reasoning === undefined) return info
+      return {
+        ...info,
+        reasoning: {
+          ...info.reasoning,
+          defaultEffort: ReasoningEffortId(defaultEffort),
+        },
+      }
+    })
+  }
+
+  private defaultEffort(provider: string, model: string): string | undefined {
+    return (provider === OPENROUTER_ROUTE ? openRouterDefaultEffort(this.session.openRouter.model(model)) : undefined)
+      ?? defaultReasoningEffortFor(model)
+  }
+
+  private sanitize(options: GenerateOptions): GenerateOptions {
+    const defaultEffort = this.defaultEffort(options.provider, options.model)
+    return {
+      ...options,
+      messages: stripAssistantImages(options.messages),
+      ...options.reasoningEffort === undefined && defaultEffort !== undefined
+        ? { reasoningEffort: ReasoningEffortId(defaultEffort) }
+        : {},
+    }
+  }
+
+  /**
+   * Live `llm.stream` dispatches `prepareCall().stream`, not `adapter.stream()`.
+   * Hosted X Search / web_search traces must be stripped on that path too,
+   * or Harness executes them as UNKNOWN_TOOL.
+   */
+  private async * decorateStream(
+    options: GenerateOptions,
+    source: AsyncIterable<StreamChunk>,
+  ): AsyncIterable<StreamChunk> {
+    const capture: HostedCapture = { images: [] }
+    try {
+      const raw = iterateInCapture(capture, this.session.proxy.iterate(
+        source,
+        options.provider === 'pi-openai-codex' && options.sessionId !== undefined
+          ? String(options.sessionId)
+          : undefined,
+      ))
+      const spec = piLoginProviderByRoute(options.provider)
+      const api = spec === undefined
+        ? undefined
+        : this.session.visibleModels(spec.id).find(model => model.id === options.model)?.api
+      const plan = nativePlanForRoute(options.provider, api, this.native)
+      const filtered = plan === undefined ? raw : filterHostedServerToolTraces(raw)
+      const attachments = this.native.image ? this.resolveAttachments() : undefined
+      const decorated = attachments === undefined
+        ? filtered
+        : injectHostedImages(filtered, capture, input => attachments.saveImage(input))
+      yield* withFailureHints(decorated, options.provider)
+    } catch (error: unknown) {
+      throw withModelErrorHint(error, options.provider)
+    }
+  }
+
+  override async prepareCall(provider: string, model: string, signal?: AbortSignal): Promise<PreparedAdapterCall> {
+    const prepared = await this.session.proxy.run(() => super.prepareCall(provider, model, signal))
+    return {
+      ...prepared,
+      stream: options => {
+        const sanitized = this.sanitize(options)
+        return this.decorateStream(sanitized, prepared.stream(sanitized))
+      },
+    }
+  }
+
+  override async * stream(options: GenerateOptions): AsyncIterable<StreamChunk> {
+    const sanitized = this.sanitize(options)
+    yield* this.decorateStream(sanitized, super.stream(sanitized))
+  }
+}
+
+export function createPiLoginAdapter(
+  session: PiLoginSession,
+  resolveAttachments: () => AttachmentStore | undefined,
+  options: PiLoginAdapterOptions = {},
+): PiAiAdapter {
+  const streamIdleTimeoutMs = options.streamIdleTimeoutMs ?? PI_LOGIN_STREAM_IDLE_TIMEOUT_MS
+  const retryPolicy = resolveRetryPolicy(options.retryPolicy, 'dsh-oauth-login retryPolicy')
+  const requestImageLimits = {
+    requestImagePixelBudget: 2048 * 2048,
+    requestImageMaxBytes: 1024 * 1024,
+  }
+  const auth = {
+    auth: {
+      credentials: session.store,
+      authContext: defaultProviderAuthContext(),
+    },
+  }
+  return new PiLoginAdapter({
+    profiles: () => {
+      const profiles = new Map<string, ResolvedPiAiProviderProfile>()
+      for (const spec of PI_LOGIN_PROVIDERS) {
+        profiles.set(spec.route, {
+          provider: spec.route,
+          displayName: spec.displayName,
+          streamIdleTimeoutMs,
+          maxRequestImageBytes: PI_LOGIN_MAX_REQUEST_IMAGE_BYTES,
+          ...requestImageLimits,
+          retryPolicy,
+          configuredMaxTokens: new Map(),
+          modelErrors: new Map(),
+          piProvider: session.provider(spec.id),
+        })
+      }
+      return profiles
+    },
+    resolveApiKey: async (route) => {
+      await session.ensureTransport()
+      const spec = piLoginProviderByRoute(route)
+      if (spec === undefined) {
+        throw new LlmError(`dsh-oauth-login: unknown route "${route}"`, 'MISSING_CREDENTIAL')
+      }
+      const auth = await session.models.getAuth(spec.id)
+      const apiKey = auth?.auth.apiKey
+      if (apiKey === undefined || apiKey.length === 0) {
+        throw new LlmError(
+          `${spec.displayName} is not connected. Open Settings → Subscription Login and connect it.`,
+          'MISSING_CREDENTIAL',
+        )
+      }
+      return apiKey
+    },
+    resolveAttachments,
+    ...auth,
+  }, session.native, resolveAttachments, session)
+}