dsh-opendesign-corouter 0.1.3 → 0.1.4

package/README.md

@@ -32,7 +32,7 @@ dsh plugin --profile web add dsh-opendesign-corouter
 也可打开 [Actions → CI](https://github.com/KouzakiUmi/dsh-opendesign-corouter/actions/workflows/ci.yml)，从成功构建下载 **`dsh-opendesign-corouter-build`** artifact。登录 GitHub 后解压 ZIP，取得 `.tgz` 与 `.sha256`，再安装本地包：
 
 ```console
-dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.2.tgz
+dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.4.tgz
 ```
 
 `web` 只是示例，请替换为目标 Profile。Desktop 使用桌面安装器提供的 `dsh` 入口；独立公共 CLI 不能代管保留的 `desktop` Profile。安装后的启用与重载按目标 DSH 的管理流程进行。
@@ -40,11 +40,11 @@ dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.2.tgz
 ### 2. 配置连接
 
 1. 打开 **设置 → OpenDesign CoRouter → 连接与登录**。
-2. 为推理配置 CoRouter 工作空间 **API Key**，或沿用启动环境中的 `COROUTER_API_KEY`。
-3. 额度默认读取桌面登录态；没有桌面端时，点击 **登录并保存会话**，在官方页面自行完成登录。
+2. 点击 **开始设备授权**，再用常用浏览器 **打开授权页**，核对授权码并确认；也可单独配置工作空间 API Key 或沿用 `COROUTER_API_KEY`。
+3. 返回设置页等待保存成功。额度默认优先读取桌面登录态；要明确使用设备授权的账号，可关闭桌面优先。
 4. 回到模型选择器，选择 **OpenDesign CoRouter · 套餐赠送** 或 **OpenDesign CoRouter · 付费模型**。
 
-**API Key 用于推理，桌面 / 控制台会话用于查额度。两者不能互相代替。** [完整连接说明](docs/usage.md)
+**设备授权同时取得查额度和官方网关推理的两类令牌；显式配置的 API Key 仍优先。** [完整连接说明](docs/usage.md)
 
 ## 功能预览
 
@@ -72,7 +72,7 @@ dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.2.tgz
 
 ### 桌面优先，也能独立登录
 
-不复制或修改桌面配置。独立登录使用临时 Chrome 窗口，用户亲自完成官方登录与人机验证；验证通过才保存到 DSH 凭据服务。支持取消、超时和卸载清理，不触碰日常浏览器。
+独立登录采用设备授权，在常用浏览器打开普通官方授权页，沿用现有配置、密码管理器和自动填充。确认后设备令牌保存到 DSH 凭据服务；取消、超时和卸载停止轮询，不关闭用户浏览器，也不修改桌面配置。
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="docs/previews/theme-dark.png">
@@ -98,7 +98,7 @@ dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.2.tgz
 | 目标 DSH Core | `0.2.1-rc.3`，以官方同版本发布包验证 |
 | Core 声明范围 | `>=0.2.1-rc.3 <0.3.0-0`，范围内其他版本不代表已实测 |
 | Node.js | `>=24.9.0` |
-| 独立登录 | 本机 Google Chrome；插件不会自动下载 |
+| 独立登录 | 能访问官方授权页的常用浏览器；无需浏览器自动化或扩展 |
 | 默认推理接口 | `https://amr-link.open-design.ai/v1/chat/completions` |
 
 CI 在 Windows 与 Ubuntu 执行构建、类型检查及隔离测试；Ubuntu 另执行四页签浏览器和亮暗主题检查。通过 CI 不等于已安装或已通过真实账号验收。[开发与验证范围](docs/development.md)

package/SECURITY.md

@@ -1,11 +1,12 @@
 # 安全边界
 
 - 推理、桌面控制面和控制台 Cookie 分属独立通道，不互相替代鉴权材料。
-- API Key 与独立登录 Cookie 仅经 DSH 凭据服务写入插件专属记录；设置页只读取存在性和状态，不回填秘密。
+- API Key 与设备授权的 controlKey / runtimeKey 仅经 DSH 凭据服务写入插件专属记录；设置页只读取存在性和状态，不回填秘密。
 - 桌面配置只读。仅支持已核实的生产环境，控制令牌只能发送到 `https://amr-api.open-design.ai`。控制台和推理请求禁止自动跟随重定向。
+- 设备授权双令牌原子保存；runtimeKey 只自动提供给请求快照中的官方推理 origin，controlKey 只发往官方控制面。旧 Cookie grant 保留只读兼容。
 - 推理自定义地址由用户显式配置；除本机回环外要求 HTTPS，拒绝 URL 内嵌凭据、查询串与片段。
 - 额度分池不跨身份混合。桌面认证失效时，可回退到单独保存的控制台登录；权限不足和未知额度不伪装成 0。
-- 独立登录使用临时浏览器上下文。用户自行完成登录和验证；取消、超时和卸载关闭插件拥有的窗口。持久化成功是不可撤回的提交边界，之后取消不会假称已撤回。
+- 独立登录使用设备授权，普通浏览器仅打开官方激活页；插件不启动浏览器自动化、不读取浏览器配置或 Cookie。deviceSecret 只在 Host 内存用于轮询；授权码、激活链接和到期时间仅在等待期提供给 UI。取消、超时和卸载中止请求，不关闭用户浏览器。持久化成功是不可撤回的提交边界，之后取消不会假称已撤回。
 - `OPENDESIGN_VELA_PATH` 是用户信任的本地程序路径。插件仅以固定 argv 执行只读查询，不通过 shell；不校验该程序的签名或下载它。不要将此变量指向来源不明的程序。
 - RPC 使用严格白名单解析；原始错误正文、Cookie、请求头、Key 和桌面本地路径不进入状态返回。并发保存有版本冲突检测。
 - 请求、流空闲、额度接口、CLI、登录和 RPC 均有有界超时。停用插件会撤销 Provider / RPC 并中止自身请求。

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # 第三方代码与资料
 
-本项目的消息/图片兼容处理、套餐模型元数据参考 [dsh-opendesign-go 0.1.9](https://github.com/EliteOtaku/dsh-opendesign-go)。额度归一化和临时浏览器登录流程改编自 [dsh-subusage 0.16.2](https://github.com/KouzakiUmi/dsh-subusage)。空轮判定参考 [dsh-empty-turn-guard 0.4.0](https://github.com/FYTXY/dsh-empty-turn-guard)。设置布局参考 [dsh-code-pill](https://github.com/KouzakiUmi/dsh-code-pill)。
+本项目的消息/图片兼容处理、套餐模型元数据参考 [dsh-opendesign-go 0.1.9](https://github.com/EliteOtaku/dsh-opendesign-go)。额度归一化及登录生命周期的基础处理改编自 [dsh-subusage 0.16.2](https://github.com/KouzakiUmi/dsh-subusage)。空轮判定参考 [dsh-empty-turn-guard 0.4.0](https://github.com/FYTXY/dsh-empty-turn-guard)。设置布局参考 [dsh-code-pill](https://github.com/KouzakiUmi/dsh-code-pill)。
 
 离线主题夹具使用 [DeepSeek Harness 官方主题令牌](https://github.com/deepseek-ai/deepseek-harness/blob/22ddee3792402c3e70ec5f86a63c3e3e895a2f60/packages/client/ui-theme/src/styles/design-platform.css)，仅供测试，不随插件安装包分发。
 

package/lib/adapter.d.ts

@@ -5,7 +5,7 @@ import { type RuntimeConfig } from './config.js';
 export interface AdapterOptions {
     config(): RuntimeConfig;
     models?(): readonly CatalogModel[];
-    apiKey(ref: string): Promise<string | undefined>;
+    apiKey(ref: string, baseURL?: string): Promise<string | undefined>;
     imageDataUrl?(image: ImageAttachmentRef, signal: AbortSignal): Promise<string | undefined>;
     onEmptyTurn?(): void;
     fetch?: typeof fetch;

package/lib/auth.d.ts

@@ -77,11 +77,22 @@ export interface DesktopDeps {
  */
 export declare function readDesktopCredential(deps?: DesktopDeps): Promise<DesktopRead>;
 /** Cookie payload persisted through the credential seam as a `grant` record. */
-export interface LoginGrant {
+export interface CookieLoginGrant {
     cookie: string;
-    /** Epoch ms; `0`/absent means the console declared no expiry. */
+    /** Legacy cookie expiry only; never applied to device tokens. */
     expiresAt?: number;
 }
+export interface DeviceLoginGrant {
+    kind: 'device';
+    controlKey: string;
+    runtimeKey: string;
+    savedAt?: string;
+}
+export type LoginGrant = CookieLoginGrant | DeviceLoginGrant;
+/** Validate both keys as one snapshot; never combine an incomplete grant with another source. */
+export declare function deviceGrant(value: unknown): DeviceLoginGrant | undefined;
+/** Device runtime credentials may only reach this exact HTTPS origin, never a custom gateway. */
+export declare function isOfficialRuntimeUrl(raw: string): boolean;
 export type AuthSource = 'desktop' | 'login' | 'environment';
 export interface AuthSession extends Session {
     source: SessionSource;
@@ -112,11 +123,15 @@ export interface AuthDeps extends DesktopDeps {
 }
 /** Desktop `controlKey` as a Bearer header (daemon evidence: `/api/v1/wallet/balance`). */
 export declare function desktopSession(credential: DesktopCredential, apiUrl?: string): AuthSession;
+/** Device control token: Bearer on the official control plane only. No inferred token expiry. */
+export declare function deviceSession(tokens: {
+    controlKey: string;
+} | string): AuthSession;
 /** A persisted or environment-supplied console cookie as a `cookie` header. */
 export declare function cookieSession(cookie: string, source: SessionSource, apiUrl?: string): AuthSession | undefined;
 /**
  * Resolve the session in the order the user asked for: **desktop first**, then the
- * cookie saved by this plugin's own login, then environment references.
+ * device grant saved by this plugin, then legacy cookies and environment references.
  *
  * A desktop config whose `apiUrl` is not an official origin is *skipped*, not used: the
  * token must not travel to a host the plugin cannot vouch for. The skip is reported as a

package/lib/client.d.ts

@@ -1,7 +1,7 @@
 import * as React from 'react';
 import openDesignCoRouterRemote, { type CoRouterRemote } from './generated/typert.remote-client.js';
 import type { TypertClientRemote } from '@deepseek-ai/dsh-typert-protocol';
-import { type Status, type StatusModel } from './remote.js';
+import { type LoginState, type Status, type StatusModel } from './remote.js';
 import type { QuotaSnapshot, QuotaWindow } from './quota.js';
 import { type ApiProtocol } from './protocol-options.js';
 import type { ModelSettings, ModelSettingsMap } from './model-settings.js';
@@ -183,6 +183,13 @@ export interface AdvancedProps {
 export declare function Advanced({ status, formSnapshot, setFormField, pendingField }: AdvancedProps): React.FunctionComponentElement<{
     children?: React.ReactNode | undefined;
 }>;
+/** Approval opens through an ordinary link; no browser profile is created or controlled. */
+export declare function LoginApproval({ login }: {
+    login: LoginState | undefined;
+}): React.DetailedReactHTMLElement<{
+    className: string;
+    'aria-label': string;
+}, HTMLElement> | null;
 export declare function tabAfter(current: TabId, key: string): TabId | undefined;
 export declare function SettingsPage({ caller, form }: SettingsProps): React.DetailedReactHTMLElement<{
     className: string;

package/lib/client.js

@@ -32,6 +32,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   Advanced: () => Advanced,
+  LoginApproval: () => LoginApproval,
   ModelRow: () => ModelRow,
   Models: () => Models,
   Overview: () => Overview,
@@ -19925,6 +19926,27 @@ function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/device-auth.ts
+function validateActivationUrl(value, userCode) {
+  if (typeof value !== "string" || value.length > 512 || !/^https:\/\/open-design\.ai\/cloud\/cli\/activate(?:\?[^#]*)?$/u.test(value) || /[\s\\]/u.test(value)) return null;
+  try {
+    const url2 = new URL(value);
+    if (url2.origin !== "https://open-design.ai" || url2.pathname !== "/cloud/cli/activate" || url2.username || url2.password || url2.hash) return null;
+    const entries = [...url2.searchParams];
+    if (entries.length > 1) return null;
+    if (entries.length) {
+      const entry = entries[0];
+      if (!["code", "user_code"].includes(entry[0]) || !validUserCode(entry[1]) || userCode !== void 0 && entry[1] !== userCode) return null;
+    }
+    return url2.href;
+  } catch {
+    return null;
+  }
+}
+function validUserCode(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]{3,31}$/iu.test(value);
+}
+
 // src/protocol-options.ts
 var API_PROTOCOL_IDS = ["chat-completions", "responses", "messages"];
 function openAiBaseURL(baseURL) {
@@ -20086,9 +20108,19 @@ function parseLoginState(value) {
   if (!record2(value)) throw new Error("\u767B\u5F55\u72B6\u6001\u5FC5\u987B\u662F\u5BF9\u8C61");
   const jobId = value.jobId;
   if (jobId !== null && jobId !== void 0 && typeof jobId !== "string") throw new Error("\u767B\u5F55\u4EFB\u52A1 id \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6216 null");
+  const state = member(value.state, LOGIN_PHASES, "\u767B\u5F55\u9636\u6BB5");
+  let approval = {};
+  if (state === "waiting" && (value.activationUrl !== void 0 || value.userCode !== void 0 || value.expiresAt !== void 0)) {
+    const userCode = text(value.userCode, "\u8BBE\u5907\u6388\u6743\u7801", 64);
+    if (!/^[A-Za-z0-9-]+$/u.test(userCode)) throw new Error("\u8BBE\u5907\u6388\u6743\u7801\u683C\u5F0F\u65E0\u6548");
+    const activationUrl = validateActivationUrl(value.activationUrl, userCode);
+    if (activationUrl === null) throw new Error("\u8BBE\u5907\u6388\u6743\u94FE\u63A5\u65E0\u6548");
+    approval = { activationUrl, userCode, expiresAt: isoTime(value.expiresAt, "\u8BBE\u5907\u6388\u6743\u5230\u671F\u65F6\u95F4") };
+  }
   return {
     jobId: typeof jobId === "string" && jobId.length > 0 ? text(jobId, "\u767B\u5F55\u4EFB\u52A1 id", MAX_JOB_ID) : null,
-    state: member(value.state, LOGIN_PHASES, "\u767B\u5F55\u9636\u6BB5"),
+    state,
+    ...approval,
     ...value.message === void 0 ? {} : { message: text(value.message, "\u767B\u5F55\u8BF4\u660E", MAX_MESSAGE) },
     ...value.startedAt === void 0 ? {} : { startedAt: isoTime(value.startedAt, "\u767B\u5F55\u5F00\u59CB\u65F6\u95F4") },
     ...value.finishedAt === void 0 ? {} : { finishedAt: isoTime(value.finishedAt, "\u767B\u5F55\u7ED3\u675F\u65F6\u95F4") }
@@ -20208,10 +20240,10 @@ var MAX_CONTEXT_WINDOW = 1e8;
 var GENERIC_ERROR = "\u64CD\u4F5C\u672A\u5B8C\u6210\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002";
 var LOGIN_LABELS = {
   idle: "\u5C1A\u672A\u5F00\u59CB\u72EC\u7ACB\u767B\u5F55",
-  launching: "\u6B63\u5728\u6253\u5F00\u5B98\u65B9\u767B\u5F55\u9875\u9762\u2026",
-  waiting: "\u7B49\u5F85\u4F60\u5728\u5B98\u65B9\u9875\u9762\u5B8C\u6210\u767B\u5F55\u2026",
-  verifying: "\u6B63\u5728\u9A8C\u8BC1\u5E76\u4FDD\u5B58\u4F1A\u8BDD\u2026",
-  success: "\u767B\u5F55\u6210\u529F\uFF0C\u4F1A\u8BDD\u5DF2\u4FDD\u5B58\u3002",
+  launching: "\u6B63\u5728\u7533\u8BF7\u8BBE\u5907\u6388\u6743\u7801\u2026",
+  waiting: "\u8BF7\u6253\u5F00\u6388\u6743\u9875\uFF0C\u5728\u5E38\u7528\u6D4F\u89C8\u5668\u4E2D\u786E\u8BA4\u672C\u6B21\u767B\u5F55\u3002",
+  verifying: "\u6B63\u5728\u4FDD\u5B58\u8BBE\u5907\u6388\u6743\u2026",
+  success: "\u767B\u5F55\u6210\u529F\uFF0C\u8BBE\u5907\u6388\u6743\u5DF2\u4FDD\u5B58\u3002",
   cancelled: "\u5DF2\u53D6\u6D88\u672C\u6B21\u767B\u5F55\u3002",
   error: "\u767B\u5F55\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5\u3002"
 };
@@ -20531,7 +20563,7 @@ function Overview({ status, busy, onRefresh, nextAutoRefreshAt, refreshIntervalS
         "div",
         null,
         h("h3", null, "\u5148\u5B8C\u6210\u8FDE\u63A5"),
-        h("p", { className: "odc-hint" }, status.apiKeyConfigured === false ? "\u63A8\u7406\u5C1A\u7F3A API Key\uFF1B\u989D\u5EA6\u767B\u5F55\u4E0E\u63A8\u7406\u51ED\u636E\u5206\u522B\u914D\u7F6E\u3002" : "API Key \u5DF2\u914D\u7F6E\uFF1B\u767B\u5F55\u540E\u5373\u53EF\u67E5\u770B\u8D26\u53F7\u989D\u5EA6\u3002")
+        h("p", { className: "odc-hint" }, status.apiKeyConfigured === false ? "\u5C1A\u65E0\u5F53\u524D\u7F51\u5173\u7684\u63A8\u7406\u51ED\u636E\uFF1B\u53EF\u5B8C\u6210\u8BBE\u5907\u6388\u6743\u6216\u5355\u72EC\u914D\u7F6E API Key\u3002" : "API Key \u5DF2\u914D\u7F6E\uFF1B\u767B\u5F55\u540E\u5373\u53EF\u67E5\u770B\u8D26\u53F7\u989D\u5EA6\u3002")
       ),
       onConnection === void 0 ? null : h("button", { type: "button", className: "odc-button odc-button-primary", onClick: onConnection }, "\u524D\u5F80\u8FDE\u63A5\u4E0E\u767B\u5F55")
     ) : null,
@@ -21069,6 +21101,24 @@ function Switch({ checked, disabled, label, hint, onChange }) {
 function loginInFlight(state) {
   return state === "launching" || state === "waiting" || state === "verifying";
 }
+function LoginApproval({ login }) {
+  if (login?.state !== "waiting" || login.userCode === void 0 || login.expiresAt === void 0) return null;
+  const url2 = validateActivationUrl(login.activationUrl, login.userCode);
+  if (url2 === null) return null;
+  return h(
+    "div",
+    { className: "odc-readonly", "aria-label": "\u8BBE\u5907\u6388\u6743" },
+    h("span", { className: "odc-label" }, "\u6838\u5BF9\u6388\u6743\u7801"),
+    h("code", { className: "odc-metric-value", "aria-label": "\u8BBE\u5907\u6388\u6743\u7801" }, login.userCode),
+    h(
+      "div",
+      { className: "odc-actions" },
+      h("a", { className: "odc-button odc-button-primary", href: url2, target: "_blank", rel: "noreferrer noopener" }, "\u6253\u5F00\u6388\u6743\u9875")
+    ),
+    h("p", { className: "odc-hint" }, `\u6388\u6743\u7801\u6709\u6548\u81F3 ${formatTime(login.expiresAt)}\u3002\u5728\u5E38\u7528\u6D4F\u89C8\u5668\u786E\u8BA4\u540E\uFF0C\u8FD4\u56DE\u6B64\u9875\u67E5\u770B\u7ED3\u679C\u3002`),
+    h("p", { className: "odc-hint" }, "\u53EF\u53F3\u952E\u590D\u5236\u6388\u6743\u94FE\u63A5\u5230\u5E38\u7528\u6D4F\u89C8\u5668\uFF1B\u5BC6\u7801\u7BA1\u7406\u5668\u548C\u81EA\u52A8\u586B\u5145\u7531\u6D4F\u89C8\u5668\u6B63\u5E38\u63D0\u4F9B\u3002\u4EC5\u786E\u8BA4\u4F60\u672C\u4EBA\u53D1\u8D77\u7684\u6388\u6743\u3002")
+  );
+}
 function Connection({ status, formSnapshot, setFormField, pendingField, caller, loadStatus, refreshAfterLogin }) {
   const mounted = useMounted();
   const actionVersion = React.useRef(0);
@@ -21086,11 +21136,11 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
     if (status === void 0 || busy || keyBusy) return;
     const version2 = ++actionVersion.current;
     setBusy(true);
-    setNotice({ kind: "status", text: "\u6B63\u5728\u542F\u52A8\u5B98\u65B9\u767B\u5F55\u2026" });
+    setNotice({ kind: "status", text: "\u6B63\u5728\u7533\u8BF7\u8BBE\u5907\u6388\u6743\u2026" });
     try {
       const next = await caller("startLogin", { expectedRevision: status.revision });
       if (!mounted.current || version2 !== actionVersion.current) return;
-      setNotice({ kind: "status", text: "\u8BF7\u5728\u6253\u5F00\u7684\u5B98\u65B9\u9875\u9762\u4E2D\u4EB2\u81EA\u5B8C\u6210\u767B\u5F55\u3002" });
+      setNotice(null);
       await (next.state === "success" ? refreshAfterLogin() : loadStatus());
     } catch {
       if (mounted.current && version2 === actionVersion.current) setNotice({ kind: "error", text: "\u65E0\u6CD5\u542F\u52A8\u767B\u5F55\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002" });
@@ -21163,27 +21213,28 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
     h(
       "section",
       { className: "odc-card" },
-      h("h3", null, "\u72EC\u7ACB\u767B\u5F55"),
-      h("p", { className: "odc-hint" }, "\u767B\u5F55\u9700\u7531\u4F60\u5728\u5B98\u65B9\u9875\u9762\u4EB2\u81EA\u5B8C\u6210\uFF1B\u63D2\u4EF6\u4E0D\u4F1A\u4EE3\u586B\u8D26\u53F7\u6216\u5BC6\u7801\u3002\u9A8C\u8BC1\u901A\u8FC7\u540E\u624D\u4FDD\u5B58\u4F1A\u8BDD\u3002"),
+      h("h3", null, "\u8BBE\u5907\u6388\u6743\u767B\u5F55"),
+      h("p", { className: "odc-hint" }, "\u7533\u8BF7\u6388\u6743\u7801\u540E\uFF0C\u5728\u5E38\u7528\u6D4F\u89C8\u5668\u6253\u5F00\u5B98\u65B9\u6388\u6743\u9875\u3002\u6CBF\u7528\u5DF2\u6709\u767B\u5F55\u72B6\u6001\u3001\u5BC6\u7801\u7BA1\u7406\u5668\u548C\u81EA\u52A8\u586B\u5145\uFF1B\u786E\u8BA4\u540E\u81EA\u52A8\u4FDD\u5B58\u8BBE\u5907\u4EE4\u724C\uFF0C\u7528\u4E8E\u67E5\u8BE2\u989D\u5EA6\u53CA\u5B98\u65B9\u7F51\u5173\u63A8\u7406\u3002"),
       h(
         "div",
         { className: "odc-actions", style: { marginTop: 14 } },
         h("button", { className: "odc-button odc-button-primary", type: "button", disabled: status === void 0 || busy || keyBusy || inFlight, onClick: () => {
           void startLogin();
-        } }, "\u767B\u5F55\u5E76\u4FDD\u5B58\u4F1A\u8BDD"),
+        } }, "\u5F00\u59CB\u8BBE\u5907\u6388\u6743"),
         inFlight ? h("button", { className: "odc-button", type: "button", disabled: busy || keyBusy || login?.jobId == null, onClick: () => {
           void cancelLogin();
         } }, "\u53D6\u6D88\u767B\u5F55") : null,
         h("a", { className: "odc-link", href: OFFICIAL_SITE, target: "_blank", rel: "noreferrer noopener" }, "\u6253\u5F00 CoRouter \u5B98\u7F51")
       ),
-      h("p", { className: "odc-meta", role: state === "error" ? "alert" : "status" }, LOGIN_LABELS[state]),
+      h(LoginApproval, { login }),
+      h("p", { className: "odc-meta", role: state === "error" ? "alert" : "status" }, login?.message ?? LOGIN_LABELS[state]),
       h(NoticeView, { notice })
     ),
     h(
       "section",
       { className: "odc-card" },
-      h("h3", null, "API Key"),
-      h("p", { className: "odc-hint" }, status?.apiKeyConfigured === true ? "\u5DF2\u914D\u7F6E API Key\u3002\u4FDD\u5B58\u4EC5\u66FF\u6362\u672C\u63D2\u4EF6\u4FDD\u5B58\u7684 Key\uFF1B\u73AF\u5883\u53D8\u91CF\u6216\u5DF2\u6709\u51ED\u636E\u5F15\u7528\u4ECD\u4F18\u5148\u3002" : "\u5C1A\u672A\u914D\u7F6E API Key\uFF1B\u63A8\u7406\u9700\u8981 CoRouter Key\uFF0C\u989D\u5EA6\u767B\u5F55\u4E0D\u80FD\u4EE3\u66FF\u3002"),
+      h("h3", null, "API Key\uFF08\u53EF\u9009\u8986\u76D6\uFF09"),
+      h("p", { className: "odc-hint" }, status?.apiKeyConfigured === true ? "\u5F53\u524D\u7F51\u5173\u5DF2\u6709\u53EF\u7528\u63A8\u7406\u51ED\u636E\u3002\u4F18\u5148\u7EA7\uFF1A\u73AF\u5883\u6216\u51ED\u636E\u5F15\u7528 \u2192 \u624B\u52A8\u4FDD\u5B58\u7684 API Key \u2192 \u8BBE\u5907\u6388\u6743\u4EE4\u724C\u3002" : "\u5F53\u524D\u7F51\u5173\u5C1A\u65E0\u63A8\u7406\u51ED\u636E\u3002\u53EF\u5B8C\u6210\u8BBE\u5907\u6388\u6743\u4EE5\u4F7F\u7528\u5B98\u65B9\u7F51\u5173\uFF0C\u6216\u4E3A\u5F53\u524D\u7F51\u5173\u5355\u72EC\u4FDD\u5B58 API Key\u3002"),
       h(
         "form",
         { onSubmit: (event) => {

package/lib/device-auth.d.ts

@@ -0,0 +1,34 @@
+export interface DeviceTokens {
+    controlKey: string;
+    runtimeKey: string;
+}
+export declare const DEVICE_AUTH_ENDPOINT = "https://amr-api.open-design.ai/api/v1/cli/device-authorizations";
+export declare const DEVICE_AUTH_PLUGIN_VERSION = "0.1.4";
+export declare const DEVICE_REQUEST_TIMEOUT_MS = 20000;
+export declare const DEVICE_RESPONSE_MAX_BYTES = 65536;
+export declare const DEVICE_POLL_MIN_MS = 1000;
+export declare const DEVICE_POLL_MAX_MS = 300000;
+export declare class DeviceAuthError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+/** Strict public-link allowlist: only an optional, single, non-secret code is allowed. */
+export declare function validateActivationUrl(value: unknown, userCode?: string): string | null;
+export interface DeviceAuthorization {
+    deviceId: string;
+    deviceSecret: string;
+    userCode: string;
+    activationUrl: string;
+    pollMs: number;
+    expiresAt: number;
+}
+export declare function parseDeviceAuthorization(value: unknown): DeviceAuthorization;
+export type DevicePollResult = {
+    state: 'pending';
+} | {
+    state: 'success';
+    tokens: DeviceTokens;
+};
+export declare function parseDevicePoll(value: unknown): DevicePollResult;
+/** Bound fetch *and body consumption*, even if an injected transport ignores abort. */
+export declare function postDeviceJson(fetcher: typeof fetch, url: string, body: unknown, signal: AbortSignal, timeoutMs?: number): Promise<unknown>;

package/lib/generated/typert.host.js

@@ -7,6 +7,27 @@ function record(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/device-auth.ts
+function validateActivationUrl(value, userCode) {
+  if (typeof value !== "string" || value.length > 512 || !/^https:\/\/open-design\.ai\/cloud\/cli\/activate(?:\?[^#]*)?$/u.test(value) || /[\s\\]/u.test(value)) return null;
+  try {
+    const url = new URL(value);
+    if (url.origin !== "https://open-design.ai" || url.pathname !== "/cloud/cli/activate" || url.username || url.password || url.hash) return null;
+    const entries = [...url.searchParams];
+    if (entries.length > 1) return null;
+    if (entries.length) {
+      const entry = entries[0];
+      if (!["code", "user_code"].includes(entry[0]) || !validUserCode(entry[1]) || userCode !== void 0 && entry[1] !== userCode) return null;
+    }
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+function validUserCode(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]{3,31}$/iu.test(value);
+}
+
 // src/protocol-options.ts
 var API_PROTOCOL_IDS = ["chat-completions", "responses", "messages"];
 
@@ -155,9 +176,19 @@ function parseLoginState(value) {
   if (!record(value)) throw new Error("\u767B\u5F55\u72B6\u6001\u5FC5\u987B\u662F\u5BF9\u8C61");
   const jobId = value.jobId;
   if (jobId !== null && jobId !== void 0 && typeof jobId !== "string") throw new Error("\u767B\u5F55\u4EFB\u52A1 id \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6216 null");
+  const state = member(value.state, LOGIN_PHASES, "\u767B\u5F55\u9636\u6BB5");
+  let approval = {};
+  if (state === "waiting" && (value.activationUrl !== void 0 || value.userCode !== void 0 || value.expiresAt !== void 0)) {
+    const userCode = text(value.userCode, "\u8BBE\u5907\u6388\u6743\u7801", 64);
+    if (!/^[A-Za-z0-9-]+$/u.test(userCode)) throw new Error("\u8BBE\u5907\u6388\u6743\u7801\u683C\u5F0F\u65E0\u6548");
+    const activationUrl = validateActivationUrl(value.activationUrl, userCode);
+    if (activationUrl === null) throw new Error("\u8BBE\u5907\u6388\u6743\u94FE\u63A5\u65E0\u6548");
+    approval = { activationUrl, userCode, expiresAt: isoTime(value.expiresAt, "\u8BBE\u5907\u6388\u6743\u5230\u671F\u65F6\u95F4") };
+  }
   return {
     jobId: typeof jobId === "string" && jobId.length > 0 ? text(jobId, "\u767B\u5F55\u4EFB\u52A1 id", MAX_JOB_ID) : null,
-    state: member(value.state, LOGIN_PHASES, "\u767B\u5F55\u9636\u6BB5"),
+    state,
+    ...approval,
     ...value.message === void 0 ? {} : { message: text(value.message, "\u767B\u5F55\u8BF4\u660E", MAX_MESSAGE) },
     ...value.startedAt === void 0 ? {} : { startedAt: isoTime(value.startedAt, "\u767B\u5F55\u5F00\u59CB\u65F6\u95F4") },
     ...value.finishedAt === void 0 ? {} : { finishedAt: isoTime(value.finishedAt, "\u767B\u5F55\u7ED3\u675F\u65F6\u95F4") }

package/lib/generated/typert.remote-client.js

@@ -7,6 +7,27 @@ function record(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/device-auth.ts
+function validateActivationUrl(value, userCode) {
+  if (typeof value !== "string" || value.length > 512 || !/^https:\/\/open-design\.ai\/cloud\/cli\/activate(?:\?[^#]*)?$/u.test(value) || /[\s\\]/u.test(value)) return null;
+  try {
+    const url = new URL(value);
+    if (url.origin !== "https://open-design.ai" || url.pathname !== "/cloud/cli/activate" || url.username || url.password || url.hash) return null;
+    const entries = [...url.searchParams];
+    if (entries.length > 1) return null;
+    if (entries.length) {
+      const entry = entries[0];
+      if (!["code", "user_code"].includes(entry[0]) || !validUserCode(entry[1]) || userCode !== void 0 && entry[1] !== userCode) return null;
+    }
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+function validUserCode(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]{3,31}$/iu.test(value);
+}
+
 // src/protocol-options.ts
 var API_PROTOCOL_IDS = ["chat-completions", "responses", "messages"];
 
@@ -155,9 +176,19 @@ function parseLoginState(value) {
   if (!record(value)) throw new Error("\u767B\u5F55\u72B6\u6001\u5FC5\u987B\u662F\u5BF9\u8C61");
   const jobId = value.jobId;
   if (jobId !== null && jobId !== void 0 && typeof jobId !== "string") throw new Error("\u767B\u5F55\u4EFB\u52A1 id \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6216 null");
+  const state = member(value.state, LOGIN_PHASES, "\u767B\u5F55\u9636\u6BB5");
+  let approval = {};
+  if (state === "waiting" && (value.activationUrl !== void 0 || value.userCode !== void 0 || value.expiresAt !== void 0)) {
+    const userCode = text(value.userCode, "\u8BBE\u5907\u6388\u6743\u7801", 64);
+    if (!/^[A-Za-z0-9-]+$/u.test(userCode)) throw new Error("\u8BBE\u5907\u6388\u6743\u7801\u683C\u5F0F\u65E0\u6548");
+    const activationUrl = validateActivationUrl(value.activationUrl, userCode);
+    if (activationUrl === null) throw new Error("\u8BBE\u5907\u6388\u6743\u94FE\u63A5\u65E0\u6548");
+    approval = { activationUrl, userCode, expiresAt: isoTime(value.expiresAt, "\u8BBE\u5907\u6388\u6743\u5230\u671F\u65F6\u95F4") };
+  }
   return {
     jobId: typeof jobId === "string" && jobId.length > 0 ? text(jobId, "\u767B\u5F55\u4EFB\u52A1 id", MAX_JOB_ID) : null,
-    state: member(value.state, LOGIN_PHASES, "\u767B\u5F55\u9636\u6BB5"),
+    state,
+    ...approval,
     ...value.message === void 0 ? {} : { message: text(value.message, "\u767B\u5F55\u8BF4\u660E", MAX_MESSAGE) },
     ...value.startedAt === void 0 ? {} : { startedAt: isoTime(value.startedAt, "\u767B\u5F55\u5F00\u59CB\u65F6\u95F4") },
     ...value.finishedAt === void 0 ? {} : { finishedAt: isoTime(value.finishedAt, "\u767B\u5F55\u7ED3\u675F\u65F6\u95F4") }

package/lib/index.d.ts

@@ -4,6 +4,7 @@ import { fetchModelCatalog } from './model-discovery.js';
 import type { CatalogModel } from './catalog.js';
 import { readConfig, type LiveConfig } from './config.js';
 import { resolveSession } from './auth.js';
+import { type LoginOptions } from './login.js';
 import { readQuota, type QuotaSnapshot } from './quota.js';
 import { readDesktopQuota } from './desktop-quota.js';
 import { type Status, type LoginState, type StartLoginRequest, type CancelLoginRequest, type SaveApiKeyRequest } from './remote.js';
@@ -18,6 +19,7 @@ export interface HostDependencies {
     readDesktopQuota: typeof readDesktopQuota;
     fetchModels?: typeof fetchModelCatalog;
     modelsChanged?: () => void;
+    loginOptions?: LoginOptions;
 }
 export declare class OpenDesignCoRouterService extends TypertRemoteService {
     readonly dependencies: HostDependencies;
@@ -44,7 +46,9 @@ export declare class OpenDesignCoRouterService extends TypertRemoteService {
     modelCatalog(): readonly CatalogModel[];
     constructor(ctx: Context, config: () => ReturnType<typeof readConfig>, dependencies?: HostDependencies);
     private _credentials;
-    resolveApiKey(ref: string): Promise<string | undefined>;
+    private _key;
+    resolveApiKey(ref: string, baseURL?: string): Promise<string | undefined>;
+    private _invalidateModels;
     private _state;
     private _conflict;
     private _expect;