dsh-opendesign-corouter 0.1.4 → 0.1.5

package/README.md

@@ -32,7 +32,7 @@ dsh plugin --profile web add dsh-opendesign-corouter
 也可打开 [Actions → CI](https://github.com/KouzakiUmi/dsh-opendesign-corouter/actions/workflows/ci.yml)，从成功构建下载 **`dsh-opendesign-corouter-build`** artifact。登录 GitHub 后解压 ZIP，取得 `.tgz` 与 `.sha256`，再安装本地包：
 
 ```console
-dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.4.tgz
+dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.5.tgz
 ```
 
 `web` 只是示例，请替换为目标 Profile。Desktop 使用桌面安装器提供的 `dsh` 入口；独立公共 CLI 不能代管保留的 `desktop` Profile。安装后的启用与重载按目标 DSH 的管理流程进行。
@@ -40,7 +40,7 @@ dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.4.tgz
 ### 2. 配置连接
 
 1. 打开 **设置 → OpenDesign CoRouter → 连接与登录**。
-2. 点击 **开始设备授权**，再用常用浏览器 **打开授权页**，核对授权码并确认；也可单独配置工作空间 API Key 或沿用 `COROUTER_API_KEY`。
+2. 点击 **开始设备授权**，再用 **在新窗口打开授权页** 显示官方页面，核对授权码并确认；也可复制链接到你自己的常用浏览器，或单独配置工作空间 API Key / 沿用 `COROUTER_API_KEY`。
 3. 返回设置页等待保存成功。额度默认优先读取桌面登录态；要明确使用设备授权的账号，可关闭桌面优先。
 4. 回到模型选择器，选择 **OpenDesign CoRouter · 套餐赠送** 或 **OpenDesign CoRouter · 付费模型**。
 
@@ -72,7 +72,7 @@ dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.4.tgz
 
 ### 桌面优先，也能独立登录
 
-独立登录采用设备授权，在常用浏览器打开普通官方授权页，沿用现有配置、密码管理器和自动填充。确认后设备令牌保存到 DSH 凭据服务；取消、超时和卸载停止轮询，不关闭用户浏览器，也不修改桌面配置。
+独立登录采用设备授权，官方授权页可交给插件自己启动的临时 Chrome 窗口显示（不读取或改动你已有的浏览器配置），也可复制链接到你自己的浏览器沿用已有登录态、密码管理器和自动填充。确认后设备令牌保存到 DSH 凭据服务；取消、超时和卸载停止轮询并关闭临时窗口，不关闭你自己的浏览器，也不修改桌面配置。
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="docs/previews/theme-dark.png">

package/SECURITY.md

@@ -6,7 +6,7 @@
 - 设备授权双令牌原子保存；runtimeKey 只自动提供给请求快照中的官方推理 origin，controlKey 只发往官方控制面。旧 Cookie grant 保留只读兼容。
 - 推理自定义地址由用户显式配置；除本机回环外要求 HTTPS，拒绝 URL 内嵌凭据、查询串与片段。
 - 额度分池不跨身份混合。桌面认证失效时，可回退到单独保存的控制台登录；权限不足和未知额度不伪装成 0。
-- 独立登录使用设备授权，普通浏览器仅打开官方激活页；插件不启动浏览器自动化、不读取浏览器配置或 Cookie。deviceSecret 只在 Host 内存用于轮询；授权码、激活链接和到期时间仅在等待期提供给 UI。取消、超时和卸载中止请求，不关闭用户浏览器。持久化成功是不可撤回的提交边界，之后取消不会假称已撤回。
+- 独立登录使用设备授权。Host 可用 `playwright-core` 启动一个短暂的 Chrome 窗口显示官方激活页；这是插件自己创建的临时浏览器上下文，不创建、不驱动、不读取用户已有的浏览器配置或 Cookie，也不在该页面输入、点击或读取内容。由系统外壳拦截 `target="_blank"` 的宿主里，官方链接仍作为手动路径保留。deviceSecret 只在 Host 内存用于轮询；授权码、激活链接和到期时间仅在等待期提供给 UI，打开结果只返回固定代码，不返回 URL、浏览器句柄或错误正文。取消、超时和卸载中止请求，并有界请求关闭该临时窗口（每阶段最多约 5 秒，超时为尽力清理）；不关闭用户自己的浏览器。持久化成功是不可撤回的提交边界，之后取消不会假称已撤回。
 - `OPENDESIGN_VELA_PATH` 是用户信任的本地程序路径。插件仅以固定 argv 执行只读查询，不通过 shell；不校验该程序的签名或下载它。不要将此变量指向来源不明的程序。
 - RPC 使用严格白名单解析；原始错误正文、Cookie、请求头、Key 和桌面本地路径不进入状态返回。并发保存有版本冲突检测。
 - 请求、流空闲、额度接口、CLI、登录和 RPC 均有有界超时。停用插件会撤销 Provider / RPC 并中止自身请求。

package/THIRD_PARTY_NOTICES.md

@@ -1,11 +1,32 @@
 # 第三方代码与资料
 
-本项目的消息/图片兼容处理、套餐模型元数据参考 [dsh-opendesign-go 0.1.9](https://github.com/EliteOtaku/dsh-opendesign-go)。额度归一化及登录生命周期的基础处理改编自 [dsh-subusage 0.16.2](https://github.com/KouzakiUmi/dsh-subusage)。空轮判定参考 [dsh-empty-turn-guard 0.4.0](https://github.com/FYTXY/dsh-empty-turn-guard)。设置布局参考 [dsh-code-pill](https://github.com/KouzakiUmi/dsh-code-pill)。
+本项目的消息/图片兼容处理、套餐模型元数据参考 [dsh-opendesign-go 0.1.9](https://github.com/EliteOtaku/dsh-opendesign-go)。额度归一化及登录生命周期的基础处理改编自 [dsh-subusage 0.16.2](https://github.com/KouzakiUmi/dsh-subusage)；临时授权窗口的 Chrome 启动策略改编自 [dsh-subusage 0.16.3](https://github.com/KouzakiUmi/dsh-subusage) 的 `lib/cookie-login.js`。空轮判定参考 [dsh-empty-turn-guard 0.4.0](https://github.com/FYTXY/dsh-empty-turn-guard)。设置布局参考 [dsh-code-pill](https://github.com/KouzakiUmi/dsh-code-pill)。
 
 离线主题夹具使用 [DeepSeek Harness 官方主题令牌](https://github.com/deepseek-ai/deepseek-harness/blob/22ddee3792402c3e70ec5f86a63c3e3e895a2f60/packages/client/ui-theme/src/styles/design-platform.css)，仅供测试，不随插件安装包分发。
 
 Client bundle 内含 [Zod 4.6.6](https://github.com/colinhacks/zod) 与 DSH 协议辅助代码，分别保留 Colin McDonnell 与 DeepSeek 的 MIT 声明。
 
+Host 侧运行时依赖 [playwright-core 1.63.0](https://github.com/microsoft/playwright)（Apache-2.0），只用于启动显示官方授权页的临时 Chrome 窗口：不下载浏览器，使用本机已安装的 Chrome。它按 npm 依赖安装，不并入本项目源码。
+
+```text
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Copyright (c) Microsoft Corporation.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+```
+
 以上项目为 MIT 许可。保留如下版权和许可声明，适用于相应移植与改编部分：
 
 ```text

package/lib/browser-open.d.ts

@@ -0,0 +1,104 @@
+/** Bounds on one navigation; the window stays open for the user afterwards. */
+export declare const ACTIVATION_NAVIGATE_TIMEOUT_MS = 15000;
+/**
+ * End-to-end budget for one open request: launch + newPage + navigate. Kept below the
+ * client's 30 s RPC wait so a successful open is reported to the user, not a timeout.
+ */
+export declare const ACTIVATION_OPEN_BUDGET_MS = 20000;
+/** Bound on closing a window; a wedged browser must not pin disposal. */
+export declare const ACTIVATION_CLOSE_TIMEOUT_MS = 5000;
+/** Why the window could not be offered. Codes are public; no URL or error text is echoed. */
+export type ActivationOpenCode = 'opened' | 'invalid-url' | 'unavailable' | 'failed';
+export interface ActivationOpenResult {
+    code: ActivationOpenCode;
+    /** True only when a Chrome window is showing the activation page. */
+    opened: boolean;
+}
+/** The subset of playwright-core this module uses, so tests can inject a stand-in. */
+export interface ActivationPage {
+    goto(url: string, options: {
+        waitUntil: 'domcontentloaded';
+        timeout: number;
+    }): Promise<unknown>;
+    /** playwright's Page.close(); default does not run unload handlers. */
+    close?(): Promise<void>;
+}
+export interface ActivationBrowser {
+    close(): Promise<unknown>;
+    isConnected(): boolean;
+    newPage(): Promise<ActivationPage>;
+    on?(event: 'disconnected', listener: () => void): unknown;
+}
+export interface ActivationLauncherOptions {
+    /** Injected for offline tests; production resolves playwright-core lazily. */
+    launch?: () => Promise<ActivationBrowser>;
+    timeoutMs?: number;
+    /** Reports whether a launch is even possible, e.g. a missing Chrome install. */
+    available?: () => boolean;
+}
+/**
+ * Chrome without the automation flag subusage found counterproductive on guarded pages.
+ * `chromiumSandbox: true` is explicit on purpose: playwright otherwise appends
+ * `--no-sandbox` (verified in playwright-core 1.63.0), and this window renders a page
+ * this plugin does not control.
+ */
+export declare function chromeLaunchOptions(): {
+    channel: "chrome";
+    headless: boolean;
+    chromiumSandbox: boolean;
+    ignoreDefaultArgs: string[];
+    args: string[];
+};
+export declare class ActivationLauncher {
+    private browser;
+    private page;
+    private pending;
+    private disposal;
+    /** In-flight window closure, shared so disposal can join it. */
+    private closing;
+    /** Closures of handles that were never adopted; disposal joins them too. */
+    private tracked;
+    /** Chrome starts in flight, so disposal waits for the handle they will produce. */
+    private starting;
+    private disposed;
+    /** Bumped by `close()`: an attempt from an older session must not resurrect a window. */
+    private session;
+    private readonly options;
+    constructor(options?: ActivationLauncherOptions);
+    /**
+     * Show `url` in the temporary window, reusing one already open. Concurrent calls share
+     * a single attempt: the caller's button stays honest about what actually happened.
+     */
+    open(url: string): Promise<ActivationOpenResult>;
+    /**
+     * Close the temporary window and stay usable: a cancelled or expired job takes its
+     * window away, while the next login may open a new one.
+     */
+    close(): Promise<void>;
+    /**
+     * Retire the launcher for good. Cleanup is best-effort and bounded: it joins in-flight
+     * starts and closures, but a browser that ignores `close()` may outlive the 5 s wait.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Close the window this launcher owns right now. Ownership is taken before the async
+     * close, so a job that adopts a new window afterwards is not affected by this closure.
+     * The closure promise is shared so a later `dispose()` joins it.
+     */
+    private closeCurrent;
+    private attempt;
+    /** The job that started this attempt ended, or the launcher retired. */
+    private stale;
+    private ensureBrowser;
+    private ensurePage;
+    /** A handle that arrived too late is closed, and still counts as work disposal joins. */
+    private trackClose;
+    private trackPageClose;
+    private adopt;
+    /**
+     * Bound one launch step by the attempt's shared deadline. A step that settles only
+     * after that deadline still hands its handle back: dropping it would leak a Chrome
+     * process nobody can close.
+     */
+    private bounded;
+}

package/lib/client.d.ts

@@ -183,9 +183,15 @@ export interface AdvancedProps {
 export declare function Advanced({ status, formSnapshot, setFormField, pendingField }: AdvancedProps): React.FunctionComponentElement<{
     children?: React.ReactNode | undefined;
 }>;
-/** Approval opens through an ordinary link; no browser profile is created or controlled. */
-export declare function LoginApproval({ login }: {
+/** Approval is an ordinary official link; the Host may also show it in a temporary window. */
+export declare function LoginApproval({ login, onOpen, opening, notice }: {
     login: LoginState | undefined;
+    onOpen?: () => void;
+    opening?: boolean;
+    notice?: {
+        kind: 'status' | 'error';
+        text: string;
+    } | null;
 }): React.DetailedReactHTMLElement<{
     className: string;
     'aria-label': string;

package/lib/client.js

@@ -20021,6 +20021,7 @@ var MAX_API_KEY = 16384;
 var HTTP_ASCII = /^[\x21-\x7e]+$/u;
 var ENV_REF = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 var MODEL_ID = /^[A-Za-z0-9._:/-]{1,128}$/u;
+var ACTIVATION_OPEN_CODES = ["opened", "no-link", "invalid-url", "unavailable", "failed"];
 var LOGIN_PHASES = ["idle", "launching", "waiting", "verifying", "success", "cancelled", "error"];
 var QUOTA_STATES = ["ok", "partial", "need-login", "error"];
 var SESSION_SOURCES = ["desktop", "login", "environment"];
@@ -20196,6 +20197,10 @@ function parseSaveApiKeyRequest(value) {
   if (key.length > MAX_API_KEY) throw new Error(`API Key \u4E0D\u80FD\u8D85\u8FC7 ${MAX_API_KEY} \u5B57\u7B26`);
   return { value: key, expectedRevision: text(value.expectedRevision, "\u914D\u7F6E\u7248\u672C", MAX_REVISION) };
 }
+function parseActivationOpenState(value) {
+  if (!record2(value)) throw new Error("\u6388\u6743\u9875\u6253\u5F00\u7ED3\u679C\u5FC5\u987B\u662F\u5BF9\u8C61");
+  return { code: member(value.code, ACTIVATION_OPEN_CODES, "\u6388\u6743\u9875\u6253\u5F00\u7ED3\u679C"), opened: flag(value.opened, "\u6388\u6743\u9875\u662F\u5426\u5DF2\u6253\u5F00") };
+}
 
 // src/generated/typert.remote-client.ts
 var StatusCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#Status", create: () => external_exports.unknown().transform((value) => parseStatus(value)) };
@@ -20203,6 +20208,7 @@ var QuotaSnapshotCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#
 var LoginStateCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#LoginState", create: () => external_exports.unknown().transform((value) => parseLoginState(value)) };
 var StartLoginRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#StartLoginRequest", create: () => external_exports.unknown().transform((value) => parseStartLoginRequest(value)) };
 var CancelLoginRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#CancelLoginRequest", create: () => external_exports.unknown().transform((value) => parseCancelLoginRequest(value)) };
+var ActivationOpenStateCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#ActivationOpenState", create: () => external_exports.unknown().transform((value) => parseActivationOpenState(value)) };
 var SaveApiKeyRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#SaveApiKeyRequest", create: () => external_exports.unknown().transform((value) => parseSaveApiKeyRequest(value)) };
 var TYPERT_REMOTE = createTypertRemoteInfo({ package: "dsh-opendesign-corouter", methods: {
   "openDesignCoRouter/status": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: StatusCodec },
@@ -20212,6 +20218,7 @@ var TYPERT_REMOTE = createTypertRemoteInfo({ package: "dsh-opendesign-corouter",
   "openDesignCoRouter/startLogin": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: StartLoginRequestCodec, strictCodec: StartLoginRequestCodec }], result: LoginStateCodec },
   "openDesignCoRouter/loginStatus": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: LoginStateCodec },
   "openDesignCoRouter/cancelLogin": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: CancelLoginRequestCodec, strictCodec: CancelLoginRequestCodec }], result: LoginStateCodec },
+  "openDesignCoRouter/openActivationPage": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: ActivationOpenStateCodec },
   "openDesignCoRouter/saveApiKey": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: SaveApiKeyRequestCodec, strictCodec: SaveApiKeyRequestCodec }], result: StatusCodec }
 } }, external_exports);
 var typert_remote_client_default = TYPERT_REMOTE;
@@ -20235,13 +20242,14 @@ var MAX_REQUEST_TIMEOUT_MS = 36e5;
 var DEFAULT_STREAM_IDLE_TIMEOUT_MS = 3e5;
 var MIN_STREAM_IDLE_TIMEOUT_MS = 1e3;
 var MAX_STREAM_IDLE_TIMEOUT_MS = 18e5;
+var RPC_TIMEOUT_MS = 3e4;
 var MAX_OUTPUT_TOKENS = 1e7;
 var MAX_CONTEXT_WINDOW = 1e8;
 var GENERIC_ERROR = "\u64CD\u4F5C\u672A\u5B8C\u6210\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002";
 var LOGIN_LABELS = {
   idle: "\u5C1A\u672A\u5F00\u59CB\u72EC\u7ACB\u767B\u5F55",
   launching: "\u6B63\u5728\u7533\u8BF7\u8BBE\u5907\u6388\u6743\u7801\u2026",
-  waiting: "\u8BF7\u6253\u5F00\u6388\u6743\u9875\uFF0C\u5728\u5E38\u7528\u6D4F\u89C8\u5668\u4E2D\u786E\u8BA4\u672C\u6B21\u767B\u5F55\u3002",
+  waiting: "\u8BF7\u5728\u6388\u6743\u7A97\u53E3\u6216\u5E38\u7528\u6D4F\u89C8\u5668\u4E2D\u786E\u8BA4\u672C\u6B21\u767B\u5F55\u3002",
   verifying: "\u6B63\u5728\u4FDD\u5B58\u8BBE\u5907\u6388\u6743\u2026",
   success: "\u767B\u5F55\u6210\u529F\uFF0C\u8BBE\u5907\u6388\u6743\u5DF2\u4FDD\u5B58\u3002",
   cancelled: "\u5DF2\u53D6\u6D88\u672C\u6B21\u767B\u5F55\u3002",
@@ -20332,7 +20340,7 @@ function createCaller(ctx) {
     if (!operation) throw new Error("Unknown generated Remote method");
     const parameter = operation.parameters[0];
     const input2 = operation.input({ strict: true }).create().parse(parameter ? { [parameter.wire]: request } : {});
-    const response = await withTimeout(Promise.resolve(operation.invoke(remote, input2)), 25e3, controller.signal);
+    const response = await withTimeout(Promise.resolve(operation.invoke(remote, input2)), RPC_TIMEOUT_MS, controller.signal);
     if (!("ok" in response) || !response.ok) throw new Error("RPC failed");
     return response.value;
   };
@@ -21101,7 +21109,14 @@ function Switch({ checked, disabled, label, hint, onChange }) {
 function loginInFlight(state) {
   return state === "launching" || state === "waiting" || state === "verifying";
 }
-function LoginApproval({ login }) {
+var ACTIVATION_OPEN_LABELS = {
+  opened: "\u5DF2\u5728\u65B0\u7A97\u53E3\u6253\u5F00\u5B98\u65B9\u6388\u6743\u9875\uFF1B\u8BF7\u5728\u8BE5\u7A97\u53E3\u786E\u8BA4\u8BBE\u5907\u7801\u3002",
+  "no-link": "\u6388\u6743\u7801\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u7533\u8BF7\u3002",
+  "invalid-url": "\u6388\u6743\u94FE\u63A5\u672A\u901A\u8FC7\u6821\u9A8C\uFF0C\u8BF7\u590D\u5236\u94FE\u63A5\u624B\u52A8\u6253\u5F00\u3002",
+  unavailable: "\u65E0\u6CD5\u542F\u52A8\u4E34\u65F6\u6D4F\u89C8\u5668\uFF0C\u8BF7\u786E\u8BA4\u5DF2\u5B89\u88C5 Chrome\uFF1B\u4E5F\u53EF\u590D\u5236\u94FE\u63A5\u624B\u52A8\u6253\u5F00\u3002",
+  failed: "\u4E34\u65F6\u6D4F\u89C8\u5668\u7A97\u53E3\u672A\u80FD\u6253\u5F00\uFF0C\u8BF7\u590D\u5236\u94FE\u63A5\u624B\u52A8\u6253\u5F00\u3002"
+};
+function LoginApproval({ login, onOpen, opening, notice }) {
   if (login?.state !== "waiting" || login.userCode === void 0 || login.expiresAt === void 0) return null;
   const url2 = validateActivationUrl(login.activationUrl, login.userCode);
   if (url2 === null) return null;
@@ -21113,10 +21128,19 @@ function LoginApproval({ login }) {
     h(
       "div",
       { className: "odc-actions" },
-      h("a", { className: "odc-button odc-button-primary", href: url2, target: "_blank", rel: "noreferrer noopener" }, "\u6253\u5F00\u6388\u6743\u9875")
+      h("button", {
+        className: "odc-button odc-button-primary",
+        type: "button",
+        disabled: opening === true || onOpen === void 0,
+        onClick: () => {
+          onOpen?.();
+        }
+      }, opening === true ? "\u6B63\u5728\u6253\u5F00\u2026" : "\u5728\u65B0\u7A97\u53E3\u6253\u5F00\u6388\u6743\u9875"),
+      h("a", { className: "odc-button", href: url2, target: "_blank", rel: "noreferrer noopener" }, "\u590D\u5236\u94FE\u63A5\u624B\u52A8\u6253\u5F00")
     ),
-    h("p", { className: "odc-hint" }, `\u6388\u6743\u7801\u6709\u6548\u81F3 ${formatTime(login.expiresAt)}\u3002\u5728\u5E38\u7528\u6D4F\u89C8\u5668\u786E\u8BA4\u540E\uFF0C\u8FD4\u56DE\u6B64\u9875\u67E5\u770B\u7ED3\u679C\u3002`),
-    h("p", { className: "odc-hint" }, "\u53EF\u53F3\u952E\u590D\u5236\u6388\u6743\u94FE\u63A5\u5230\u5E38\u7528\u6D4F\u89C8\u5668\uFF1B\u5BC6\u7801\u7BA1\u7406\u5668\u548C\u81EA\u52A8\u586B\u5145\u7531\u6D4F\u89C8\u5668\u6B63\u5E38\u63D0\u4F9B\u3002\u4EC5\u786E\u8BA4\u4F60\u672C\u4EBA\u53D1\u8D77\u7684\u6388\u6743\u3002")
+    notice ? h(NoticeView, { notice }) : null,
+    h("p", { className: "odc-hint" }, `\u6388\u6743\u7801\u6709\u6548\u81F3 ${formatTime(login.expiresAt)}\u3002\u5728\u6388\u6743\u7A97\u53E3\u786E\u8BA4\u540E\uFF0C\u8FD4\u56DE\u6B64\u9875\u67E5\u770B\u7ED3\u679C\u3002`),
+    h("p", { className: "odc-hint" }, "\u65B0\u7A97\u53E3\u662F\u72EC\u7ACB\u7684\u4E34\u65F6 Chrome\uFF0C\u4E0D\u4F1A\u8BFB\u53D6\u6216\u6539\u52A8\u4F60\u6B63\u5728\u4F7F\u7528\u7684\u6D4F\u89C8\u5668\u914D\u7F6E\uFF1B\u9700\u8981\u6CBF\u7528\u5DF2\u6709\u767B\u5F55\u6001\u65F6\uFF0C\u53F3\u952E\u590D\u5236\u94FE\u63A5\u5230\u5E38\u7528\u6D4F\u89C8\u5668\u3002\u4EC5\u786E\u8BA4\u4F60\u672C\u4EBA\u53D1\u8D77\u7684\u6388\u6743\u3002")
   );
 }
 function Connection({ status, formSnapshot, setFormField, pendingField, caller, loadStatus, refreshAfterLogin }) {
@@ -21126,10 +21150,22 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
   const [notice, setNotice] = React.useState(null);
   const [apiKey, setApiKey] = React.useState("");
   const [keyBusy, setKeyBusy] = React.useState(false);
+  const [opening, setOpening] = React.useState(false);
+  const [activationNotice, setActivationNotice] = React.useState(null);
+  const activationJob = React.useRef(null);
+  const activationToken = React.useRef(0);
   React.useEffect(() => () => {
     actionVersion.current += 1;
   }, []);
   const login = status?.login;
+  React.useEffect(() => {
+    const job = login?.jobId ?? null;
+    if (activationJob.current === job) return;
+    activationJob.current = job;
+    activationToken.current += 1;
+    setActivationNotice(null);
+    setOpening(false);
+  }, [login?.jobId]);
   const state = login?.state ?? "idle";
   const inFlight = loginInFlight(state);
   const startLogin = async () => {
@@ -21141,6 +21177,7 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
       const next = await caller("startLogin", { expectedRevision: status.revision });
       if (!mounted.current || version2 !== actionVersion.current) return;
       setNotice(null);
+      setActivationNotice(null);
       await (next.state === "success" ? refreshAfterLogin() : loadStatus());
     } catch {
       if (mounted.current && version2 === actionVersion.current) setNotice({ kind: "error", text: "\u65E0\u6CD5\u542F\u52A8\u767B\u5F55\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002" });
@@ -21186,6 +21223,23 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
       if (mounted.current && version2 === actionVersion.current) setKeyBusy(false);
     }
   };
+  const openActivation = async () => {
+    if (status === void 0 || busy || keyBusy || opening || login?.state !== "waiting") return;
+    const job = login.jobId;
+    const token = ++activationToken.current;
+    activationJob.current = job;
+    setOpening(true);
+    setActivationNotice(null);
+    const current = () => mounted.current && activationToken.current === token && activationJob.current === job;
+    try {
+      const result = await caller("openActivationPage");
+      if (current()) setActivationNotice({ kind: result.opened ? "status" : "error", text: ACTIVATION_OPEN_LABELS[result.code] });
+    } catch {
+      if (current()) setActivationNotice({ kind: "error", text: ACTIVATION_OPEN_LABELS.failed });
+    } finally {
+      if (mounted.current && activationToken.current === token) setOpening(false);
+    }
+  };
   const desktopChecked = formSnapshot.value?.useDesktopCredential ?? status?.config.useDesktopCredential ?? true;
   return h(
     React.Fragment,
@@ -21214,7 +21268,7 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
       "section",
       { className: "odc-card" },
       h("h3", null, "\u8BBE\u5907\u6388\u6743\u767B\u5F55"),
-      h("p", { className: "odc-hint" }, "\u7533\u8BF7\u6388\u6743\u7801\u540E\uFF0C\u5728\u5E38\u7528\u6D4F\u89C8\u5668\u6253\u5F00\u5B98\u65B9\u6388\u6743\u9875\u3002\u6CBF\u7528\u5DF2\u6709\u767B\u5F55\u72B6\u6001\u3001\u5BC6\u7801\u7BA1\u7406\u5668\u548C\u81EA\u52A8\u586B\u5145\uFF1B\u786E\u8BA4\u540E\u81EA\u52A8\u4FDD\u5B58\u8BBE\u5907\u4EE4\u724C\uFF0C\u7528\u4E8E\u67E5\u8BE2\u989D\u5EA6\u53CA\u5B98\u65B9\u7F51\u5173\u63A8\u7406\u3002"),
+      h("p", { className: "odc-hint" }, "\u7533\u8BF7\u6388\u6743\u7801\u540E\uFF0C\u7531\u63D2\u4EF6\u542F\u52A8\u4E34\u65F6\u7A97\u53E3\u663E\u793A\u5B98\u65B9\u6388\u6743\u9875\uFF0C\u4E5F\u53EF\u590D\u5236\u94FE\u63A5\u5230\u4F60\u81EA\u5DF1\u7684\u5E38\u7528\u6D4F\u89C8\u5668\u3002\u786E\u8BA4\u540E\u81EA\u52A8\u4FDD\u5B58\u8BBE\u5907\u4EE4\u724C\uFF0C\u7528\u4E8E\u67E5\u8BE2\u989D\u5EA6\u53CA\u5B98\u65B9\u7F51\u5173\u63A8\u7406\u3002"),
       h(
         "div",
         { className: "odc-actions", style: { marginTop: 14 } },
@@ -21226,7 +21280,9 @@ function Connection({ status, formSnapshot, setFormField, pendingField, caller,
         } }, "\u53D6\u6D88\u767B\u5F55") : null,
         h("a", { className: "odc-link", href: OFFICIAL_SITE, target: "_blank", rel: "noreferrer noopener" }, "\u6253\u5F00 CoRouter \u5B98\u7F51")
       ),
-      h(LoginApproval, { login }),
+      h(LoginApproval, { login, onOpen: () => {
+        void openActivation();
+      }, opening, notice: activationNotice }),
       h("p", { className: "odc-meta", role: state === "error" ? "alert" : "status" }, login?.message ?? LOGIN_LABELS[state]),
       h(NoticeView, { notice })
     ),

package/lib/device-auth.d.ts

@@ -3,8 +3,10 @@ export interface DeviceTokens {
     runtimeKey: string;
 }
 export declare const DEVICE_AUTH_ENDPOINT = "https://amr-api.open-design.ai/api/v1/cli/device-authorizations";
-export declare const DEVICE_AUTH_PLUGIN_VERSION = "0.1.4";
+export declare const DEVICE_AUTH_PLUGIN_VERSION = "0.1.5";
 export declare const DEVICE_REQUEST_TIMEOUT_MS = 20000;
+/** One bounded launch step of the temporary activation window. */
+export declare const DEVICE_OPEN_TIMEOUT_MS = 30000;
 export declare const DEVICE_RESPONSE_MAX_BYTES = 65536;
 export declare const DEVICE_POLL_MIN_MS = 1000;
 export declare const DEVICE_POLL_MAX_MS = 300000;

package/lib/generated/typert.host.js

@@ -89,6 +89,7 @@ var MAX_API_KEY = 16384;
 var HTTP_ASCII = /^[\x21-\x7e]+$/u;
 var ENV_REF = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 var MODEL_ID = /^[A-Za-z0-9._:/-]{1,128}$/u;
+var ACTIVATION_OPEN_CODES = ["opened", "no-link", "invalid-url", "unavailable", "failed"];
 var LOGIN_PHASES = ["idle", "launching", "waiting", "verifying", "success", "cancelled", "error"];
 var QUOTA_STATES = ["ok", "partial", "need-login", "error"];
 var SESSION_SOURCES = ["desktop", "login", "environment"];
@@ -264,6 +265,10 @@ function parseSaveApiKeyRequest(value) {
   if (key.length > MAX_API_KEY) throw new Error(`API Key \u4E0D\u80FD\u8D85\u8FC7 ${MAX_API_KEY} \u5B57\u7B26`);
   return { value: key, expectedRevision: text(value.expectedRevision, "\u914D\u7F6E\u7248\u672C", MAX_REVISION) };
 }
+function parseActivationOpenState(value) {
+  if (!record(value)) throw new Error("\u6388\u6743\u9875\u6253\u5F00\u7ED3\u679C\u5FC5\u987B\u662F\u5BF9\u8C61");
+  return { code: member(value.code, ACTIVATION_OPEN_CODES, "\u6388\u6743\u9875\u6253\u5F00\u7ED3\u679C"), opened: flag(value.opened, "\u6388\u6743\u9875\u662F\u5426\u5DF2\u6253\u5F00") };
+}
 
 // src/generated/typert.remote-client.ts
 var StatusCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#Status", create: () => z.unknown().transform((value) => parseStatus(value)) };
@@ -271,6 +276,7 @@ var QuotaSnapshotCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#
 var LoginStateCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#LoginState", create: () => z.unknown().transform((value) => parseLoginState(value)) };
 var StartLoginRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#StartLoginRequest", create: () => z.unknown().transform((value) => parseStartLoginRequest(value)) };
 var CancelLoginRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#CancelLoginRequest", create: () => z.unknown().transform((value) => parseCancelLoginRequest(value)) };
+var ActivationOpenStateCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#ActivationOpenState", create: () => z.unknown().transform((value) => parseActivationOpenState(value)) };
 var SaveApiKeyRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#SaveApiKeyRequest", create: () => z.unknown().transform((value) => parseSaveApiKeyRequest(value)) };
 var TYPERT_REMOTE = createTypertRemoteInfo({ package: "dsh-opendesign-corouter", methods: {
   "openDesignCoRouter/status": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: StatusCodec },
@@ -280,6 +286,7 @@ var TYPERT_REMOTE = createTypertRemoteInfo({ package: "dsh-opendesign-corouter",
   "openDesignCoRouter/startLogin": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: StartLoginRequestCodec, strictCodec: StartLoginRequestCodec }], result: LoginStateCodec },
   "openDesignCoRouter/loginStatus": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: LoginStateCodec },
   "openDesignCoRouter/cancelLogin": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: CancelLoginRequestCodec, strictCodec: CancelLoginRequestCodec }], result: LoginStateCodec },
+  "openDesignCoRouter/openActivationPage": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: ActivationOpenStateCodec },
   "openDesignCoRouter/saveApiKey": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: SaveApiKeyRequestCodec, strictCodec: SaveApiKeyRequestCodec }], result: StatusCodec }
 } }, z);
 var typert_remote_client_default = TYPERT_REMOTE;

package/lib/generated/typert.remote-client.d.ts

@@ -1,5 +1,5 @@
 import type { RemoteResult } from '@deepseek-ai/dsh-typert-protocol';
-import type { Status, QuotaSnapshot, LoginState, StartLoginRequest, CancelLoginRequest, SaveApiKeyRequest } from '../remote.js';
+import type { Status, QuotaSnapshot, LoginState, StartLoginRequest, CancelLoginRequest, ActivationOpenState, SaveApiKeyRequest } from '../remote.js';
 export type CoRouterRemote = {
     status: () => Promise<RemoteResult<Status>>;
     refreshModels: () => Promise<RemoteResult<Status>>;
@@ -8,6 +8,7 @@ export type CoRouterRemote = {
     startLogin: (input: StartLoginRequest) => Promise<RemoteResult<LoginState>>;
     loginStatus: () => Promise<RemoteResult<LoginState>>;
     cancelLogin: (input: CancelLoginRequest) => Promise<RemoteResult<LoginState>>;
+    openActivationPage: () => Promise<RemoteResult<ActivationOpenState>>;
     saveApiKey: (input: SaveApiKeyRequest) => Promise<RemoteResult<Status>>;
 };
 declare module '@deepseek-ai/dsh-typert-protocol' {

package/lib/generated/typert.remote-client.js

@@ -89,6 +89,7 @@ var MAX_API_KEY = 16384;
 var HTTP_ASCII = /^[\x21-\x7e]+$/u;
 var ENV_REF = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 var MODEL_ID = /^[A-Za-z0-9._:/-]{1,128}$/u;
+var ACTIVATION_OPEN_CODES = ["opened", "no-link", "invalid-url", "unavailable", "failed"];
 var LOGIN_PHASES = ["idle", "launching", "waiting", "verifying", "success", "cancelled", "error"];
 var QUOTA_STATES = ["ok", "partial", "need-login", "error"];
 var SESSION_SOURCES = ["desktop", "login", "environment"];
@@ -264,6 +265,10 @@ function parseSaveApiKeyRequest(value) {
   if (key.length > MAX_API_KEY) throw new Error(`API Key \u4E0D\u80FD\u8D85\u8FC7 ${MAX_API_KEY} \u5B57\u7B26`);
   return { value: key, expectedRevision: text(value.expectedRevision, "\u914D\u7F6E\u7248\u672C", MAX_REVISION) };
 }
+function parseActivationOpenState(value) {
+  if (!record(value)) throw new Error("\u6388\u6743\u9875\u6253\u5F00\u7ED3\u679C\u5FC5\u987B\u662F\u5BF9\u8C61");
+  return { code: member(value.code, ACTIVATION_OPEN_CODES, "\u6388\u6743\u9875\u6253\u5F00\u7ED3\u679C"), opened: flag(value.opened, "\u6388\u6743\u9875\u662F\u5426\u5DF2\u6253\u5F00") };
+}
 
 // src/generated/typert.remote-client.ts
 var StatusCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#Status", create: () => z.unknown().transform((value) => parseStatus(value)) };
@@ -271,6 +276,7 @@ var QuotaSnapshotCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#
 var LoginStateCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#LoginState", create: () => z.unknown().transform((value) => parseLoginState(value)) };
 var StartLoginRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#StartLoginRequest", create: () => z.unknown().transform((value) => parseStartLoginRequest(value)) };
 var CancelLoginRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#CancelLoginRequest", create: () => z.unknown().transform((value) => parseCancelLoginRequest(value)) };
+var ActivationOpenStateCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#ActivationOpenState", create: () => z.unknown().transform((value) => parseActivationOpenState(value)) };
 var SaveApiKeyRequestCodec = { mode: "strict", typeSymbol: "dsh-opendesign-corouter#SaveApiKeyRequest", create: () => z.unknown().transform((value) => parseSaveApiKeyRequest(value)) };
 var TYPERT_REMOTE = createTypertRemoteInfo({ package: "dsh-opendesign-corouter", methods: {
   "openDesignCoRouter/status": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: StatusCodec },
@@ -280,6 +286,7 @@ var TYPERT_REMOTE = createTypertRemoteInfo({ package: "dsh-opendesign-corouter",
   "openDesignCoRouter/startLogin": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: StartLoginRequestCodec, strictCodec: StartLoginRequestCodec }], result: LoginStateCodec },
   "openDesignCoRouter/loginStatus": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: LoginStateCodec },
   "openDesignCoRouter/cancelLogin": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: CancelLoginRequestCodec, strictCodec: CancelLoginRequestCodec }], result: LoginStateCodec },
+  "openDesignCoRouter/openActivationPage": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [], result: ActivationOpenStateCodec },
   "openDesignCoRouter/saveApiKey": { service: "openDesignCoRouter", invocation: { kind: "direct" }, parameters: [{ name: "input", source: "json", codec: SaveApiKeyRequestCodec, strictCodec: SaveApiKeyRequestCodec }], result: StatusCodec }
 } }, z);
 var typert_remote_client_default = TYPERT_REMOTE;

package/lib/index.d.ts

@@ -5,9 +5,10 @@ import type { CatalogModel } from './catalog.js';
 import { readConfig, type LiveConfig } from './config.js';
 import { resolveSession } from './auth.js';
 import { type LoginOptions } from './login.js';
+import { type ActivationLauncherOptions } from './browser-open.js';
 import { readQuota, type QuotaSnapshot } from './quota.js';
 import { readDesktopQuota } from './desktop-quota.js';
-import { type Status, type LoginState, type StartLoginRequest, type CancelLoginRequest, type SaveApiKeyRequest } from './remote.js';
+import { type Status, type LoginState, type StartLoginRequest, type CancelLoginRequest, type SaveApiKeyRequest, type ActivationOpenState } from './remote.js';
 export { Config } from './config.js';
 export { CoRouterAdapter } from './adapter.js';
 export { MODELS } from './catalog.js';
@@ -20,11 +21,13 @@ export interface HostDependencies {
     fetchModels?: typeof fetchModelCatalog;
     modelsChanged?: () => void;
     loginOptions?: LoginOptions;
+    activationOptions?: ActivationLauncherOptions;
 }
 export declare class OpenDesignCoRouterService extends TypertRemoteService {
     readonly dependencies: HostDependencies;
     private readonly _config;
     private readonly _login;
+    private readonly _activation;
     private readonly _lifetime;
     private _revision;
     private _fingerprint;
@@ -62,6 +65,7 @@ export declare class OpenDesignCoRouterService extends TypertRemoteService {
     startLogin(input: StartLoginRequest): Promise<LoginState>;
     loginStatus(): LoginState;
     cancelLogin(input: CancelLoginRequest): LoginState;
+    openActivationPage(): Promise<ActivationOpenState>;
     saveApiKey(input: SaveApiKeyRequest): Promise<Status>;
 }
 declare module '@deepseek-ai/cordis' {