dsh-tap 0.20.0

package/providers/codebuddy/images.js

@@ -0,0 +1,125 @@
+/**
+ * providers/codebuddy/images.js — dsh 原生 `image_generate` 工具的
+ * CodeBuddy 后端：POST /v2/images/generations（2026-08-17 探测可用，
+ * hunyuan-image-v3.0-art 约 22s/张，samples 在 docs/probes/）。
+ *
+ * 路由事实（docs/rules/routing.md）：/v2/3d/generations 路由形状存在但
+ * 当前账号无 3D 模型注册（14407 "route config not found"，注册表层拒绝）
+ * ——3D 记为不可用，不接入。
+ *
+ * 计量说明：images 响应体的 usage 字段**未经探测证伪**（quota 探测只覆盖
+ * agenttool），按咒语红线保留原计量路径，不删不改。
+ */
+
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { CREDENTIAL_UNAVAILABLE_MESSAGE } from './errors.js'
+
+/**
+ * @param {{ withKeyRotation: Function, meter: { record: Function }, dshHome: string }} deps
+ */
+export function createImageTool({ withKeyRotation, meter, dshHome }) {
+  /** Where generated images land: the session workspace when the agent loop
+   * exposes one, else <dshHome>/generated-images. */
+  function resolveImageSaveDir(exec) {
+    const a = exec?.agent
+    const dir = a?.workspaceDir ?? a?.workDir ?? a?.cwd ?? a?.workspace?.dir ?? null
+    return dir && typeof dir === 'string'
+      ? join(dir, 'generated-images')
+      : join(dshHome, 'generated-images')
+  }
+
+  /** dsh tool definition for `image_generate` (plain object — the plugin must
+   * not import @deepseek-ai/*; the registry accepts the structural shape). */
+  function makeImageGenTool(settings) {
+    return {
+      name: 'image_generate',
+      description:
+        'Generate an image from a text prompt (CodeBuddy hunyuan-image backend). ' +
+        'Returns the local file path of the saved image and its source URL. ' +
+        'Takes ~20s per image; one image per call.',
+      // Schemas here are FINAL JSON Schema (the registry's defineTool shorthand
+      // converter is not importable from a plugin — see docs/pitfalls.md #9).
+      parameters: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          prompt: { type: 'string', description: 'What to draw; be concrete about subject, style, and colors.' },
+          size: { type: 'string', description: 'WxH pixels, e.g. "1024x1024" (default), "768x768", "1280x720".' },
+        },
+        required: ['prompt'],
+      },
+      output: {
+        schema: {
+          type: 'object',
+          additionalProperties: false,
+          properties: {
+            path: { type: 'string' },
+            url: { type: 'string' },
+            model: { type: 'string' },
+            ms: { type: 'number' },
+          },
+          required: ['path', 'model', 'ms'],
+        },
+        render: (_args, value) => [{
+          type: 'text',
+          text: `image generated (${value.model}, ${(value.ms / 1000).toFixed(1)}s)\nsaved: ${value.path}\nsource: ${value.url ?? 'n/a'}`,
+        }],
+      },
+      // Generation measured at ~22s end-to-end; keep headroom for slow runs.
+      timeoutMs: 180_000,
+      isConcurrencySafe: () => true,
+      async execute(args, exec) {
+        const prompt = typeof args?.prompt === 'string' ? args.prompt.trim() : ''
+        if (!prompt) throw new Error('image_generate: prompt 不能为空')
+        const size = typeof args?.size === 'string' && /^\d{3,4}x\d{3,4}$/.test(args.size)
+          ? args.size : '1024x1024'
+        const s = settings()
+        const t0 = Date.now()
+        const { res, err } = await withKeyRotation(settings, (cred) => fetch(`${s.baseURL}/v2/images/generations`, {
+          method: 'POST',
+          signal: exec?.signal,
+          headers: {
+            Authorization: cred.authorization,
+            ...cred.headers,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+          },
+          body: JSON.stringify({ model: s.imageGenModel, prompt, size, n: 1 }),
+        }))
+        if (err) {
+          if (err.message === CREDENTIAL_UNAVAILABLE_MESSAGE) throw err
+          if (exec?.signal?.aborted) throw err
+          const causes = []
+          for (let e = err; e; e = e.cause) causes.push(e.code ?? e.message ?? String(e))
+          throw new Error(`image_generate network error: ${causes.join(' ← ')}`)
+        }
+        const body = await res.json().catch(() => null)
+        if (!res.ok) {
+          throw new Error(`image_generate HTTP ${res.status}${body?.code != null ? ` code ${body.code}: ${body.msg ?? ''}` : ''}`)
+        }
+        if (!body || body.code !== 0) {
+          throw new Error(`image_generate error ${body?.code ?? '?'}: ${body?.msg ?? 'empty or malformed response'}`)
+        }
+        if (body.data?.usage) meter.record({ ts: t0, kind: 'image', model: s.imageGenModel, usage: body.data.usage })
+        const item = body.data?.data?.[0]
+        const url = typeof item?.url === 'string' ? item.url : null
+        const b64 = typeof item?.b64_json === 'string' ? item.b64_json : null
+        if (!url && !b64) throw new Error('image_generate: 响应既无 url 也无 b64_json')
+        const dir = resolveImageSaveDir(exec)
+        mkdirSync(dir, { recursive: true })
+        const file = join(dir, `image-${t0}.png`)
+        if (url) {
+          const img = await fetch(url, { signal: exec?.signal })
+          if (!img.ok) throw new Error(`image_generate: 下载图片失败 HTTP ${img.status}`)
+          writeFileSync(file, Buffer.from(await img.arrayBuffer()))
+        } else {
+          writeFileSync(file, Buffer.from(b64, 'base64'))
+        }
+        return { path: file, url: url ?? undefined, model: s.imageGenModel, ms: Date.now() - t0 }
+      },
+    }
+  }
+
+  return { makeImageGenTool }
+}

package/providers/codebuddy/index.js

@@ -0,0 +1,123 @@
+/**
+ * providers/codebuddy/index.js — CodeBuddy（copilot.tencent.com）薄适配器。
+ *
+ * 组合各特化件并向 core/ 暴露 provider 钩子。core/bridge.js 只依赖这里
+ * 暴露的结构钩子，不认识任何 CodeBuddy 事实；接第二个 OpenAI 兼容上游时
+ * 照本目录形态另写一个适配器即可，core/ 零改动（证伪测试：
+ * scripts/verify-core-generic.mjs）。
+ *
+ * 规则文档是适配器行为的裁判依据：
+ * - docs/rules/ua-validation.md §3   → headers.js 逐字段规则/迷信判定
+ * - docs/rules/content-moderation.md → transformChatPayload 的 developer→system
+ * - docs/rules/routing.md            → errors.js 14401/14407/11102/11103
+ * - docs/rules/quota-signals.md      → catalog.js 额度方言 + agenttool 死路径删除
+ * - docs/rules/oauth-handshake.md    → oauth.js 设备流与迷信头标注
+ */
+
+import { CLIENT_HEADERS } from './headers.js'
+import { createOAuth } from './oauth.js'
+import { createCatalog } from './catalog.js'
+import { createAgentTool } from './agenttool.js'
+import { createImageTool } from './images.js'
+
+/**
+ * 桥取证日志允许记录的头名白名单；authorization 单独分类（sentinel/caller-set），
+ * 永不逐字落盘。
+ */
+const LOG_HEADER_NAMES = [
+  'user-agent', 'content-type',
+  'x-conversation-id', 'x-session-id', 'session_id', 'x-client-request-id', 'x-session-affinity',
+  'x-ide-type', 'x-ide-name', 'x-ide-version', 'x-product-version',
+  'x-requested-with', 'x-private-data',
+]
+
+/**
+ * @param {{
+ *   meter: { record: Function },
+ *   readAuth: () => object,
+ *   writeAuth: (v: object) => void,
+ *   envKey: (envName: string|undefined) => string|null,
+ *   withKeyRotation: (settingsFn: () => object, attempt: Function) => Promise<object>,
+ *   resolveCredential: (settingsFn: () => object) => Promise<object|null>,
+ *   effortWireFor: (model: string) => string|undefined, // G8 思考强度线值（可无）
+ *   dshHome: string,
+ * }} deps 组合根注入的 core 原语与凭据编排（迟绑定箭头，循环引用靠它解开）
+ */
+export function createCodeBuddyProvider(deps) {
+  const oauth = createOAuth({ readAuth: deps.readAuth, writeAuth: deps.writeAuth })
+  const catalog = createCatalog({ resolveCredential: deps.resolveCredential, envKey: deps.envKey })
+  const agenttool = createAgentTool({ withKeyRotation: deps.withKeyRotation })
+  const images = createImageTool({
+    withKeyRotation: deps.withKeyRotation,
+    meter: deps.meter,
+    dshHome: deps.dshHome,
+  })
+
+  return {
+    id: 'codebuddy',
+
+    // ---------------------------------------------------------------
+    // core/bridge.js 的适配钩子
+    // ---------------------------------------------------------------
+
+    logPrefix: '[dsh-tap]',
+
+    /** 桥出站静态头组（逐字段规则/迷信判定见 headers.js 文件头）。 */
+    bridgeHeaders: () => ({ ...CLIENT_HEADERS }),
+
+    /**
+     * Chat 出站重写：developer → system。
+     *
+     * 规则（docs/rules/content-moderation.md）：网关入口通道校验层对含字面量
+     * `role:"developer"` 消息的 chat payload 单列拒绝（当前拒绝面
+     * 500/11128 "unapproved channel"；模型无关、位置无关、计费前）。触发源
+     * 是 pi-ai 把推理模型的 system prompt 序列化为 developer 角色。网关对
+     * developer/system 指令语义等价，桥直接重写——回归锁在 verify-bridge §9。
+     */
+    transformChatPayload(payload) {
+      if (Array.isArray(payload.messages)) {
+        for (const m of payload.messages) {
+          if (m?.role === 'developer') m.role = 'system'
+        }
+      }
+      // G8 思考强度注入：effortWireFor 只在档位线值非空时返回（off 的线值
+      // 是 null = 省略参数；无表模型/非法档位同）。调用方（pi-ai / dsh 核心
+      // UI）显式携带 reasoning_effort 时绝不覆盖。
+      if (payload && payload.reasoning_effort == null) {
+        const wire = deps.effortWireFor?.(payload.model)
+        if (wire) payload.reasoning_effort = wire
+      }
+    },
+
+    /** SSE chunk → usage 对象（网关每 chunk 重复携带，含 credit 与缓存计数）。 */
+    extractUsage: (chunk) => chunk.usage ?? null,
+
+    /** SSE chunk → 错误判定：OpenAI 形态 chunk.error，或网关信封 code !== 0。 */
+    extractStreamError: (chunk) =>
+      (chunk.error || (chunk.code != null && chunk.code !== 0)) ? chunk : null,
+
+    /** 聚合 chat.completion 响应的 id（保持 0.7.4 线上值不变）。 */
+    bridgeResponseId: 'codebuddy-stream-bridge',
+
+    logHeaderNames: LOG_HEADER_NAMES,
+
+    /** 静态哨兵 Authorization（cordis.patch.yml 主聊天路由携带；桥逐请求替换）。 */
+    sentinelAuth: 'Bearer dsh-codebuddy-bridge',
+
+    texts: {
+      credentialUnavailable: 'codebuddy credential unavailable',
+    },
+
+    // ---------------------------------------------------------------
+    // 组合根直接消费的特化能力
+    // ---------------------------------------------------------------
+
+    oauth,
+    catalog,
+    agenttool,
+    images,
+    makeSearchProvider: agenttool.makeSearchProvider,
+    makeFetchProvider: agenttool.makeFetchProvider,
+    makeImageGenTool: images.makeImageGenTool,
+  }
+}

package/providers/codebuddy/oauth.js

@@ -0,0 +1,279 @@
+/**
+ * providers/codebuddy/oauth.js — CodeBuddy 浏览器 OAuth 设备流。
+ *
+ * 流程（与官方 CLI 对齐；规则化结论见 docs/rules/oauth-handshake.md，
+ * 证据 docs/probes/oauth-2026-08-19.jsonl，15 条）：
+ *   POST /v2/plugin/auth/state?platform=CLI  → {state, authUrl}   （创建无认证；
+ *        X-No-* 三头实测是迷信——P-O3：不携带也 200；platform 必填但任意值皆可）
+ *   GET  /v2/plugin/auth/token?state=…       → 11217 pending，0 → tokens
+ *        （核心否定发现：pending/bogus/过期一律 11217，三态不可区分，state TTL 不可观测）
+ *   GET  /v2/plugin/login/account?state=…    → {uid, nickname, …}
+ *   POST /v2/plugin/auth/token/refresh       → 刷新（bogus refresh → 401+12153）
+ *
+ * 实例状态（refresh 单飞锁、poll 代际号、pending 视图、relogin 粘性信号）
+ * 在本工厂闭包内——组合根每个插件模块实例创建一个 provider 实例，隔离语义
+ * 与重构前模块全局一致。
+ */
+
+const AUTH_PENDING_CODE = 11217 // ERROR_CODES[11217]：三态同码，勿当"未完成"以外含义用
+const LOGIN_TIMEOUT_MS = 10 * 60 * 1000
+const LOGIN_POLL_INTERVAL_MS = 1000
+
+// 授权页允许的站点族：CodeBuddy（copilot.tencent.com）与 WorkBuddy
+// （www.workbuddy.cn）同账户体系（docs/rules/gateway-facts.md）；codebuddy.cn
+// 依据 docs/probes/oauth-token-2026-08-19.jsonl 的账户 domain 证据一并放行。
+const LOGIN_SITE_SUFFIXES = ['tencent.com', 'workbuddy.cn', 'codebuddy.cn']
+const isLoopbackHost = (h) => h === '127.0.0.1' || h === 'localhost' || h === '[::1]'
+
+/**
+ * 授权页出宿主前的门禁：authUrl 由上游响应原样给出，浏览器侧直送
+ * window.open / location.href（lib/client.js 两个汇）。上游被劫持/投毒时
+ * 必须在此响亮失败，而不是把用户导去钓鱼页或 javascript: 串：
+ *   - scheme 一律 https（authUrl 与 baseURL 双双回环时例外——离线 verify
+ *     的 mock 上游走 http://127.0.0.1）；
+ *   - host 必须是发起 auth/state 的 baseURL 本身或官方登录站点族（子域放行，
+ *     兼容代理转发不改写 body 的部署）。
+ */
+function assertSafeAuthUrl(authUrl, baseURL) {
+  let parsed
+  try { parsed = new URL(String(authUrl)) } catch { throw new Error('authUrl 不是合法 URL') }
+  let base
+  try { base = new URL(baseURL) } catch { throw new Error('baseURL 不是合法 URL') }
+  const loopbackPair = isLoopbackHost(parsed.hostname) && isLoopbackHost(base.hostname)
+  if (parsed.protocol !== 'https:' && !loopbackPair) {
+    throw new Error(`authUrl 必须使用 https（收到 ${parsed.protocol}//）`)
+  }
+  const hostOk = parsed.hostname === base.hostname || loopbackPair
+    || LOGIN_SITE_SUFFIXES.some((s) => parsed.hostname === s || parsed.hostname.endsWith(`.${s}`))
+  if (!hostOk) {
+    throw new Error(`authUrl 域名 ${parsed.hostname} 不在预期登录域（${base.hostname} 或 ${LOGIN_SITE_SUFFIXES.join(' / ')} 站点族）`)
+  }
+}
+
+/**
+ * @param {{ readAuth: () => object, writeAuth: (v: object) => void }} deps
+ *   令牌存储 IO（组合根绑定到 ~/.dsh/codebuddy-plugin-auth.json；令牌永不
+ *   回传浏览器——oauthStatus() 只出视图字段）。
+ */
+export function createOAuth({ readAuth, writeAuth }) {
+  let refreshInFlight = null
+  // 进行中的 poll 代际号：logout 令其失效（poll 循环每步复查），logout 后
+  // 浏览器才完成的授权不再被写回——旧实现 while 只看 deadline，logout 后
+  // 10 分钟内授权仍会被重新登进。
+  let pollGeneration = 0
+  // 令牌存储代际号：logout 令其失效。refresh 的落盘是读-改-写（拿到新令牌后
+  // writeAuth({...readAuth(), auth})——与 logout 的整体覆写竞态时，在飞刷新
+  // 会把已登出的令牌写回（登出失效）。刷新落盘前比对代际，过期即丢弃结果。
+  let storeGeneration = 0
+  // refresh 实败（refreshOAuth 返回 undefined）的粘性信号：accessToken 还在
+  // 但聊天已全 503 时，oauthStatus 必须暴露"需重新登录"而不是只报已登录。
+  // 下次 refresh 成功自愈；logout 清除。
+  let reloginNeeded = false
+  const oauthPending = { active: false, authUrl: '', error: '' }
+
+  /**
+   * Exchange the refresh token for a fresh access token (single-flight).
+   * Mirrors the official CLI: Bearer <old access>, X-Refresh-Token, plus the
+   * identity headers. Returns the updated auth store or undefined on refusal.
+   */
+  async function refreshOAuth(baseURL, auth) {
+    if (refreshInFlight) return refreshInFlight
+    const generation = storeGeneration
+    refreshInFlight = (async () => {
+      try {
+        const headers = {
+          Accept: 'application/json',
+          Authorization: `Bearer ${auth.accessToken}`,
+          'X-Domain': auth.domain ?? '',
+          'X-Refresh-Token': auth.refreshToken ?? '',
+        }
+        if (auth.uid) headers['X-User-Id'] = auth.uid
+        if (auth.enterpriseId) headers['X-Enterprise-Id'] = auth.enterpriseId
+        const res = await fetch(`${baseURL}/v2/plugin/auth/token/refresh`, {
+          method: 'POST',
+          headers,
+        })
+        if (!res.ok) { reloginNeeded = true; return undefined }
+        const body = await res.json().catch(() => null)
+        if (!body || body.code !== 0 || !body.data?.accessToken) { reloginNeeded = true; return undefined }
+        // logout 竞态守卫：代际在飞期间已变（用户点了退出）→ 丢弃刷新结果
+        if (generation !== storeGeneration) return undefined
+        const store = readAuth()
+        store.auth = {
+          accessToken: body.data.accessToken,
+          expiresAt: Date.now() + (body.data.expiresIn ?? 3600) * 1000,
+          refreshToken: body.data.refreshToken ?? auth.refreshToken,
+          refreshExpiresAt: body.data.refreshExpiresAt != null
+            ? Date.now() + body.data.refreshExpiresAt * 1000
+            : auth.refreshExpiresAt,
+          domain: body.data.domain ?? auth.domain,
+        }
+        writeAuth(store)
+        reloginNeeded = false // 刷新成功自愈
+        return store.auth
+      } catch {
+        reloginNeeded = true
+        return undefined
+      } finally {
+        refreshInFlight = null
+      }
+    })()
+    return refreshInFlight
+  }
+
+  /** OAuth credential branch, shared by every outbound flavor. */
+  async function resolveOAuthCredential(s) {
+    const store = readAuth()
+    const auth = store.auth
+    if (!auth?.accessToken) return null
+    let current = auth
+    if (auth.expiresAt && auth.expiresAt - Date.now() < 60_000) {
+      const refreshed = await refreshOAuth(s.baseURL, auth)
+      if (!refreshed) return null
+      current = refreshed
+    }
+    const headers = { 'X-Domain': current.domain ?? '' }
+    if (store.account?.uid) headers['X-User-Id'] = store.account.uid
+    if (store.account?.enterpriseId) headers['X-Enterprise-Id'] = store.account.enterpriseId
+    return { authorization: `Bearer ${current.accessToken}`, headers }
+  }
+
+  async function startOAuth(baseURL) {
+    if (oauthPending.active) return { started: true, authUrl: oauthPending.authUrl }
+    const res = await fetch(`${baseURL}/v2/plugin/auth/state?platform=CLI`, {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        // X-No-* 三头：实测迷信（oauth-handshake.md P-O3，不携带也 200），
+        // 为零行为变更保留，不作为能力依赖。
+        'X-No-Authorization': 'true',
+        'X-No-User-Id': 'true',
+        'X-No-Enterprise-Id': 'true',
+      },
+    })
+    if (!res.ok) throw new Error(`auth state HTTP ${res.status}`)
+    const body = await res.json()
+    if (body.code !== 0 || !body.data?.state) {
+      throw new Error(`auth state error: ${body.code} ${body.msg ?? ''}`)
+    }
+    const { state, authUrl } = body.data
+    // 门禁在置位 oauthPending 之前：拒绝时 pending 不激活（oauthStatus 不再
+    // 外泄该 URL），组合根 oauth-start 的 catch 回 502 + 错误信息。缓存的
+    // oauthPending.authUrl（上方早退分支与 oauthStatus 视图）因此必已过检
+    // ——浏览器的两个导航汇（window.open / location.href）被同一单点覆盖。
+    assertSafeAuthUrl(authUrl, baseURL)
+    oauthPending.active = true
+    oauthPending.authUrl = authUrl
+    oauthPending.error = ''
+
+    const poll = async () => {
+      const gen = pollGeneration
+      // 代际守卫：logout（或新一轮 start）后本 poll 已失效——循环每步复查，
+      // 拿到令牌写回前再复查一次，logout 后完成的授权绝不落盘。
+      const alive = () => gen === pollGeneration && oauthPending.active
+      const deadline = Date.now() + LOGIN_TIMEOUT_MS
+      try {
+        while (alive() && Date.now() < deadline) {
+          await new Promise((r) => setTimeout(r, LOGIN_POLL_INTERVAL_MS))
+          if (!alive()) return
+          let response
+          try {
+            response = await fetch(`${baseURL}/v2/plugin/auth/token?state=${encodeURIComponent(state)}`, {
+              headers: { Accept: 'application/json', 'X-No-Authorization': 'true' },
+            })
+          } catch {
+            continue
+          }
+          if (!response.ok) continue
+          const body = await response.json().catch(() => null)
+          if (!body) continue
+          if (body.code === AUTH_PENDING_CODE) continue
+          if (body.code !== 0 || !body.data?.accessToken) {
+            oauthPending.error = `登录失败：${body.code} ${body.msg ?? ''}`
+            return
+          }
+          const token = body.data
+          if (!alive()) return // 令牌在飞期间用户已退出
+          // Fetch the account facts before persisting.
+          let account = {}
+          try {
+            const accRes = await fetch(`${baseURL}/v2/plugin/login/account?state=${encodeURIComponent(state)}`, {
+              headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${token.accessToken}`,
+                'X-No-User-Id': 'true',
+                'X-No-Enterprise-Id': 'true',
+                'X-Domain': token.domain ?? '',
+              },
+            })
+            const accBody = await accRes.json().catch(() => null)
+            if (accBody?.code === 0 && accBody.data) account = accBody.data
+          } catch {
+            // account facts are best-effort; tokens alone still work
+          }
+          if (!alive()) return // 账户信息在飞期间用户已退出
+          writeAuth({
+            auth: {
+              accessToken: token.accessToken,
+              expiresAt: Date.now() + (token.expiresIn ?? 3600) * 1000,
+              refreshToken: token.refreshToken,
+              refreshExpiresAt: token.refreshExpiresAt != null
+                ? Date.now() + token.refreshExpiresAt * 1000
+                : undefined,
+              domain: token.domain,
+            },
+            account,
+          })
+          reloginNeeded = false // 新登录落成，旧的 refresh 失败信号作废
+          return
+        }
+        if (alive()) oauthPending.error = '登录超时（10 分钟未完成）'
+      } finally {
+        // 只清自己这一代的 pending：代际已过时（logout 后用户可能又开始了
+        // 新一轮登录），老 poll 不得动新 poll 的状态。
+        if (gen === pollGeneration) oauthPending.active = false
+      }
+    }
+    // Fire-and-forget, but never unhandled: writeAuth (json-store) throws
+    // synchronously on ENOSPC/EACCES/EROFS, and an unhandled rejection here
+    // would take the whole dsh process down (Node ≥15 default).
+    poll().catch((err) => {
+      oauthPending.error = String(err?.message ?? err)
+    })
+    return { started: true, authUrl }
+  }
+
+  /** OAuth view for the card — tokens never leave the host. */
+  function oauthStatus() {
+    const store = readAuth()
+    const auth = store.auth
+    // 需重新登录信号：refresh 令牌本身已过期（refreshExpiresAt 存了就要查），
+    // 或最近一次 refresh 实败。accessToken 还在 ≠ 可用——此时聊天全 503，
+    // signedIn 照常报（令牌确实在），needsRelogin 单独暴露给 UI。
+    const refreshExpired = typeof auth?.refreshExpiresAt === 'number' && auth.refreshExpiresAt <= Date.now()
+    return {
+      pending: oauthPending.active,
+      authUrl: oauthPending.active ? oauthPending.authUrl : '',
+      error: oauthPending.error,
+      signedIn: Boolean(auth?.accessToken),
+      needsRelogin: Boolean(auth?.accessToken) && (refreshExpired || reloginNeeded),
+      account: store.account?.nickname ? {
+        nickname: store.account.nickname,
+        uid: store.account.uid,
+        enterpriseName: store.account.enterpriseName ?? '',
+      } : null,
+      accessTokenExpiresAt: auth?.expiresAt ?? null,
+    }
+  }
+
+  function logout() {
+    pollGeneration++ // 终止进行中的 poll：代际失效，授权晚到也不落盘
+    storeGeneration++ // 终止在飞 refresh：其落盘前的代际校验必然失败
+    writeAuth({})
+    reloginNeeded = false
+    oauthPending.active = false
+    oauthPending.error = ''
+  }
+
+  return { resolveOAuthCredential, startOAuth, oauthStatus, logout }
+}

package/providers/deepseek/index.js

@@ -0,0 +1,11 @@
+import { createOpenAICompatProvider } from '../openai-compat.js'
+
+/**
+ * DeepSeek 官方 preset。2026-09-11 实测：GET /models 假 key 401
+ * （authentication_error），标准 OpenAI 目录，验 key 即拿目录。
+ */
+export default createOpenAICompatProvider({
+  id: 'deepseek',
+  displayName: 'DeepSeek 官方',
+  baseURL: 'https://api.deepseek.com/v1',
+})

package/providers/moonshot/index.js

@@ -0,0 +1,11 @@
+import { createOpenAICompatProvider } from '../openai-compat.js'
+
+/**
+ * Moonshot AI（Kimi）preset。2026-09-11 实测：GET /models 假 key 401
+ * （invalid_authentication_error），标准 OpenAI 目录。
+ */
+export default createOpenAICompatProvider({
+  id: 'moonshot',
+  displayName: 'Moonshot AI',
+  baseURL: 'https://api.moonshot.cn/v1',
+})