pi2dsh 0.15.2 → 0.16.0

package/dist/{runtime-BlbKWw7W.mjs → runtime-C6_pOPmL.mjs}

@@ -1,9 +1,9 @@
 
-import { En as PiCapabilityError, F as generateBranchSummary, Tn as CapabilityLedger, b as Theme, d as ExtensionRunner, w as __runWithSubagentSessionFactory } from "./pi-coding-agent-DK8hbJP5.mjs";
+import { En as PiCapabilityError, F as generateBranchSummary, Tn as CapabilityLedger, b as Theme, d as ExtensionRunner, w as __runWithSubagentSessionFactory } from "./pi-coding-agent-f3_hNCpd.mjs";
 import { t as getAgentDir } from "./pi-config-shim-CZ1wFzqM.mjs";
-import { $ as isContextOverflow, Q as AssistantMessageEventStream, S as getSupportedThinkingLevels, c as builtinProviders, o as __runWithPiAiRuntime, r as __createPiAiRuntimeRegistry } from "./pi-ai-DpqiLdPA.mjs";
+import { $ as AssistantMessageEventStream, S as getSupportedThinkingLevels, c as builtinProviders, et as isContextOverflow, o as __runWithPiAiRuntime, r as __createPiAiRuntimeRegistry } from "./pi-ai-DQPHUR9S.mjs";
 import { W as getKeybindings, _t as stripTerminalSequences } from "./pi-tui-DruSeKmd.mjs";
-import { a as FileCredentialStore, c as providerSupportsOAuth, i as oauthCredentialRef, l as resolvePiProviderAuth, o as joinSignals, s as loginPiProvider, u as storedOAuthCredential } from "./credentials-oauth-Didpkkjx.mjs";
+import { c as resolvePiProviderAuth, i as oauthCredentialRef, l as storedOAuthCredential, n as joinSignals, o as providerSupportsOAuth, r as loginPiProvider, t as FileCredentialStore } from "./oauth-bridge-C_MAPMGA.mjs";
 import { createRequire } from "node:module";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
@@ -5172,6 +5172,197 @@ async function discoverProviderModels(ctx, state, name, value) {
 		if (state.shared.providerModelDiscoveries.get(name) === task) state.shared.providerModelDiscoveries.delete(name);
 	}
 }
+/**
+* Run one provider's own OAuth login end to end — the shared spine behind
+* the /login command and the DSH authorization-seam flow. Owns the
+* host-wide single-flight (the fixed callback port), the short-link
+* publication, and the post-login route + catalog refresh.
+* @returns the user-facing summary line.
+*/
+async function runProviderLogin(ctx, state, providerId, config, ui, externalSignal) {
+	const oauthName = config.oauth?.name ?? providerId;
+	const superseded = await supersedeActiveLogin(state);
+	if (superseded !== void 0) ui.notify(`Cancelled the ${superseded} login that was still waiting.`);
+	const active = {
+		providerName: oauthName,
+		controller: new AbortController(),
+		finished: Promise.resolve(),
+		published: []
+	};
+	if (externalSignal !== void 0) {
+		if (externalSignal.aborted) active.controller.abort();
+		else externalSignal.addEventListener("abort", () => active.controller.abort(), { once: true });
+	}
+	const attempt = loginPiProvider({
+		open: openBrowser,
+		shorten: (url) => {
+			const path = publishAuthorization(url);
+			const web = ctx.get("webServer");
+			if (path === void 0 || web?.port === void 0) return void 0;
+			active.published.push(path);
+			return `http://${web.host === "0.0.0.0" || web.host === void 0 ? "127.0.0.1" : web.host}:${web.port}${path}`;
+		},
+		providerId,
+		providerName: oauthName,
+		providerConfig: config,
+		store: oauthStoreOf(state),
+		ui,
+		signal: active.controller.signal
+	});
+	active.finished = attempt.then(() => void 0, () => void 0);
+	state.shared.activeLogin = active;
+	try {
+		await attempt;
+	} finally {
+		for (const path of active.published) revokeAuthorization(path);
+		if (state.shared.activeLogin === active) state.shared.activeLogin = void 0;
+	}
+	const declared = await ensureLoggedInProviderRoute(ctx, state, providerId, config);
+	const discovered = await discoverProviderModels(ctx, state, providerId, config) ?? (declared ? await llmOf(ctx)?.listModels(providerId).then((list) => list.length).catch(() => void 0) : void 0);
+	const models = discovered === void 0 ? "" : `; ${discovered} models available`;
+	ui.notify(`Logged in to ${oauthName}${models}`);
+	return `Logged in to ${oauthName}${models}`;
+}
+/**
+* Project one provider's OAuth login onto DSH's official authorization seam
+* (`ctx.authorization`, 0.1.1 line). The flow runs the SAME login spine as
+* /login; the DSH sign-in surface supplies the interaction. On hosts without
+* the seam (rc.8 line) this is a no-op and /login stays the only entry.
+*
+* The credential itself stays in the bridge's Pi-format store — the DSH
+* credential record written at the end is the seam's commit witness (the
+* service verifies it observed a record update for the flow's key), and the
+* official sign-out (`deleteRecord`) is mirrored back into the Pi store by
+* the watcher below.
+*
+* Same id under another scope (the official llm-pi-ai catalog registers
+* sign-ins for its whole catalog) is NOT a conflict: flows are keyed by
+* scope/id exactly so registrars can coexist, and the credential spaces
+* really are separate — signing in through the official flow lands a record
+* only llm-pi-ai routes can use, while this flow authorizes the routes the
+* bridge actually serves (package transports and logged-in builtins).
+* Standing down here would leave those routes unreachable from the native
+* surface. The label carries "(pi2dsh)" so a future surface shows whose
+* sign-in each entry is. Only our own exact key is defended: a collision on
+* `pi2dsh/<id>` throws in registerFlow and degrades to /login-only.
+*
+* Composition order is not ours to assume: the stock 0.1.1 compositions ship
+* the authorization package without composing it, so the service may appear
+* (or bounce) at any time after this provider registers. The official
+* pattern — the one llm-pi-ai itself uses — is `ctx.inject(['authorization',
+* ...], cb)`: cordis mounts the callback when the services are present,
+* disposes everything it registered when they leave, and mounts it again if
+* they return. The scope hangs off the CALLING ctx, so a flow projected for
+* a package's provider dies with that package, and a built-in entry's flow
+* dies with the engine.
+*/
+function maybeProjectAuthorizationFlow(ctx, state, providerId) {
+	const shared = state.shared;
+	shared.authorizationArmedIds ??= /* @__PURE__ */ new Set();
+	if (shared.authorizationArmedIds.has(providerId)) return;
+	const inject = ctx.inject;
+	if (typeof inject !== "function") return;
+	shared.authorizationArmedIds.add(providerId);
+	inject.call(ctx, ["authorization", "credentials"], (scope) => {
+		projectAuthorizationFlow(scope, state, providerId);
+	});
+}
+/** The per-mount half: services are present on `scope`, register the flow and
+* this provider's sign-out mirror. Everything registered here is disposed by
+* cordis with the scope. */
+async function projectAuthorizationFlow(scope, state, providerId) {
+	const shared = state.shared;
+	const ctx = scope;
+	const authorization = optionalService(ctx, "authorization");
+	const credentials = optionalService(ctx, "credentials");
+	if (authorization === void 0 || credentials === void 0) return;
+	try {
+		const { credentialKey, isCredentialKeySegment } = await import("@deepseek-ai/dsh-credentials");
+		if (credentialKey === void 0 || isCredentialKeySegment === void 0) return;
+		if (!isCredentialKeySegment(providerId)) {
+			logger(ctx).warn(`[pi2dsh] provider ${JSON.stringify(providerId)} cannot appear on the DSH sign-in surface (its id is outside the credential-key grammar); /login still works`);
+			return;
+		}
+		const canonicalOf = () => shared.providers.get(providerId) ?? {};
+		const labelOf = () => canonicalOf().oauth?.name ?? providerId;
+		const key = credentialKey("pi2dsh", providerId);
+		authorization.registerFlow({
+			key,
+			label: `${labelOf()} (pi2dsh)`,
+			methods: [{
+				id: "oauth",
+				label: `Sign in to ${labelOf()}`
+			}],
+			run: async (session) => {
+				const ui = {
+					notify: (message) => {
+						session.notify({ message: String(message) });
+					},
+					input: async (title, _placeholder, promptSignal) => {
+						try {
+							return await session.prompt({
+								kind: "text",
+								message: String(title),
+								...promptSignal instanceof AbortSignal ? { signal: promptSignal } : {}
+							});
+						} catch (error) {
+							if (promptSignal instanceof AbortSignal && promptSignal.aborted) return void 0;
+							throw error;
+						}
+					},
+					select: async (title, options, promptSignal) => {
+						try {
+							return await session.prompt({
+								kind: "select",
+								message: String(title),
+								options: options.map((option) => ({
+									id: String(option),
+									label: String(option)
+								})),
+								...promptSignal instanceof AbortSignal ? { signal: promptSignal } : {}
+							});
+						} catch (error) {
+							if (promptSignal instanceof AbortSignal && promptSignal.aborted) return void 0;
+							throw error;
+						}
+					},
+					deviceCode: async (title, detail) => {
+						session.notify({
+							message: String(title),
+							code: String(detail)
+						});
+					}
+				};
+				const canonical = canonicalOf();
+				if (!providerSupportsOAuth(canonical)) throw new Error(`${providerId} no longer supports OAuth login`);
+				await runProviderLogin(ctx, state, providerId, canonical, ui, session.signal);
+				await credentials.modifyRecord(key, async () => ({
+					kind: "grant",
+					payload: {
+						provider: providerId,
+						managedBy: "pi2dsh"
+					}
+				}));
+			}
+		});
+		ctx.on("credentials/record-updated", (eventKey) => {
+			(async () => {
+				try {
+					if (String(eventKey) !== String(key)) return;
+					if (await credentials.readRecord(key) !== void 0) return;
+					await oauthStoreOf(state).delete(providerId);
+					const canonical = shared.providers.get(providerId);
+					if (canonical !== void 0 && !providerCarriesTransport(canonical)) retireSharedProviderRoute(shared, providerId);
+					logger(ctx).info(`[pi2dsh] signed out of ${providerId}: the DSH credential record was deleted, so the bridge's stored login was removed`);
+				} catch (error) {
+					logger(ctx).warn(`[pi2dsh] sign-out mirror failed: ${error instanceof Error ? error.message : String(error)}`);
+				}
+			})();
+		});
+	} catch (error) {
+		logger(ctx).warn(`[pi2dsh] could not project ${JSON.stringify(providerId)} onto the DSH sign-in surface: ${error instanceof Error ? error.message : String(error)}; /login still works`);
+	}
+}
 function registerLoginCommand(ctx, state) {
 	registerCommand(ctx, state, {
 		name: "login",
@@ -5187,49 +5378,7 @@ function registerLoginCommand(ctx, state) {
 			const providerId = resolveOfferedChoice(answer, oauthProviders);
 			const config = providerId === void 0 ? void 0 : state.providers.get(providerId);
 			if (providerId === void 0 || config === void 0 || !providerSupportsOAuth(config)) throw new Error(`unknown OAuth provider ${JSON.stringify(answer)}; available: ${oauthProviders.join(", ")}`);
-			const oauthName = config.oauth?.name ?? providerId;
-			const commandSignal = commandContext.signal;
-			const superseded = await supersedeActiveLogin(state);
-			if (superseded !== void 0) ui.notify(`Cancelled the ${superseded} login that was still waiting.`);
-			const active = {
-				providerName: oauthName,
-				controller: new AbortController(),
-				finished: Promise.resolve(),
-				published: []
-			};
-			if (commandSignal !== void 0) {
-				if (commandSignal.aborted) active.controller.abort();
-				else commandSignal.addEventListener("abort", () => active.controller.abort(), { once: true });
-			}
-			const attempt = loginPiProvider({
-				open: openBrowser,
-				shorten: (url) => {
-					const path = publishAuthorization(url);
-					const web = ctx.get("webServer");
-					if (path === void 0 || web?.port === void 0) return void 0;
-					active.published.push(path);
-					return `http://${web.host === "0.0.0.0" || web.host === void 0 ? "127.0.0.1" : web.host}:${web.port}${path}`;
-				},
-				providerId,
-				providerName: oauthName,
-				providerConfig: config,
-				store: oauthStoreOf(state),
-				ui,
-				signal: active.controller.signal
-			});
-			active.finished = attempt.then(() => void 0, () => void 0);
-			state.shared.activeLogin = active;
-			try {
-				await attempt;
-			} finally {
-				for (const path of active.published) revokeAuthorization(path);
-				if (state.shared.activeLogin === active) state.shared.activeLogin = void 0;
-			}
-			const declared = await ensureLoggedInProviderRoute(ctx, state, providerId, config);
-			const discovered = await discoverProviderModels(ctx, state, providerId, config) ?? (declared ? await llmOf(ctx)?.listModels(providerId).then((list) => list.length).catch(() => void 0) : void 0);
-			const models = discovered === void 0 ? "" : `; ${discovered} models available`;
-			ui.notify(`Logged in to ${oauthName}${models}`);
-			return `Logged in to ${oauthName}${models}`;
+			return await runProviderLogin(ctx, state, providerId, config, ui, commandContext.signal);
 		}
 	});
 }
@@ -5733,6 +5882,7 @@ function createPiApi(ctx, state) {
 			const canonical = state.shared.providers.get(name) ?? value;
 			if (providerSupportsOAuth(canonical)) {
 				ensureLoginCommand(ctx, state);
+				maybeProjectAuthorizationFlow(ctx, state, name);
 				logger(ctx).info(`[pi2dsh] Pi provider ${JSON.stringify(name)} supports OAuth — log in with /login ${name}`);
 			}
 			if (registerSharedProviderRoute(ctx, state, name, canonical) !== void 0) {
@@ -6105,6 +6255,7 @@ async function applyPiPackage(ctx, options) {
 			shared.providerBuiltins.set(provider.id, config);
 			recomposeSharedProvider(shared, provider.id);
 		}
+		maybeProjectAuthorizationFlow(ctx, state, provider.id);
 	}
 	ensureLoginCommand(ctx, state);
 	for (const [name, config] of [...state.providers]) try {
@@ -6286,4 +6437,4 @@ const runtimeInternals = {
 //#endregion
 export { registerVisionCompanions as a, overlayProviderConfig as i, mergeProviderRegistration as n, runtimeInternals as o, normalizeToolSchema as r, applyPiPackage as t };
 
-//# sourceMappingURL=runtime-BlbKWw7W.mjs.map
+//# sourceMappingURL=runtime-C6_pOPmL.mjs.map