feat(providers): add DeepSeek account OAuth sign-in (#1548)

Add a built-in "DeepSeek account" provider next to ChatGPT, Grok and Claude
official sign-in. Login follows the DeepSeek Harness flow: PKCE through the
platform's auth_init / auth_exchange endpoints with a loopback callback. The
resulting opaque account token is stored 0600 and sent as x-dsh-auth-token to
the existing api.deepseek.com/anthropic endpoint, so no protocol translation
or refresh is needed.

- the CLI fetch layer swaps the Anthropic key headers for the account token
  per request, only for the DeepSeek inference origin, with redirects refused
  and a local non-retryable 401 when signed out
- grants from a non-production platform origin or dsh_mock_ tokens never
  authenticate production requests
- sign-out is local first and revokes remotely; a superseded or failed login
  revokes the token it minted
- settings status re-checks the grant with the platform and treats only an
  explicit rejection as signed out
- desktop: settings card with login risk confirmation, model selector and
  empty session entry, five locales; docs updated

Author: NanmiCoder

desktop/src/__tests__/generalSettings.test.tsx

@@ -2325,6 +2325,7 @@ describe('Settings > Providers tab', () => {
       'openai-official-provider',
       'claude-official-provider',
       'grok-official-provider',
+      'deepseek-account-provider',
     ])
   })
 
@@ -2340,6 +2341,7 @@ describe('Settings > Providers tab', () => {
       'claude-official-provider',
       'openai-official-provider',
       'grok-official-provider',
+      'deepseek-account-provider',
     ])
   })
 

desktop/src/api/hahaDeepSeekOAuth.test.ts

@@ -0,0 +1,42 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { postMock, getMock, deleteMock } = vi.hoisted(() => ({
+  postMock: vi.fn(),
+  getMock: vi.fn(),
+  deleteMock: vi.fn(),
+}))
+
+vi.mock('./client', () => ({
+  api: { post: postMock, get: getMock, delete: deleteMock },
+}))
+
+import { hahaDeepSeekOAuthApi } from './hahaDeepSeekOAuth'
+
+describe('hahaDeepSeekOAuthApi', () => {
+  beforeEach(() => {
+    postMock.mockReset()
+    getMock.mockReset()
+    deleteMock.mockReset()
+  })
+
+  it('starts the login with an empty body, adding the locale only when given', async () => {
+    postMock.mockResolvedValue({ authorizeUrl: 'https://example.invalid/auth', state: 's' })
+
+    await hahaDeepSeekOAuthApi.start()
+    await hahaDeepSeekOAuthApi.start('zh-TW')
+
+    expect(postMock).toHaveBeenNthCalledWith(1, '/api/haha-deepseek-oauth/start', {})
+    expect(postMock).toHaveBeenNthCalledWith(2, '/api/haha-deepseek-oauth/start', { locale: 'zh-TW' })
+  })
+
+  it('reads the status and logs out on the same base path', async () => {
+    getMock.mockResolvedValue({ loggedIn: false })
+    deleteMock.mockResolvedValue({ ok: true })
+
+    await hahaDeepSeekOAuthApi.status()
+    await hahaDeepSeekOAuthApi.logout()
+
+    expect(getMock).toHaveBeenCalledWith('/api/haha-deepseek-oauth')
+    expect(deleteMock).toHaveBeenCalledWith('/api/haha-deepseek-oauth')
+  })
+})

desktop/src/api/hahaDeepSeekOAuth.ts

@@ -0,0 +1,28 @@
+import { api } from './client'
+
+export type HahaDeepSeekOAuthStatus =
+  | { loggedIn: false }
+  | {
+      loggedIn: true
+      name: string | null
+      /** Masked email or mobile number of the signed-in account. */
+      contact: string | null
+    }
+
+export const hahaDeepSeekOAuthApi = {
+  /** `locale` only picks the language of the DeepSeek login page. */
+  start(locale?: string) {
+    return api.post<{ authorizeUrl: string; state: string }>(
+      '/api/haha-deepseek-oauth/start',
+      locale ? { locale } : {},
+    )
+  },
+
+  status() {
+    return api.get<HahaDeepSeekOAuthStatus>('/api/haha-deepseek-oauth')
+  },
+
+  logout() {
+    return api.delete<{ ok: true }>('/api/haha-deepseek-oauth')
+  },
+}

desktop/src/api/providers.ts

@@ -22,7 +22,7 @@ type TestResultResponse = { result: ProviderTestResult }
 type OfficialProviderModelsResponse = { models: ModelMapping }
 type AuthStatusResponse = {
   hasAuth: boolean
-  source: 'cc-haha-provider' | 'claude-oauth' | 'openai-oauth' | 'grok-oauth' | 'original-settings' | 'env' | 'none'
+  source: 'cc-haha-provider' | 'claude-oauth' | 'openai-oauth' | 'grok-oauth' | 'deepseek-oauth' | 'original-settings' | 'env' | 'none'
   activeProvider?: string
 }
 

desktop/src/components/controls/ModelSelector.test.tsx

@@ -20,6 +20,7 @@ import { useChatStore } from '../../stores/chatStore'
 import { useHahaOAuthStore } from '../../stores/hahaOAuthStore'
 import { useHahaOpenAIOAuthStore } from '../../stores/hahaOpenAIOAuthStore'
 import { useHahaGrokOAuthStore } from '../../stores/hahaGrokOAuthStore'
+import { useHahaDeepSeekOAuthStore } from '../../stores/hahaDeepSeekOAuthStore'
 import { useProviderStore } from '../../stores/providerStore'
 import { useSessionRuntimeStore } from '../../stores/sessionRuntimeStore'
 import { useSettingsStore } from '../../stores/settingsStore'
@@ -52,6 +53,7 @@ afterEach(() => {
   useHahaOAuthStore.setState(useHahaOAuthStore.getInitialState(), true)
   useHahaOpenAIOAuthStore.setState(useHahaOpenAIOAuthStore.getInitialState(), true)
   useHahaGrokOAuthStore.setState(useHahaGrokOAuthStore.getInitialState(), true)
+  useHahaDeepSeekOAuthStore.setState(useHahaDeepSeekOAuthStore.getInitialState(), true)
   useTabStore.setState(useTabStore.getInitialState(), true)
   useUIStore.setState(useUIStore.getInitialState(), true)
 })
@@ -60,6 +62,7 @@ beforeEach(() => {
   useHahaOAuthStore.setState({ fetchStatus: async () => {} })
   useHahaOpenAIOAuthStore.setState({ fetchStatus: async () => {} })
   useHahaGrokOAuthStore.setState({ fetchStatus: async () => {} })
+  useHahaDeepSeekOAuthStore.setState({ fetchStatus: async () => {} })
 })
 
 describe('ModelSelector', () => {
@@ -356,9 +359,13 @@ describe('ModelSelector', () => {
     const fetchGrokStatus = vi.fn(async () => {
       useHahaGrokOAuthStore.setState({ status: { loggedIn: false } })
     })
+    const fetchDeepSeekStatus = vi.fn(async () => {
+      useHahaDeepSeekOAuthStore.setState({ status: { loggedIn: false } })
+    })
     useHahaOAuthStore.setState({ fetchStatus: fetchClaudeStatus })
     useHahaOpenAIOAuthStore.setState({ fetchStatus: fetchOpenAIStatus })
     useHahaGrokOAuthStore.setState({ fetchStatus: fetchGrokStatus })
+    useHahaDeepSeekOAuthStore.setState({ fetchStatus: fetchDeepSeekStatus })
     useSettingsStore.setState({
       locale: 'en',
       availableModels: MODELS,
@@ -391,6 +398,7 @@ describe('ModelSelector', () => {
     expect(fetchClaudeStatus).toHaveBeenCalledTimes(1)
     expect(fetchOpenAIStatus).toHaveBeenCalledTimes(1)
     expect(fetchGrokStatus).toHaveBeenCalledTimes(1)
+    expect(fetchDeepSeekStatus).toHaveBeenCalledTimes(1)
     expect(useTabStore.getState().activeTabId).toBe(SETTINGS_TAB_ID)
     expect(screen.queryByTestId('model-selector-dropdown')).not.toBeInTheDocument()
   })
@@ -399,9 +407,11 @@ describe('ModelSelector', () => {
     const fetchClaudeStatus = vi.fn(async () => {})
     const fetchOpenAIStatus = vi.fn(async () => {})
     const fetchGrokStatus = vi.fn(async () => {})
+    const fetchDeepSeekStatus = vi.fn(async () => {})
     useHahaOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: fetchClaudeStatus })
     useHahaOpenAIOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: fetchOpenAIStatus })
     useHahaGrokOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: fetchGrokStatus })
+    useHahaDeepSeekOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: fetchDeepSeekStatus })
     useSettingsStore.setState({
       locale: 'en',
       currentModel: {
@@ -424,6 +434,7 @@ describe('ModelSelector', () => {
     expect(fetchClaudeStatus).not.toHaveBeenCalled()
     expect(fetchOpenAIStatus).not.toHaveBeenCalled()
     expect(fetchGrokStatus).not.toHaveBeenCalled()
+    expect(fetchDeepSeekStatus).not.toHaveBeenCalled()
     expect(useUIStore.getState().pendingSettingsTab).toBe('providers')
     expect(useTabStore.getState().activeTabId).toBe(SETTINGS_TAB_ID)
   })
@@ -1373,6 +1384,147 @@ describe('ModelSelector', () => {
     expect(screen.queryByRole('button', { name: /Effort:/i })).not.toBeInTheDocument()
   })
 
+  describe('DeepSeek Account', () => {
+    const savedProvider = {
+      id: 'provider-a',
+      presetId: 'custom',
+      name: 'Provider A',
+      apiKey: '***',
+      baseUrl: 'https://api.example.com',
+      apiFormat: 'anthropic' as const,
+      models: { main: 'provider-main', haiku: '', sonnet: '', opus: '' },
+    }
+
+    function useSavedProviderActive() {
+      useSettingsStore.setState({
+        locale: 'en',
+        availableModels: MODELS,
+        currentModel: MODELS[0],
+        activeProviderName: 'Provider A',
+      })
+      useProviderStore.setState({
+        providers: [savedProvider],
+        activeId: 'provider-a',
+        hasLoadedProviders: true,
+        isLoading: false,
+      })
+      useHahaOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+      useHahaOpenAIOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+      useHahaGrokOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+    }
+
+    it('does not offer DeepSeek Account models while signed out', async () => {
+      useSavedProviderActive()
+      useHahaDeepSeekOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+
+      render(<ModelSelector runtimeKey="session-ds-out" />)
+      await clickByRole(/provider-main/i)
+
+      const dropdown = screen.getByTestId('model-selector-dropdown')
+      expect(dropdown.textContent).toContain('Provider A')
+      expect(dropdown.textContent).not.toContain('DeepSeek Account')
+      expect(dropdown.textContent).not.toContain('deepseek-v4')
+    })
+
+    it('lists the bundled DeepSeek models once signed in and selects one for the session', async () => {
+      useSavedProviderActive()
+      useHahaDeepSeekOAuthStore.setState({
+        status: { loggedIn: true, name: 'Ada', contact: 'a***@example.com' },
+        fetchStatus: async () => {},
+      })
+
+      render(<ModelSelector runtimeKey="session-ds-in" />)
+      await clickByRole(/provider-main/i)
+
+      const dropdown = screen.getByTestId('model-selector-dropdown')
+      expect(dropdown.textContent).toContain('DeepSeek Account')
+      expect(within(dropdown).getByRole('button', { name: /deepseek-v4-pro\[1m\]/ })).toBeInTheDocument()
+      await act(async () => {
+        fireEvent.click(within(dropdown).getByRole('button', { name: /deepseek-v4-flash/ }))
+        await Promise.resolve()
+      })
+
+      expect(useSessionRuntimeStore.getState().selections['session-ds-in']).toMatchObject({
+        providerId: 'deepseek-account',
+        modelId: 'deepseek-v4-flash',
+      })
+    })
+
+    it('keeps a restored DeepSeek Account selection instead of falling back to the saved provider', () => {
+      useSavedProviderActive()
+      useHahaDeepSeekOAuthStore.setState({ status: null, fetchStatus: async () => {} })
+      useSessionRuntimeStore.getState().setSelection('session-ds-restored', {
+        providerId: 'deepseek-account',
+        modelId: 'deepseek-v4-pro[1m]',
+      })
+
+      render(<ModelSelector runtimeKey="session-ds-restored" />)
+
+      expect(screen.getByRole('button', { name: /deepseek-v4-pro\[1m\], DeepSeek Account/ })).toBeInTheDocument()
+    })
+
+    it('fetches the DeepSeek sign-in status when the selector opens', async () => {
+      useSavedProviderActive()
+      const fetchStatus = vi.fn(async () => {})
+      useHahaDeepSeekOAuthStore.setState({ status: null, fetchStatus })
+
+      render(<ModelSelector runtimeKey="session-ds-lazy" />)
+      expect(fetchStatus).not.toHaveBeenCalled()
+      await clickByRole(/provider-main/i)
+
+      expect(fetchStatus).toHaveBeenCalledTimes(1)
+    })
+
+    it('opens the selector instead of routing to settings when DeepSeek is the only login', async () => {
+      useSettingsStore.setState({ locale: 'en', currentModel: undefined, activeProviderName: null })
+      useProviderStore.setState({ providers: [], activeId: null, hasLoadedProviders: true, isLoading: false })
+      useHahaOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+      useHahaOpenAIOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+      useHahaGrokOAuthStore.setState({ status: { loggedIn: false }, fetchStatus: async () => {} })
+      useHahaDeepSeekOAuthStore.setState({
+        status: { loggedIn: true, name: null, contact: null },
+        fetchStatus: async () => {},
+      })
+
+      render(<ModelSelector runtimeKey="session-ds-only" />)
+      await act(async () => {
+        fireEvent.click(screen.getByRole('button'))
+        await Promise.resolve()
+      })
+
+      expect(useUIStore.getState().pendingSettingsTab).not.toBe('providers')
+      expect(screen.getByTestId('model-selector-dropdown').textContent).toContain('DeepSeek Account')
+    })
+
+    it('opens the selector after the status fetch finds a DeepSeek login nobody had checked yet', async () => {
+      useSettingsStore.setState({ locale: 'en', currentModel: undefined, activeProviderName: null })
+      useProviderStore.setState({ providers: [], activeId: null, hasLoadedProviders: true, isLoading: false })
+      useHahaOAuthStore.setState({ status: null, fetchStatus: async () => {
+        useHahaOAuthStore.setState({ status: { loggedIn: false } })
+      } })
+      useHahaOpenAIOAuthStore.setState({ status: null, fetchStatus: async () => {
+        useHahaOpenAIOAuthStore.setState({ status: { loggedIn: false } })
+      } })
+      useHahaGrokOAuthStore.setState({ status: null, fetchStatus: async () => {
+        useHahaGrokOAuthStore.setState({ status: { loggedIn: false } })
+      } })
+      useHahaDeepSeekOAuthStore.setState({ status: null, fetchStatus: async () => {
+        useHahaDeepSeekOAuthStore.setState({ status: { loggedIn: true, name: null, contact: null } })
+      } })
+
+      render(<ModelSelector runtimeKey="session-ds-late" />)
+      await act(async () => {
+        fireEvent.click(screen.getByRole('button'))
+        await Promise.resolve()
+      })
+
+      await waitFor(() => {
+        expect(screen.getByTestId('model-selector-dropdown').textContent).toContain('DeepSeek Account')
+      })
+      expect(useUIStore.getState().pendingSettingsTab).not.toBe('providers')
+    })
+  })
+
   it('replaces a stale Grok runtime model with the current official default', async () => {
     const grokModels: ModelInfo[] = [{
       id: 'grok-4.7',