@gatemux/dsh-gatemux-login 1.0.2 → 1.0.4

package/README.md

@@ -12,7 +12,8 @@ composed profile:
 - Adds a GateMux account service that signs you in through GateMux's OAuth 2.0
   redirect flow (authorization code with PKCE `S256`).
 - Registers a model route, provider id `gatemux-account`, that authenticates every
-  request with your own credential.
+  request with your own credential and advertises the models the endpoint reports
+  it serves.
 - Turns off the shipped vendor account route (`deepseek-account` and
   `llm-deepseek-account`) so there is one account provider instead of two.
 
@@ -22,8 +23,8 @@ keep another default.
 
 ## Requirements
 
-- DeepSeek Harness desktop app, `0.1.7.x`.
-  The plugin declares `@deepseek-ai/dsh-*` peer dependencies pinned to that line.
+- DeepSeek Harness desktop app, `0.1.7.x` or `0.2.x`.
+  The plugin declares `@deepseek-ai/dsh-*` peer dependencies across both lines.
   A different DSH release is rejected at install time; installing anyway needs a
   version exemption, which risks crashes and data loss.
 - A GateMux account.
@@ -70,12 +71,35 @@ never auto-closes; you can close it once the app is signed in.
 
 ## Models
 
+Once you are signed in, the route reads what the endpoint serves from
+`https://rest.gatemux.ai/v1/models` and advertises every entry whose `protocols`
+include `anthropic-messages`. An entry served over any other protocol is left
+out, because every request this route makes speaks the Messages protocol: a
+model that speaks only `openai-completions` would fail on every request, so
+offering it in the model selector would be offering a choice that cannot work.
+
+Context window, output cap, display name, and image input come from the listing.
+
+### Fallback catalog
+
+The bundle's patch layer also declares two models, which the route advertises
+before you sign in and keeps when a listing read fails:
+
 | Model id | Context | Input |
 |---|---|---|
 | `gatemux/deepseek-v4-flash` | 1,000,000 | text, image |
 | `gatemux/deepseek-v4-pro` | 1,000,000 | text |
 
-Both are served from `https://rest.gatemux.ai/v1`.
+A failed read is logged as a warning and leaves the last catalog that was read
+successfully in force, so a listing outage never empties the model selector or
+drops the provider from it. Before the first successful read, the declared
+catalog above is what the route advertises.
+
+For a model the endpoint also lists, every field the declaration states wins and
+the endpoint fills the rest. `gatemux/deepseek-v4-flash` therefore keeps the
+declared 1,000,000-token context window and image input while taking its output
+cap from the endpoint. A declared model the endpoint does not list is still
+advertised.
 
 ## Changing the default model
 
@@ -105,7 +129,7 @@ module or the patch is skipped.
 | `ACCOUNT_QUOTA_EXCEEDED` | Your GateMux balance or spend cap is exhausted. Top up. |
 | `ip_not_allowed` (HTTP 403) | Your network is not in the GateMux application's trusted egress IP allowlist. Contact the plugin operator. Re-authorizing will not fix it. |
 | `scope_denied`, `model_not_allowed` (HTTP 403) | The application registration does not permit this request. Contact the plugin operator. |
-| Install refused for peer dependencies | Your DSH version is outside `0.1.7.x`. |
+| Install refused for peer dependencies | Your DSH version is outside `0.1.7.x` and `0.2.x`. |
 
 403 errors are reported as authorization faults, not retried: they are
 configuration problems on the application's side.

package/account.js

@@ -20,6 +20,7 @@
  */
 
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto'
+import { platform, release } from 'node:os'
 import { promises as streamPromises } from 'node:stream'
 
 import { Service } from '@deepseek-ai/cordis'
@@ -393,6 +394,27 @@ export class GateMuxAccount extends DeepSeekAccount {
     return null
   }
 
+  /**
+   * Read the signed-in account ID without a request and without credentials.
+   *
+   * GateMux registers no device, so `deviceId` is omitted rather than invented.
+   * The ID comes from the last successful profile read for this same grant; a
+   * caller that reads it before that profile read gets the OS version alone.
+   *
+   * @returns the Node platform version, plus the account ID while a profile for the stored grant is cached.
+   */
+  async getDeviceIdentity() {
+    const lifetime = this.detailsLifetime
+    const grant = await this.readGrant(lifetime)
+    const profile = grant !== null && this.lastProfile?.token === grant.accessToken
+      ? this.lastProfile.profile
+      : null
+    return {
+      ...(profile?.id == null ? {} : { userId: profile.id }),
+      osVersion: `${platform()} ${release()}`,
+    }
+  }
+
   /**
    * Run one authorization attempt: PKCE, browser callback, code exchange, commit.
    * @param session - the attempt's cancellation signal and commit channel.

package/llm.js

@@ -9,9 +9,11 @@
  * already claims that route with the application's server key, and claiming it
  * twice would throw `DUPLICATE_ADAPTER` and break plugin loading.
  *
- * Endpoint, model catalog, and retry policy come from this entry's `config` in
- * `cordis.patch.yml`, so the composition remains the single source of truth for
- * deployment choices.
+ * Endpoint, retry policy, and the fallback catalog come from this entry's
+ * `config` in `cordis.patch.yml`, so the composition remains the single source
+ * of truth for deployment choices. Which models the route serves is read from
+ * the endpoint's `/v1/models` listing instead; see `mergeCatalog` for how the
+ * two combine.
  *
  * @module @gatemux/dsh-gatemux-login/llm
  */
@@ -27,6 +29,107 @@ export const PROVIDER = 'gatemux-account'
 export const name = 'gatemux-account'
 export const inject = ['llm']
 
+/** Listing value a model must carry to be reachable through this route's Messages transport. */
+const MESSAGES_PROTOCOL = 'anthropic-messages'
+
+/** Protocol version this transport sends on every request, the model listing included. */
+const ANTHROPIC_VERSION = '2023-06-01'
+
+/**
+ * Anthropic's listing path, read from a Messages base URL.
+ *
+ * The listing lives at `{root}/v1/models`, where the root is the base without a
+ * trailing slash and without one trailing `/v1` segment; GateMux publishes both
+ * spellings of the same root. `messagesApiRoot` implements this normalization
+ * for the transport but is not exported from the package, so the rule is
+ * restated here rather than pulled in through a deep import.
+ *
+ * @param baseURL - the route's configured Messages base URL.
+ * @returns the absolute model listing URL.
+ */
+function listingUrl(baseURL) {
+  const base = baseURL.replace(/\/+$/u, '')
+  return `${base.endsWith('/v1') ? base.slice(0, -3) : base}/v1/models`
+}
+
+/**
+ * Read one positive catalog number, treating a missing, null, or unusable value as absent.
+ * @param value - candidate field from a listing entry.
+ * @returns the number, or `undefined` when the endpoint did not state a usable one.
+ */
+function positiveInteger(value) {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : undefined
+}
+
+/**
+ * Read one non-empty catalog string, treating anything else as absent.
+ * @param value - candidate field from a listing entry.
+ * @returns the string, or `undefined` when the endpoint did not state a usable one.
+ */
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0 ? value : undefined
+}
+
+/**
+ * Project one listing entry into a catalog entry, or drop it as unserved.
+ *
+ * `protocols` is the criterion, not `category`: a chat model is not
+ * necessarily reachable through `/v1/messages`. GateMux reports `kimi-k3` as a
+ * chat model that speaks only `openai-completions`, and advertising it here
+ * would offer the user a model every request to this route fails on.
+ *
+ * @param entry - one element of the listing's `data` array.
+ * @returns the catalog entry, or `undefined` when this route cannot serve it.
+ */
+function servedModel(entry) {
+  if (entry === null || typeof entry !== 'object') return undefined
+  const id = nonEmptyString(entry.id)
+  const protocols = Array.isArray(entry.protocols) ? entry.protocols : []
+  if (id === undefined || !protocols.includes(MESSAGES_PROTOCOL)) return undefined
+  const name = nonEmptyString(entry.name)
+  const contextWindow = positiveInteger(entry.contextWindow)
+  const maxTokens = positiveInteger(entry.maxTokens)
+  // `capabilities` describes the model; `inputModalities` describes what this
+  // transport may send. Only vision is projected, because a model advertising
+  // image input that the endpoint rejects would fail on every later turn.
+  const vision = Array.isArray(entry.capabilities) && entry.capabilities.includes('vision')
+  return {
+    id,
+    ...name === undefined ? {} : { name },
+    ...contextWindow === undefined ? {} : { contextWindow },
+    ...maxTokens === undefined ? {} : { maxTokens },
+    inputModalities: vision ? ['text', 'image'] : ['text'],
+  }
+}
+
+/**
+ * Combine the endpoint's served models with the declared catalog.
+ *
+ * A declared entry keeps every field it states, so the deployment's reviewed
+ * values win over fetched ones and a profile can still pin a model the endpoint
+ * reports differently; the endpoint fills only what the declaration leaves out.
+ * Wire-behavior fields — `systemPromptUpdate`, `toolUpdate`, the image budgets —
+ * exist only in a declaration, because they describe how to talk to the
+ * endpoint rather than a property of the model.
+ *
+ * Declared models the endpoint does not list are retained: an endpoint that
+ * omits an entry, or drops one, must not empty a route the operator configured.
+ *
+ * @param declared - catalog from this entry's `config`.
+ * @param remote - models the endpoint reported as served.
+ * @returns the effective catalog: remote entries in listing order, then declared
+ * entries the endpoint did not list in their own order.
+ */
+function mergeCatalog(declared, remote) {
+  const declaredById = new Map(declared.map(model => [model.id, model]))
+  const merged = remote.map((model) => {
+    const declaration = declaredById.get(model.id)
+    return declaration === undefined ? model : { ...model, ...declaration }
+  })
+  const listed = new Set(remote.map(model => model.id))
+  return [...merged, ...declared.filter(model => !listed.has(model.id))]
+}
+
 /**
  * Register the GateMux account-authenticated provider route.
  * @param ctx - Host context with the LLM registry injected.
@@ -34,9 +137,40 @@ export const inject = ['llm']
  */
 export function apply(ctx, config) {
   const logger = ctx.logger('gatemux-account')
-  const options = () => resolveAdapterOptions(plainOptions(config), launchEnvironmentOf(ctx))
+  const baseOptions = () => resolveAdapterOptions(plainOptions(config), launchEnvironmentOf(ctx))
   // Validate the composed configuration now so a misconfiguration fails loudly at load.
-  options()
+  baseOptions()
+
+  // The catalog the endpoint last reported. Both the advertised model list and
+  // every later capability resolution read it, because `modelInfo` derives a
+  // model's context window and input modalities from `connection.models`: a
+  // model that only reached the listing would be resolved as text-only with the
+  // connection's fallback context window. Null until one read succeeds, which
+  // leaves the declared catalog in force before the first sign-in.
+  let discovered = null
+  const options = () => {
+    const base = baseOptions()
+    return discovered === null ? base : { ...base, models: mergeCatalog(base.models, discovered) }
+  }
+
+  /**
+   * Read the served models from the endpoint's listing.
+   * @param connection - resolved route configuration carrying the endpoint base.
+   * @param headers - request authentication for the signed-in user.
+   * @returns the catalog entries this route can serve, in listing order.
+   */
+  const loadCatalog = async (connection, headers) => {
+    const url = listingUrl(connection.baseURL)
+    const response = await fetch(url, {
+      method: 'GET',
+      headers: { ...headers, 'accept': 'application/json', 'anthropic-version': ANTHROPIC_VERSION },
+    })
+    if (!response.ok) throw new Error(`${url} answered ${response.status}`)
+    const body = await response.json()
+    const entries = body !== null && typeof body === 'object' && Array.isArray(body.data) ? body.data : undefined
+    if (entries === undefined) throw new Error(`${url} did not answer with a model list`)
+    return entries.map(servedModel).filter(model => model !== undefined)
+  }
 
   const resolveAuth = async (connection) => {
     const account = ctx.get('deepseekAccount')
@@ -82,15 +216,31 @@ export function apply(ctx, config) {
     resolveAuth,
     providerName: 'GateMux Account',
     discoverModels: async (provider) => {
-      const connection = options()
+      const connection = baseOptions()
+      let auth
       try {
-        await resolveAuth(connection)
+        auth = await resolveAuth(connection)
       } catch (error) {
         // With no signed-in user the route advertises nothing rather than failing discovery.
         if (error instanceof LlmError && error.code === 'ACCOUNT_SIGN_IN_REQUIRED') return []
         throw error
       }
-      return connection.models.map((model) => catalogModelInfo(provider, model))
+      try {
+        discovered = await loadCatalog(connection, auth.headers)
+      } catch (error) {
+        // The listing is an auxiliary surface. A failed read keeps the catalog
+        // that is already in force — the declared one before the first
+        // success, the last reported one after — rather than emptying the
+        // route's model list and dropping the provider from the selector. A
+        // credential this endpoint rejects is still classified where it is
+        // acted on, by `onRequestError` on the model request itself.
+        logger.warn(
+          `GateMux model listing read failed at ${listingUrl(connection.baseURL)}; `
+          + `keeping the ${discovered === null ? 'declared' : 'last reported'} catalog`,
+          error,
+        )
+      }
+      return options().models.map((model) => catalogModelInfo(provider, model))
     },
   })
 }

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@gatemux/dsh-gatemux-login",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "type": "module",
   "description": "Sign in with GateMux for DeepSeek Harness: users pay from their own GateMux balance.",
+  "scripts": {
+    "test": "node test/discovery.spec.mjs"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -29,22 +32,22 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-authorization": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-deepseek-account": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.7-rc.2"
+    "@deepseek-ai/dsh-authorization": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-deepseek-account": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "^0.1.7-rc.2 || ^0.2.0-rc.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-authorization": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-deepseek-account": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.7-rc.2"
+    "@deepseek-ai/dsh-authorization": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-deepseek-account": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "^0.1.7-rc.2 || ^0.2.0-rc.2"
   }
 }