@goodandready/dsh-subscriptions 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GooDAnDReaDY
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,102 @@
+# dsh-subscriptions
+
+Use **ChatGPT Codex**, **Claude**, **Grok**, **Antigravity**
+subscriptions as DeepSeek Harness LLM providers. Log in from
+**Settings → Subscriptions**. Several accounts per provider rotate on quota
+inside this plugin.
+
+This package is original software. It speaks vendor-public OAuth and LLM HTTP
+contracts. It does not ship tools (`x_search`, image, or video).
+
+## Install
+
+```bash
+dsh plugin --profile web add @goodandready/dsh-subscriptions
+```
+
+Local checkout (development):
+
+```bash
+dsh plugin --profile web add file:/path/to/dsh-subscriptions
+```
+
+After a `file:` install, remove then add again if you added new files under
+`lib/` — pnpm reuses the previous copy otherwise.
+
+## Settings
+
+1. Open **Settings → Subscriptions**.
+2. Pick a provider card and click **Connect**. Complete sign-in in the browser.
+3. **Disconnect** removes that account's token so you can connect again. **Reconnect** repeats OAuth on the same slot. The × on the card also disconnects, then drops the slot.
+4. If the provider redirects to a localhost or vendor URL that this host cannot
+   receive, paste the full redirected URL (or the `code` value) into the account
+   row and click **Submit code**.
+5. Logged-in providers appear in the session model picker.
+
+Leave **Use this Web UI origin as OAuth redirect_uri** off unless you registered
+your own OAuth client for this origin. Vendor CLI clients typically require
+their published redirect URI plus the paste step.
+
+Disconnect removes that account's blob from the host credentials store.
+
+## Credential names
+
+Tokens are JSON blobs in the DSH credentials store. Names look like:
+
+```text
+CODEX_OAUTH_1
+CLAUDE_OAUTH_2
+```
+
+`<PROVIDER>` is `CODEX`, `CLAUDE`, `GROK`, or `ANTIGRAVITY`.
+Settings GET never returns access or refresh tokens — only
+`{ configured, label, usagePercent, cooldownUntil, ref }`.
+
+## Providers
+
+| Key | Subscription | Default OAuth client |
+|---|---|---|
+| `codex` | ChatGPT / Codex | Vendor-public Codex CLI client id |
+| `claude` | Claude Pro/Max | Vendor-public Claude Code client id |
+| `grok` | xAI / SuperGrok | Vendor-public Grok CLI client id |
+| `antigravity` | Google Antigravity | Vendor-public Antigravity client id |
+
+Override `codexClientId`, `claudeClientId`, and the other empty Config fields
+if you register your own OAuth app.
+
+Live requests use the vendor subscription surfaces, not API-key hosts:
+Codex `chatgpt.com/backend-api/codex/responses`, Claude Messages with the
+OAuth beta header, Grok `cli-chat-proxy.grok.com` with CLI identity headers,
+and Gemini/Antigravity Cloud Code Assist (`loadCodeAssist` then
+`streamGenerateContent`). Usage endpoints, when they answer, feed the 100%
+skip. If a live model list fails, the built-in catalog is used.
+ Installed-app Google client secrets are
+vendor-published (not user secrets); override `geminiClientSecret` /
+`antigravityClientSecret` when you use your own client.
+
+Default model catalogs are built-in lists you can replace with
+`codexModels`, `claudeModels`, `grokModels`, `geminiModels`,
+`antigravityModels` in the plugin Config.
+
+## Rotation
+
+On `RATE_LIMIT`, `QUOTA`, or HTTP 429 the plugin cools that account down
+(default 30 minutes) and retries the **same provider** on the next account.
+It never switches to a different provider. Accounts at 100% usage (when the
+vendor reports usage) are skipped.
+
+This plugin does not call `dsh-key-rotation`.
+
+## Identity
+
+These three names must match:
+
+| Place | Value |
+|---|---|
+| `package.json` `name` | `@goodandready/dsh-subscriptions` |
+| `cordis.patch.yml` `name:` | `@goodandready/dsh-subscriptions` |
+| `lib/client.js` loader `id` | `@goodandready/dsh-subscriptions` |
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,8 @@
+# dsh-subscriptions bundle layer.
+#
+# `name` must stay the full npm package name: the client-modules registry
+# resolves the browser bundle by the loader entry name.
+- insert:
+    - id: dsh-subscriptions
+      name: '@goodandready/dsh-subscriptions'
+      config: {}

package/lib/accounts.js

@@ -0,0 +1,198 @@
+import { credentialRef } from '@deepseek-ai/dsh-credentials'
+import { oauthRef, isProvider } from './refs.js'
+import { parseBlob, serializeBlob } from './blob.js'
+import { getVendor } from './vendors/index.js'
+
+const SKEW_MS = 60 * 1000
+const USAGE_TTL_MS = 2 * 60 * 1000
+
+export function normalizeSlots(slots) {
+  const out = []
+  const seen = new Set()
+  for (const slot of Array.isArray(slots) ? slots : []) {
+    if (!isProvider(slot.provider)) continue
+    const index = Number(slot.index)
+    if (!Number.isInteger(index) || index < 1) continue
+    const ref = oauthRef(slot.provider, index)
+    if (seen.has(ref)) continue
+    seen.add(ref)
+    out.push({
+      provider: slot.provider,
+      index,
+      label: String(slot.label || ''),
+      ref,
+    })
+  }
+  return out
+}
+
+export function vendorConfig(provider, cfg) {
+  const d = getVendor(provider).defaults()
+  const pick = (suffix, fallback) => {
+    const value = cfg && cfg[`${provider}${suffix}`]
+    if (value == null || String(value).trim() === '') return fallback
+    return String(value).trim()
+  }
+  const modelsKey = `${provider}Models`
+  return {
+    clientId: pick('ClientId', d.clientId),
+    clientSecret: pick('ClientSecret', d.clientSecret || ''),
+    redirectUri: pick('RedirectUri', d.redirectUri),
+    baseUrl: pick('BaseUrl', d.baseUrl || ''),
+    originator: pick('Originator', d.originator || ''),
+    systemPrefix: pick('SystemPrefix', d.systemPrefix || ''),
+    clientVersion: pick('ClientVersion', d.clientVersion || ''),
+    models: Array.isArray(cfg && cfg[modelsKey]) && cfg[modelsKey].length
+      ? cfg[modelsKey]
+      : (d.models || []),
+  }
+}
+
+export function createAccountStore({ credentials, getConfig, fetchImpl }) {
+  const cooldowns = new Map()
+  const usage = new Map()
+  const usageFetched = new Map()
+  const doFetch = fetchImpl || fetch
+
+  async function resolveRaw(ref) {
+    try {
+      const resolved = await credentials.resolve(credentialRef(ref))
+      return resolved && resolved.value ? String(resolved.value) : ''
+    } catch {
+      return ''
+    }
+  }
+
+  async function loadBlob(ref) {
+    const raw = await resolveRaw(ref)
+    if (!raw) {
+      const err = new Error(`no token for ${ref}`)
+      err.code = 'AUTH'
+      throw err
+    }
+    return parseBlob(raw)
+  }
+
+  async function saveBlob(ref, blob) {
+    await credentials.set(credentialRef(ref), serializeBlob(blob))
+  }
+
+  async function clearRef(ref) {
+    await credentials.unset(credentialRef(ref))
+    cooldowns.delete(ref)
+    usage.delete(ref)
+    usageFetched.delete(ref)
+  }
+
+  async function describeRef(ref) {
+    const base = { ref, configured: false, writable: true, label: '', email: '' }
+    try {
+      if (typeof credentials.describe === 'function') {
+        const d = await credentials.describe(credentialRef(ref))
+        base.configured = !!(d && d.configured)
+        base.writable = d && d.writable === false ? false : true
+      } else {
+        base.configured = !!(await resolveRaw(ref))
+      }
+    } catch {
+      return base
+    }
+    if (base.configured) {
+      try {
+        const blob = parseBlob(await resolveRaw(ref))
+        base.label = blob.label || blob.email || ''
+        base.email = blob.email || ''
+        if (blob.validationUrl) base.validationUrl = blob.validationUrl
+        if (blob.validationMessage) base.validationMessage = blob.validationMessage
+        if (blob.accountNotice) base.accountNotice = blob.accountNotice
+        if (blob.paidTierName) base.paidTierName = blob.paidTierName
+      } catch { /* ignore parse */ }
+    }
+    return {
+      ...base,
+      cooldownUntil: cooldowns.get(ref) || 0,
+      usagePercent: usage.has(ref) ? usage.get(ref) : null,
+      validationUrl: base.validationUrl || '',
+      validationMessage: base.validationMessage || '',
+      accountNotice: base.accountNotice || '',
+      paidTierName: base.paidTierName || '',
+    }
+  }
+
+  async function listAccounts(provider) {
+    const slots = normalizeSlots(getConfig().slots).filter((s) => s.provider === provider)
+    const out = []
+    for (const slot of slots) {
+      const info = await describeRef(slot.ref)
+      out.push({
+        ref: slot.ref,
+        hasToken: !!info.configured,
+        usagePercent: info.usagePercent,
+        cooldownUntil: info.cooldownUntil,
+        label: slot.label || info.label,
+      })
+    }
+    return out
+  }
+
+  async function loggedInProviders() {
+    const found = new Set()
+    for (const slot of normalizeSlots(getConfig().slots)) {
+      const info = await describeRef(slot.ref)
+      if (info.configured) found.add(slot.provider)
+    }
+    return [...found]
+  }
+
+  async function ensureFresh(provider, blob, ref) {
+    if (!blob.refreshToken) return blob
+    if (blob.expiresAt && blob.expiresAt - SKEW_MS > Date.now()) return blob
+    const cfg = vendorConfig(provider, getConfig())
+    const next = await getVendor(provider).refresh(cfg, blob, doFetch)
+    const merged = {
+      ...blob,
+      ...next,
+      refreshToken: next.refreshToken || blob.refreshToken,
+      projectId: next.projectId || blob.projectId,
+      accountId: next.accountId || blob.accountId,
+    }
+    if (ref) await saveBlob(ref, merged)
+    return merged
+  }
+
+  async function refreshUsage(provider) {
+    const cfg = vendorConfig(provider, getConfig())
+    const vendor = getVendor(provider)
+    for (const slot of normalizeSlots(getConfig().slots).filter((s) => s.provider === provider)) {
+      const last = usageFetched.get(slot.ref) || 0
+      if (Date.now() - last < USAGE_TTL_MS) continue
+      let raw = ''
+      try { raw = await resolveRaw(slot.ref) } catch { continue }
+      if (!raw) continue
+      try {
+        const blob = await ensureFresh(provider, parseBlob(raw), slot.ref)
+        const snap = await vendor.usage(blob, cfg, doFetch)
+        usageFetched.set(slot.ref, Date.now())
+        if (snap && Number.isFinite(Number(snap.usedPercent))) {
+          usage.set(slot.ref, Number(snap.usedPercent))
+        }
+      } catch {
+        usageFetched.set(slot.ref, Date.now())
+      }
+    }
+  }
+
+  return {
+    loadBlob,
+    saveBlob,
+    clearRef,
+    describeRef,
+    listAccounts,
+    loggedInProviders,
+    resolveRaw,
+    ensureFresh,
+    refreshUsage,
+    rememberCooldown(ref, until) { cooldowns.set(ref, until) },
+    rememberUsage(ref, percent) { usage.set(ref, percent) },
+  }
+}

package/lib/adapter.js

@@ -0,0 +1,110 @@
+import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm'
+import { displayName } from './refs.js'
+import { getVendor } from './vendors/index.js'
+import { modelCatalog } from './messages.js'
+import { streamWithRotation } from './stream-rotate.js'
+
+function asLlmError(err) {
+  if (err instanceof LlmError) return err
+  const code = (err && err.code) || 'VENDOR'
+  const message = String((err && err.message) || err || 'vendor error')
+  try {
+    const out = new LlmError(message, code)
+    if (err && err.validationUrl) out.validationUrl = err.validationUrl
+    return out
+  } catch {
+    return err
+  }
+}
+
+export class SubscriptionAdapter extends LlmAdapter {
+  constructor(deps) {
+    super()
+    this.deps = deps
+  }
+
+  providerInfo(provider) {
+    return { id: provider, name: displayName(provider) }
+  }
+
+  providerRetryPolicy(_provider) {
+    return undefined
+  }
+
+  async listModels(provider) {
+    const accounts = await this.deps.listAccounts(provider)
+    if (!accounts.some((a) => a.hasToken)) return []
+    const cfg = this.deps.vendorConfig(provider)
+    const fetchImpl = this.deps.fetchImpl || fetch
+    try {
+      const blob = await this.deps.ensureFresh(
+        provider,
+        await this.deps.loadBlob(accounts.find((a) => a.hasToken).ref),
+        accounts.find((a) => a.hasToken).ref,
+      )
+      const models = await getVendor(provider).listModels(blob, cfg, fetchImpl)
+      if (Array.isArray(models) && models.length) return models
+    } catch { /* use built-in catalog */ }
+    return modelCatalog(provider, cfg.models)
+  }
+
+  async resolveModel(provider, model, _signal) {
+    const rows = await this.listModels(provider)
+    const found = rows.find((row) => row && row.id === model)
+    if (found) {
+      return {
+        provider,
+        id: model,
+        name: found.name || model,
+        ...(found.description ? { description: found.description } : {}),
+        ...(found.inputModalities ? { inputModalities: found.inputModalities } : {}),
+        ...(found.contextWindow ? { context: { contextWindow: found.contextWindow } } : {}),
+        ...(found.reasoning ? { reasoning: found.reasoning } : {}),
+      }
+    }
+    return { provider, id: model, name: model }
+  }
+
+  async *stream(options) {
+    const provider = options.provider
+    const deps = this.deps
+    try {
+      if (typeof deps.refreshUsage === 'function') {
+        await deps.refreshUsage(provider)
+      }
+      yield* streamWithRotation({
+        accounts: await deps.listAccounts(provider),
+        nowMs: () => Date.now(),
+        cooldownMs: deps.cooldownMs(),
+        options,
+        onCooldown: (account) => deps.rememberCooldown(account.ref, account.cooldownUntil),
+        streamOnce: async function* (account, opts) {
+          const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
+          const vendor = getVendor(provider)
+          try {
+            yield* vendor.streamOnce({
+              blob,
+              options: opts,
+              fetchImpl: deps.fetchImpl || fetch,
+              headers: attributionHeaders(),
+              config: deps.vendorConfig(provider),
+              signal: opts.signal,
+              saveBlob: (next) => deps.saveBlob(account.ref, next),
+            })
+          } catch (err) {
+            if (err && err.code === 'VALIDATION_REQUIRED' && err.validationUrl) {
+              await deps.saveBlob(account.ref, {
+                ...blob,
+                validationUrl: err.validationUrl,
+                validationMessage: String(err.message || ''),
+              })
+            }
+            throw err
+          }
+        },
+      })
+    } catch (err) {
+      throw asLlmError(err)
+    }
+  }
+}

package/lib/blob.js

@@ -0,0 +1,43 @@
+function asString(value) {
+  return value == null ? '' : String(value)
+}
+
+export function serializeBlob(obj) {
+  const accessToken = asString(obj && obj.accessToken)
+  const refreshToken = asString(obj && obj.refreshToken)
+  if (!accessToken && !refreshToken) {
+    throw new Error('oauth blob needs accessToken or refreshToken')
+  }
+  return JSON.stringify({
+    accessToken,
+    refreshToken,
+    expiresAt: Number(obj && obj.expiresAt) || 0,
+    label: asString(obj && obj.label),
+    email: asString(obj && obj.email),
+    accountId: asString(obj && obj.accountId),
+    projectId: asString(obj && obj.projectId),
+  })
+}
+
+export function parseBlob(text) {
+  const obj = typeof text === 'string' ? JSON.parse(text) : text
+  if (!obj || typeof obj !== 'object') throw new Error('invalid oauth blob')
+  return {
+    accessToken: asString(obj.accessToken),
+    refreshToken: asString(obj.refreshToken),
+    expiresAt: Number(obj.expiresAt) || 0,
+    label: asString(obj.label),
+    email: asString(obj.email),
+    accountId: asString(obj.accountId),
+    projectId: asString(obj.projectId),
+  }
+}
+
+export function publicAccountView(blob, extra) {
+  const label = (blob && (blob.label || blob.email)) || ''
+  return {
+    label,
+    email: (blob && blob.email) || '',
+    ...(extra || {}),
+  }
+}