@goodandready/dsh-subscriptions 0.4.15 → 0.4.17

package/lib/ollama.js

@@ -0,0 +1,70 @@
+import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm'
+import { openaiMessages, openaiTools } from './messages.js'
+import { openaiChatStream } from './wire.js'
+
+// #91: local Ollama gateway - a $0 emergency provider and seamless quota
+// fallback. Speaks the OpenAI-compatible subset Ollama serves at /v1.
+
+export function ollamaBase(cfg) {
+  return String(cfg.ollamaBaseUrl || 'http://127.0.0.1:11434').replace(/\/$/, '')
+}
+
+export async function ollamaAlive(baseUrl, fetchImpl, timeoutMs = 2000) {
+  try {
+    const res = await fetchImpl(baseUrl + '/api/tags', { signal: AbortSignal.timeout(timeoutMs) })
+    return !!res && res.ok
+  } catch { return false }
+}
+
+export async function ollamaModels(baseUrl, fetchImpl) {
+  const res = await fetchImpl(baseUrl + '/api/tags', { signal: AbortSignal.timeout(3000) })
+  if (!res || !res.ok) throw new LlmError('ollama /api/tags http ' + (res && res.status), 'VENDOR', { status: res && res.status })
+  const j = await res.json()
+  return (Array.isArray(j.models) ? j.models : []).map((m) => ({
+    id: m.name,
+    name: m.name,
+    ...(m.details && m.details.parameter_size ? { description: m.details.parameter_size } : {}),
+  }))
+}
+
+export class OllamaAdapter extends LlmAdapter {
+  constructor(deps) {
+    super()
+    this.deps = deps
+  }
+
+  providerInfo(provider) {
+    return { id: provider, name: 'Ollama (local)' }
+  }
+
+  providerRetryPolicy(_provider) {
+    return undefined
+  }
+
+  async listModels(provider) {
+    return ollamaModels(this.deps.baseUrl(), this.deps.fetchImpl || fetch)
+  }
+
+  async resolveModel(provider, model, _signal) {
+    return { provider, id: model, name: model }
+  }
+
+  async *stream(options) {
+    const base = this.deps.baseUrl()
+    const model = options.model || this.deps.fallbackModel() || ''
+    const body = { model, messages: openaiMessages(options), stream: true }
+    const tools = openaiTools(options)
+    if (tools) body.tools = tools
+    const res = await (this.deps.fetchImpl || fetch)(base + '/v1/chat/completions', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...attributionHeaders() },
+      body: JSON.stringify(body),
+      signal: options.signal,
+    })
+    if (!res || !res.ok) {
+      const txt = res && res.text ? await res.text().catch(() => '') : ''
+      throw new LlmError('ollama http ' + (res && res.status) + (txt ? ': ' + txt.slice(0, 200) : ''), 'VENDOR', { status: res && res.status })
+    }
+    yield* openaiChatStream(res.body)
+  }
+}

package/lib/proxy.js

@@ -0,0 +1,79 @@
+// #88: per-account proxy support.
+// http/https proxies -> undici ProxyAgent; socks5 -> undici Agent with a socks connector.
+import { ProxyAgent, Agent, fetch as undiciFetch } from 'undici'
+import tls from 'node:tls'
+import { SocksClient } from 'socks'
+
+const cache = new Map()
+
+export function parseProxyUrl(raw) {
+  const s = String(raw || '').trim()
+  if (!s) return null
+  let u
+  try { u = new URL(s) } catch { return null }
+  const scheme = u.protocol.replace(':', '')
+  if (scheme !== 'http' && scheme !== 'https' && scheme !== 'socks5') return null
+  if (!u.hostname) return null
+  const port = Number(u.port) || (scheme === 'socks5' ? 1080 : (scheme === 'https' ? 443 : 80))
+  const auth = u.username
+    ? { username: decodeURIComponent(u.username), password: decodeURIComponent(u.password || '') }
+    : null
+  return { href: s, scheme, host: u.hostname, port, auth }
+}
+
+function socksDispatcher(p) {
+  return new Agent({
+    connect: (opts, callback) => {
+      SocksClient.createConnection({
+        proxy: {
+          host: p.host,
+          port: p.port,
+          type: 5,
+          ...(p.auth ? { userId: p.auth.username, password: p.auth.password } : {}),
+        },
+        command: 'connect',
+        destination: { host: opts.hostname || opts.host, port: Number(opts.port) || 443 },
+      }).then(({ socket }) => {
+        if (String(opts.protocol) !== 'https:') {
+          callback(null, socket)
+          return
+        }
+        const tlsSocket = tls.connect({
+          socket,
+          servername: opts.servername || opts.hostname || opts.host,
+        })
+        tlsSocket.once('secureConnect', () => callback(null, tlsSocket))
+        tlsSocket.once('error', (e) => callback(e))
+      }).catch(callback)
+    },
+  })
+}
+
+function httpDispatcher(p) {
+  return new ProxyAgent({
+    uri: p.href,
+    ...(p.auth ? { token: 'Basic ' + Buffer.from(p.auth.username + ':' + p.auth.password).toString('base64') } : {}),
+  })
+}
+
+/** Returns a fetch bound to the proxy dispatcher, or null for empty/invalid proxy. Dispatchers are cached per URL. */
+export function proxyFetch(raw) {
+  const p = parseProxyUrl(raw)
+  if (!p) return null
+  let f = cache.get(p.href)
+  if (!f) {
+    const d = p.scheme === 'socks5' ? socksDispatcher(p) : httpDispatcher(p)
+    f = (url, init = {}) => undiciFetch(url, { ...init, dispatcher: d })
+    cache.set(p.href, f)
+  }
+  return f
+}
+
+/** Pick the fetch for an account ref: per-slot proxy -> deps.fetchImpl -> global fetch. */
+export function pickFetch(deps, ref) {
+  if (typeof deps?.fetchForRef === 'function') {
+    const f = deps.fetchForRef(ref)
+    if (f) return f
+  }
+  return deps?.fetchImpl || fetch
+}

package/lib/rotate.js

@@ -12,6 +12,25 @@ export function isSwitchableError(err) {
   return status === 429
 }
 
+// #87: family classification. Cooldowns are scoped to the model family that
+// hit the limit, so a reasoning 429 does not block standard models.
+export function modelFamily(provider, model) {
+  const id = String(model || '')
+  if (provider === 'claude') return /thinking/i.test(id) ? 'reasoning' : 'standard'
+  if (provider === 'grok') return /reasoning/i.test(id) ? 'reasoning' : 'standard'
+  if (provider === 'codex') return 'reasoning'
+  return 'standard'
+}
+
+// Legacy cooldowns (no family list) block everything; scoped ones block only
+// their own family. An unknown family never blocks a differently-scoped cooldown.
+export function cooldownBlocks(acc, family) {
+  const fams = acc && acc.cooldownFamilies
+  if (!Array.isArray(fams) || !fams.length) return true
+  if (!family) return true
+  return fams.includes(family)
+}
+
 export function pickAccount(accounts, nowMs, opts) {
   const list = Array.isArray(accounts) ? accounts : []
   const now = Number(nowMs) || 0
@@ -47,7 +66,7 @@ export function pickAccount(accounts, nowMs, opts) {
   const fallback = []
   for (const acc of list) {
     if (!acc || !acc.hasToken) continue
-    const isCooldown = acc.cooldownUntil && Number(acc.cooldownUntil) > now
+    const isCooldown = acc.cooldownUntil && Number(acc.cooldownUntil) > now && cooldownBlocks(acc, opts && opts.family)
     const exhausted = isQuotaExhausted(acc) || isUsageExhausted(acc)
     if (isCooldown || exhausted) {
       tiers[2].push(acc)
@@ -68,8 +87,14 @@ export function pickAccount(accounts, nowMs, opts) {
   return null
 }
 
-export function markCooldown(account, nowMs, cooldownMs) {
+export function markCooldown(account, nowMs, cooldownMs, family) {
   const wait = Number(cooldownMs)
   const ms = Number.isFinite(wait) && wait > 0 ? wait : 30 * 60 * 1000
-  return { ...account, cooldownUntil: (Number(nowMs) || 0) + ms }
+  const prev = Array.isArray(account.cooldownFamilies) ? account.cooldownFamilies.slice() : []
+  const fams = family ? (prev.includes(family) ? prev : prev.concat(family)) : prev
+  return {
+    ...account,
+    cooldownUntil: (Number(nowMs) || 0) + ms,
+    ...(fams.length ? { cooldownFamilies: fams } : {}),
+  }
 }

package/lib/stream-rotate.js

@@ -1,4 +1,4 @@
-import { pickAccount, markCooldown, isSwitchableError } from './rotate.js'
+import { pickAccount, markCooldown, isSwitchableError, modelFamily } from './rotate.js'
 
 export async function* streamWithRotation({
   accounts,
@@ -13,7 +13,7 @@ export async function* streamWithRotation({
   let lastError = null
   const tried = new Set()
   while (true) {
-    const account = pickAccount(pool, nowMs(), { switchAtRemaining })
+    const account = pickAccount(pool, nowMs(), { switchAtRemaining, family: modelFamily(options && options.provider, options && options.model) })
     if (!account) {
       if (lastError) throw lastError
       const err = new Error('no usable subscription account for this provider')
@@ -33,8 +33,9 @@ export async function* streamWithRotation({
     } catch (err) {
       lastError = err
       if (!isSwitchableError(err)) throw err
-      const cooled = markCooldown(account, nowMs(), cooldownMs)
+      const cooled = markCooldown(account, nowMs(), cooldownMs, modelFamily(options && options.provider, options && options.model))
       account.cooldownUntil = cooled.cooldownUntil
+      if (cooled.cooldownFamilies) account.cooldownFamilies = cooled.cooldownFamilies
       if (onCooldown) onCooldown(account)
     }
   }

package/lib/subscriptions.js

@@ -1,7 +1,8 @@
 import { isProvider } from "./refs.js"
-import { pickAccount, markCooldown, isSwitchableError } from "./rotate.js"
+import { pickAccount, markCooldown, isSwitchableError, modelFamily } from "./rotate.js"
 import { quotaSnapshot } from "./ratelimit.js"
 import { getVendor } from "./vendors/index.js"
+import { pickFetch } from "./proxy.js"
 
 // ponytail: allowlist per provider — add path to extend without touching request logic
 export const ALLOWLIST = {
@@ -91,7 +92,7 @@ export function createSubscriptionsService(deps) {
       const tried = new Set()
       let lastError = null
       while (true) {
-        const account = pickAccount(pool, Date.now(), { switchAtRemaining: thr })
+        const account = pickAccount(pool, Date.now(), { switchAtRemaining: thr, family: modelFamily(provider, body && body.model) })
         if (!account) {
           if (lastError) throw lastError
           const err = new Error("no usable subscription account for this provider")
@@ -121,7 +122,8 @@ export function createSubscriptionsService(deps) {
           }
           const url = p
           const extraHeaders = headersFor(provider, blob, cfg)
-          const fetchImpl = deps.fetchImpl || fetch
+          const fetchImpl = pickFetch(deps, account.ref)
+          const t0 = Date.now()
           const res = await fetchImpl(url, {
             method,
             headers: {
@@ -169,6 +171,7 @@ export function createSubscriptionsService(deps) {
                 path,
                 method,
                 status: res.status || 200,
+                ms: Date.now() - t0,
                 kind: "request",
               })
             } catch {}
@@ -177,9 +180,9 @@ export function createSubscriptionsService(deps) {
         } catch (err) {
           lastError = err
           if (!isSwitchableError(err)) throw err
-          const cooled = markCooldown(account, Date.now(), cooldownMs)
+          const cooled = markCooldown(account, Date.now(), cooldownMs, modelFamily(provider, body && body.model))
           account.cooldownUntil = cooled.cooldownUntil
-          if (typeof deps.rememberCooldown === "function") deps.rememberCooldown(account.ref, account.cooldownUntil)
+          if (typeof deps.rememberCooldown === "function") deps.rememberCooldown(account.ref, account.cooldownUntil, cooled.cooldownFamilies || null)
           // try next account
         }
       }

package/lib/vendors/codex.js

@@ -10,6 +10,12 @@ export const id = 'codex'
 const AUTH = 'https://auth.openai.com/oauth/authorize'
 const TOKEN = 'https://auth.openai.com/oauth/token'
 const USAGE = 'https://chatgpt.com/backend-api/wham/usage'
+// #90: device-code login (headless). OpenAI mints an authorization_code +
+// code_verifier server-side; we finish with the normal PKCE exchange.
+const DEVICE_USERCODE_URL = 'https://auth.openai.com/api/accounts/deviceauth/usercode'
+const DEVICE_TOKEN_URL = 'https://auth.openai.com/api/accounts/deviceauth/token'
+export const DEVICE_AUTH_URL = 'https://auth.openai.com/codex/device'
+const DEVICE_REDIRECT_URI = 'https://auth.openai.com/deviceauth/callback'
 const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke'
 const INSTRUCTIONS = 'You are a coding assistant using a ChatGPT Codex subscription.'
 
@@ -82,6 +88,45 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
   return decorate(tokenBlobFromOAuth(json), json)
 }
 
+export async function deviceStart(cfg, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const res = await impl(DEVICE_USERCODE_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ client_id: cfg.clientId }),
+  })
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.user_code !== 'string' || typeof json.device_auth_id !== 'string') {
+    throw httpError(502, 'device auth response is incomplete', 'DEVICE')
+  }
+  return {
+    userCode: json.user_code,
+    deviceAuthId: json.device_auth_id,
+    intervalMs: Math.max(parseInt(json.interval, 10) || 5, 1) * 1000,
+    authUrl: DEVICE_AUTH_URL,
+  }
+}
+
+export async function devicePoll(cfg, session, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const res = await impl(DEVICE_TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ device_auth_id: session.deviceAuthId, user_code: session.userCode }),
+  })
+  // 403/404 = not confirmed yet (matches reference implementations)
+  if (res.status === 403 || res.status === 404) return { status: 'pending' }
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.authorization_code !== 'string' || typeof json.code_verifier !== 'string') {
+    throw httpError(502, 'device auth token response is incomplete', 'DEVICE')
+  }
+  const deviceCfg = { ...cfg, redirectUri: DEVICE_REDIRECT_URI }
+  const blob = await exchangeCode(deviceCfg, { verifier: json.code_verifier }, json.authorization_code, impl)
+  return { status: 'authorized', blob }
+}
+
 export async function refresh(cfg, blob, fetchImpl) {
   const json = await formTokenRequest(TOKEN, {
     grant_type: 'refresh_token',
@@ -160,7 +205,7 @@ export async function usage(blob, cfg, fetchImpl) {
 
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
   const base = (config.baseUrl || defaults().baseUrl).replace(/\/$/, '')
-  const body = codexResponsesBody(options, INSTRUCTIONS)
+  const body = codexResponsesBody(options, INSTRUCTIONS, config)
   const res = await fetchImpl(`${base}/responses`, {
     method: 'POST',
     headers: {

package/lib/vendors/grok.js

@@ -213,6 +213,8 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const base = (config.baseUrl || defaults().baseUrl).replace(/\/$/, '')
   let body = codexResponsesBody(options, '')
   if (!body.instructions) delete body.instructions
+  // grok manages reasoning itself (cli catalog aware); drop the codex-level field
+  delete body.reasoning
   const catalog = await cliCatalogCached(blob, config, fetchImpl).catch(() => new Map())
   const reasoning = grokReasoningBody(options.model, options.reasoningEffort, catalog)
   if (reasoning) body.reasoning = reasoning

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.4.15",
+  "version": "0.4.17",
   "description": "Use ChatGPT Codex, Claude, Grok, and Antigravity subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -51,13 +51,20 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-credentials": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-settings": "^0.1.0-rc.6",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "socks": "^2.8.9",
+    "undici": "^8.10.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.8"
   }
 }