@goodandready/dsh-subscriptions 0.6.66 → 0.6.68

package/README.md

@@ -207,6 +207,13 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **In-App Toast Alerts (`enableToasts`)**: Lightweight floating toast alerts in the DSH chat interface notifying you when accounts enter quarantine, recover from cooldowns, or exceed quota safety thresholds.
 * **Automated Webhook Integration**: Instant event notifications dispatched via `notifyQuarantineEntered` and `notifyQuarantineReleased`.
 
+### 22. ⚡ xAI Grok RFC 8628 Device Authorization Flow (v0.6.68)
+* **RFC 8628 Device Code Authorization (GH #17, #532)**: Native device authorization grant support for xAI Grok. Solves the issue where xAI presents a Grok Build user-code verification page for CLI client IDs without redirecting back to loopback callbacks. Provides direct user code display and automatic token polling.
+
+### 21. 🛡️ Per-Account Claude Billing Attribution Isolation (v0.6.67)
+* **Per-Account `cc_turn_index` & `cch` Isolation (#530)**: Isolates Claude Code billing attribution state (`cch` session hash and `cc_turn_index` counter) per subscription account (`accountId`) in a bounded module Map instead of `globalThis`, preventing cross-account telemetry mixing in multi-account pools.
+* **Dynamic `cc_prompt_index` & Kill-Switch**: Automatically derives 0-based `cc_prompt_index` from multi-turn `messages` history and supports suppression via `CLAUDE_CODE_ATTRIBUTION_HEADER=0` or `disableBillingHeader: true`.
+
 ### 20. 🤖 Native Copilot CLI SDK Mode & Local Tool Calling (v0.6.66)
 * **Direct Copilot CLI Integration (#508)**: Native driver `copilot-cli.js` supporting execution via local `copilot` / `github-copilot-cli` binaries with zero network token emulation risk.
 * **Smart Mode Switching (`copilotMode`)**: Choose between `auto` (prefers local CLI with graceful web API fallback), `cli` (strict CLI SDK execution), and `web` (direct OAuth/API).

package/README.ru.md

@@ -183,6 +183,13 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **Всплывающие уведомления (Toast Alerts)**: Легковесные всплывающие тосты в веб-интерфейсе DSH при событиях карантина (с отображением причины), восстановлении доступа и критическом расходе квоты. Включение управляется параметром `enableToasts` (по умолчанию `true`).
 * **Интеграция с вебхуками**: Автоматическая отправка уведомлений через `notifyQuarantineEntered` и `notifyQuarantineReleased`.
 
+### 18. ⚡ RFC 8628 Device Code авторизация для xAI Grok (v0.6.68)
+* **Авторизация по коду устройства (GH #17, #532)**: Нативная поддержка RFC 8628 device code flow для xAI Grok. Устраняет проблему, когда xAI для CLI client ID открывает страницу ввода кода для Grok Build без обратного редиректа на loopback-порт. Отображает одноразовый код на карточке и автоматически поллит токены в фоне.
+
+### 17. 🛡️ Поаккаунтная изоляция атрибуции биллинга Claude (v0.6.67)
+* **Изоляция `cc_turn_index` и `cch` по `accountId` (#530)**: Состояние атрибуции Claude Code (`cch` и счётчик `cc_turn_index`) изолировано по каждому аккаунту в ограниченной таблице модуля вместо `globalThis`, что исключает смешивание телеметрии между подписками в пуле.
+* **Динамический `cc_prompt_index` и Kill-Switch**: Индекс `cc_prompt_index` автоматически вычисляется по числу пользовательских ходов в `messages`, а отключение заголовка поддерживается через `CLAUDE_CODE_ATTRIBUTION_HEADER=0` или `disableBillingHeader: true`.
+
 ### 16. 🤖 Нативный режим Copilot CLI SDK и локальный Tool Calling (v0.6.66)
 * **Прямая интеграция с Copilot CLI (#508)**: Драйвер `copilot-cli.js` для работы через локальный бинарник `copilot` / `github-copilot-cli` без риска сетевых блокировок при эмуляции токенов.
 * **Гибкие режимы работы (`copilotMode`)**: Поддержка режимов `auto` (приоритет CLI с автоматическим fallback на web-API), `cli` (строгий режим CLI SDK) и `web` (прямое подключение по OAuth/API).

package/README.zh.md

@@ -132,6 +132,13 @@ graph LR
   queueTimeoutMs: 30000     # v0.6.62: 队列最大等待超时时间（毫秒）
 * **自动化 Webhook 告警集成**：通过 `notifyQuarantineEntered` 与 `notifyQuarantineReleased` 自动向外部通知系统派发隔离生命周期事件。
 
+### xAI Grok RFC 8628 设备码授权流支持 (v0.6.68)
+* **RFC 8628 设备码授权流 (GH #17, #532)**：为 xAI Grok 新增原生设备码登录授权支持。彻底解决 xAI 针对 CLI 客户端标识返回 Grok Build 验证码页面且不触发回环重定向回调导致的死锁问题。直接在槽位卡片展示用户授权码，并自动在后台轮询兑换会话令牌。
+
+### Claude 账户级计费归因隔离与动态轮次索引 (v0.6.67)
+* **按账户隔离 `cc_turn_index` 与 `cch` (#530)**：将 Claude Code 计费归因状态（会话哈希 `cch` 与递增轮次 `cc_turn_index`）按 `accountId` 隔离在有界模块级映射表中，彻底消除 `globalThis` 跨订阅账户状态混用问题。
+* **动态计算 `cc_prompt_index` 与禁用开关**：根据多轮对话消息历史自动计算从 0 开始的 `cc_prompt_index`，并支持通过环境变量 `CLAUDE_CODE_ATTRIBUTION_HEADER=0` 或 `disableBillingHeader: true` 禁用归因头注入。
+
 ### Antigravity 客户端密钥架构与无感 CLI 令牌刷新 (v0.6.60)
 * **配置架构密钥字段 (`antigravityClientSecret`)**：支持用户在设置中自定义配置 Google Cloud OAuth 客户端密钥（Client Secret），公共接口自动脱敏掩码 (`••••••`)，彻底解决机密型 OAuth 客户端刷新令牌被拒的问题。
 * **CLI 令牌零配置平滑刷新**：内置官方 Gemini / Antigravity CLI 客户端的公共应用凭据 (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`)，使通过 `📥 从 CLI 导入` 的会话能够持久无限刷新，不再出现 1 小时后失效问题。

package/lib/adapter.js

@@ -329,6 +329,7 @@ export class SubscriptionAdapter extends LlmAdapter {
             if (typeof deps.rememberRequest === 'function') deps.rememberRequest(account.ref)
             for await (const chunk of vendor.streamOnce({
               blob,
+              accountId: account.id || account.ref,
               options: opts,
               fetchImpl: quotaFetch,
               headers: attributionHeaders(),

package/lib/client.js

@@ -313,16 +313,20 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       grok: {
         title: "xAI Grok",
         stepsEn: [
-          "1. Run grok CLI login on the server.",
-          "2. Click \"📥 From CLI\" (~/.grok/auth.json).",
-          "3. Or paste your xAI API Key and click \"Save token\".",
+          "1. Click \"Device Login\" (or \"Connect\") on the slot card.",
+          "2. A one-time code will appear on the card.",
+          "3. Open https://accounts.x.ai/oauth2/device, enter the code, and approve access for your xAI account.",
+          "4. The plugin automatically captures tokens and enables Grok models.",
+          "5. Or click \"📥 From CLI\" (~/.grok/auth.json) / paste an xAI API Key.",
         ],
         stepsZh: [
-          "1. 在服务器上运行 grok CLI 登录。",
-          "2. 点击 \"📥 从 CLI 导入\" (~/.grok/auth.json)。",
-          "3. 或将 xAI API 密钥粘贴到输入框并点击 \"保存令牌\"。",
+          "1. 点击卡片上的 \"设备码登录\" (Device Login) 或 \"连接\"。",
+          "2. 界面将展示一次性设备授权码。",
+          "3. 打开 https://accounts.x.ai/oauth2/device，输入代码，并为您拥有 Grok 订阅的 xAI 账户授权。",
+          "4. 授权成功后，插件会自动捕获会话并激活 Grok 官方模型。",
+          "5. 或点击 \"📥 从 CLI 导入\" (~/.grok/auth.json) / 直接粘贴 xAI API 密钥。",
         ],
-        link: "https://x.ai",
+        link: "https://accounts.x.ai/oauth2/device",
       },
       kiro: {
         title: "AWS Kiro",
@@ -1362,7 +1366,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
 
       const connect = async (provider, index) => {
         setErr('')
-        if (provider === 'copilot') {
+        if (provider === 'copilot' || provider === 'grok') {
           return deviceStartLogin(provider, index).catch((e) => setErr(cleanErrorMessage(e.message || e)))
         }
         if (provider === 'antigravity' && (!draft || !draft.antigravityClientId || !String(draft.antigravityClientId).trim())) {
@@ -2253,7 +2257,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                     type: 'button', className: 'dsub-mini',
                     onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, on ? t('reconnect') : t('connect')),
-                  ((row.slot.provider === 'codex' || row.slot.provider === 'copilot') ? React.createElement('button', {
+                  ((row.slot.provider === 'codex' || row.slot.provider === 'copilot' || row.slot.provider === 'grok') ? React.createElement('button', {
                     type: 'button', className: 'dsub-mini',
                     onClick: () => deviceStartLogin(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, t('deviceLogin')) : null),

package/lib/vendors/claude.js

@@ -222,20 +222,65 @@ export async function usage(blob, _cfg, fetchImpl) {
   }
 }
 
-export function makeClaudeBillingHeader(cfg) {
+const billingAccountState = new Map()
+const MAX_BILLING_ACCOUNTS = 256
+
+function resolveAccountKey(cfg, context) {
+  const explicit = (context && context.accountId) || (cfg && cfg.accountId)
+  if (typeof explicit === 'string' && explicit.trim()) return explicit.trim()
+  const blob = (context && context.blob) || (cfg && cfg.blob)
+  if (blob && typeof blob === 'object') {
+    const id = blob.accountId || blob.id || blob.email
+    if (typeof id === 'string' && id.trim()) return id.trim()
+    if (typeof blob.accessToken === 'string' && blob.accessToken.length >= 8) {
+      return `token:${blob.accessToken.slice(-12)}`
+    }
+  }
+  return 'default'
+}
+
+function resolvePromptIndex(cfg, context) {
+  const explicit = (context && context.promptIndex !== undefined)
+    ? context.promptIndex
+    : (cfg && cfg.promptIndex !== undefined ? cfg.promptIndex : undefined)
+  if (typeof explicit === 'number' && Number.isFinite(explicit) && explicit >= 0) {
+    return Math.floor(explicit)
+  }
+  const messages = (context && context.options && Array.isArray(context.options.messages))
+    ? context.options.messages
+    : (context && Array.isArray(context.messages) ? context.messages : null)
+  if (messages) {
+    const userTurns = messages.filter((m) => m && m.role === 'user').length
+    return Math.max(0, userTurns - 1)
+  }
+  return 0
+}
+
+export function makeClaudeBillingHeader(cfg, context) {
   const ccVersion = (cfg && cfg.claudeCcVersion) || '2.1.289.7e2'
-  const cch = (globalThis.__DSH_CC_H__ || (() => {
-    globalThis.__DSH_CC_H__ = Math.random().toString(16).slice(2, 6)
-    return globalThis.__DSH_CC_H__
-  })())
-  const turnIndex = (globalThis.__DSH_CC_TURN__ = (globalThis.__DSH_CC_TURN__ || 0) + 1)
-  return `x-anthropic-billing-header: cc_version=${ccVersion}; cc_entrypoint=sdk-cli; cch=${cch}; cc_turn_origin=sdk; cc_prompt_index=0; cc_turn_index=${turnIndex};`
+  const accountKey = resolveAccountKey(cfg, context)
+  let state = billingAccountState.get(accountKey)
+  if (!state) {
+    if (billingAccountState.size >= MAX_BILLING_ACCOUNTS) {
+      const oldestKey = billingAccountState.keys().next().value
+      if (oldestKey !== undefined) billingAccountState.delete(oldestKey)
+    }
+    state = {
+      cch: Math.random().toString(16).slice(2, 6).padEnd(4, '0'),
+      turnIndex: 0,
+    }
+    billingAccountState.set(accountKey, state)
+  }
+  state.turnIndex += 1
+  const promptIndex = resolvePromptIndex(cfg, context)
+  return `x-anthropic-billing-header: cc_version=${ccVersion}; cc_entrypoint=sdk-cli; cch=${state.cch}; cc_turn_origin=sdk; cc_prompt_index=${promptIndex}; cc_turn_index=${state.turnIndex};`
 }
 
-export function applyClaudeBillingHeader(payload, cfg) {
+export function applyClaudeBillingHeader(payload, cfg, context) {
   if (process.env.CLAUDE_CODE_ATTRIBUTION_HEADER === '0') return payload
+  if (cfg && cfg.disableBillingHeader === true) return payload
   if (!payload) return payload
-  const headerText = makeClaudeBillingHeader(cfg)
+  const headerText = makeClaudeBillingHeader(cfg, context)
   const headerBlock = { type: 'text', text: headerText }
   if (Array.isArray(payload.system)) {
     if (!payload.system.some((b) => typeof b === 'object' && b && typeof b.text === 'string' && b.text.startsWith('x-anthropic-billing-header:'))) {
@@ -249,10 +294,10 @@ export function applyClaudeBillingHeader(payload, cfg) {
   return payload
 }
 
-export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
+export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal, accountId }) {
   const payload = anthropicPayload(options, config.systemPrefix || IDENTITY)
   applyClaudeThinking(payload, options)
-  applyClaudeBillingHeader(payload, config)
+  applyClaudeBillingHeader(payload, config, { accountId, blob, options })
   const res = await fetchImpl(API, {
     method: 'POST',
     headers: {

package/lib/vendors/copilot-cli.js

@@ -184,7 +184,7 @@ export function isCopilotCliAvailable(options = {}) {
  * Translate DSH turn options to Copilot CLI arguments and environment.
  * @param {any} options
  * @param {any} [blob]
- * @param {string} [binaryPath]
+ * @param {string} [_binaryPath]
  * @returns {{ args: string[], env: NodeJS.ProcessEnv, inputPayload: string }}
  */
 export function prepareCopilotCliInvocation(options, blob = {}, _binaryPath = 'copilot') {
@@ -239,7 +239,7 @@ export function prepareCopilotCliInvocation(options, blob = {}, _binaryPath = 'c
  * @param {Function} [params.spawnImpl] Test seam for child_process.spawn
  * @returns {AsyncGenerator<any, void, unknown>}
  */
-export async function* streamCopilotCli({ binaryPath, options, blob, _config, signal, spawnImpl }) {
+export async function* streamCopilotCli({ binaryPath, options, blob, config: _config, signal, spawnImpl }) {
   if (signal && signal.aborted) {
     throw new LlmError('Request aborted by client', 'ABORTED')
   }

package/lib/vendors/grok.js

@@ -230,6 +230,84 @@ export async function usage(blob, cfg, fetchImpl) {
   }
 }
 
+const DEVICE_CODE_URL = 'https://auth.x.ai/oauth2/device/code'
+const DEVICE_AUTH_URL = 'https://accounts.x.ai/oauth2/device'
+
+export async function deviceStart(cfg, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const clientId = (cfg && cfg.clientId) || defaults().clientId
+  const params = new URLSearchParams({
+    client_id: clientId,
+    scope: SCOPE,
+  })
+  const res = await impl(DEVICE_CODE_URL, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+    },
+    body: params.toString(),
+  })
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.user_code !== 'string' || typeof json.device_code !== 'string') {
+    throw httpError(502, 'xAI device authorization response is incomplete', 'DEVICE')
+  }
+  return {
+    userCode: json.user_code,
+    deviceAuthId: json.device_code,
+    intervalMs: Math.max(parseInt(json.interval, 10) || 5, 1) * 1000,
+    authUrl: json.verification_uri_complete || json.verification_uri || DEVICE_AUTH_URL,
+  }
+}
+
+export async function devicePoll(cfg, session, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const clientId = (cfg && cfg.clientId) || defaults().clientId
+  const params = new URLSearchParams({
+    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+    client_id: clientId,
+    device_code: session.deviceAuthId,
+  })
+  const res = await impl(TOKEN, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+    },
+    body: params.toString(),
+  })
+  if (res.status === 400 || res.status === 403) {
+    const rawText = await res.text().catch(() => '')
+    let errJson = {}
+    try {
+      errJson = JSON.parse(rawText)
+    } catch (err) {
+      errJson = { error: String(err && err.message) }
+    }
+    if (errJson && (errJson.error === 'authorization_pending' || errJson.error === 'slow_down')) {
+      return { status: 'pending' }
+    }
+    if (errJson && errJson.error === 'expired_token') {
+      return { status: 'expired' }
+    }
+    if (errJson && errJson.error) {
+      throw httpError(400, errJson.error_description || errJson.error, 'DEVICE')
+    }
+    throw httpError(res.status, rawText, 'DEVICE')
+  }
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.access_token !== 'string') {
+    throw httpError(502, 'xAI device token response is incomplete', 'DEVICE')
+  }
+  const blob = tokenBlobFromOAuth(json)
+  return {
+    status: 'authorized',
+    blob: { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Grok' },
+  }
+}
+
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
   const base = (config.baseUrl || defaults().baseUrl).replace(/\/$/, '')
   let body = codexResponsesBody(options, '')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.66",
+  "version": "0.6.68",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",