@goodandready/dsh-subscriptions 0.6.67 → 0.6.68

package/README.md

@@ -207,6 +207,9 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **In-App Toast Alerts (`enableToasts`)**: Lightweight floating toast alerts in the DSH chat interface notifying you when accounts enter quarantine, recover from cooldowns, or exceed quota safety thresholds.
 * **Automated Webhook Integration**: Instant event notifications dispatched via `notifyQuarantineEntered` and `notifyQuarantineReleased`.
 
+### 22. ⚡ xAI Grok RFC 8628 Device Authorization Flow (v0.6.68)
+* **RFC 8628 Device Code Authorization (GH #17, #532)**: Native device authorization grant support for xAI Grok. Solves the issue where xAI presents a Grok Build user-code verification page for CLI client IDs without redirecting back to loopback callbacks. Provides direct user code display and automatic token polling.
+
 ### 21. 🛡️ Per-Account Claude Billing Attribution Isolation (v0.6.67)
 * **Per-Account `cc_turn_index` & `cch` Isolation (#530)**: Isolates Claude Code billing attribution state (`cch` session hash and `cc_turn_index` counter) per subscription account (`accountId`) in a bounded module Map instead of `globalThis`, preventing cross-account telemetry mixing in multi-account pools.
 * **Dynamic `cc_prompt_index` & Kill-Switch**: Automatically derives 0-based `cc_prompt_index` from multi-turn `messages` history and supports suppression via `CLAUDE_CODE_ATTRIBUTION_HEADER=0` or `disableBillingHeader: true`.

package/README.ru.md

@@ -183,6 +183,9 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **Всплывающие уведомления (Toast Alerts)**: Легковесные всплывающие тосты в веб-интерфейсе DSH при событиях карантина (с отображением причины), восстановлении доступа и критическом расходе квоты. Включение управляется параметром `enableToasts` (по умолчанию `true`).
 * **Интеграция с вебхуками**: Автоматическая отправка уведомлений через `notifyQuarantineEntered` и `notifyQuarantineReleased`.
 
+### 18. ⚡ RFC 8628 Device Code авторизация для xAI Grok (v0.6.68)
+* **Авторизация по коду устройства (GH #17, #532)**: Нативная поддержка RFC 8628 device code flow для xAI Grok. Устраняет проблему, когда xAI для CLI client ID открывает страницу ввода кода для Grok Build без обратного редиректа на loopback-порт. Отображает одноразовый код на карточке и автоматически поллит токены в фоне.
+
 ### 17. 🛡️ Поаккаунтная изоляция атрибуции биллинга Claude (v0.6.67)
 * **Изоляция `cc_turn_index` и `cch` по `accountId` (#530)**: Состояние атрибуции Claude Code (`cch` и счётчик `cc_turn_index`) изолировано по каждому аккаунту в ограниченной таблице модуля вместо `globalThis`, что исключает смешивание телеметрии между подписками в пуле.
 * **Динамический `cc_prompt_index` и Kill-Switch**: Индекс `cc_prompt_index` автоматически вычисляется по числу пользовательских ходов в `messages`, а отключение заголовка поддерживается через `CLAUDE_CODE_ATTRIBUTION_HEADER=0` или `disableBillingHeader: true`.

package/README.zh.md

@@ -132,6 +132,9 @@ graph LR
   queueTimeoutMs: 30000     # v0.6.62: 队列最大等待超时时间（毫秒）
 * **自动化 Webhook 告警集成**：通过 `notifyQuarantineEntered` 与 `notifyQuarantineReleased` 自动向外部通知系统派发隔离生命周期事件。
 
+### xAI Grok RFC 8628 设备码授权流支持 (v0.6.68)
+* **RFC 8628 设备码授权流 (GH #17, #532)**：为 xAI Grok 新增原生设备码登录授权支持。彻底解决 xAI 针对 CLI 客户端标识返回 Grok Build 验证码页面且不触发回环重定向回调导致的死锁问题。直接在槽位卡片展示用户授权码，并自动在后台轮询兑换会话令牌。
+
 ### Claude 账户级计费归因隔离与动态轮次索引 (v0.6.67)
 * **按账户隔离 `cc_turn_index` 与 `cch` (#530)**：将 Claude Code 计费归因状态（会话哈希 `cch` 与递增轮次 `cc_turn_index`）按 `accountId` 隔离在有界模块级映射表中，彻底消除 `globalThis` 跨订阅账户状态混用问题。
 * **动态计算 `cc_prompt_index` 与禁用开关**：根据多轮对话消息历史自动计算从 0 开始的 `cc_prompt_index`，并支持通过环境变量 `CLAUDE_CODE_ATTRIBUTION_HEADER=0` 或 `disableBillingHeader: true` 禁用归因头注入。

package/lib/client.js

@@ -313,16 +313,20 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       grok: {
         title: "xAI Grok",
         stepsEn: [
-          "1. Run grok CLI login on the server.",
-          "2. Click \"📥 From CLI\" (~/.grok/auth.json).",
-          "3. Or paste your xAI API Key and click \"Save token\".",
+          "1. Click \"Device Login\" (or \"Connect\") on the slot card.",
+          "2. A one-time code will appear on the card.",
+          "3. Open https://accounts.x.ai/oauth2/device, enter the code, and approve access for your xAI account.",
+          "4. The plugin automatically captures tokens and enables Grok models.",
+          "5. Or click \"📥 From CLI\" (~/.grok/auth.json) / paste an xAI API Key.",
         ],
         stepsZh: [
-          "1. 在服务器上运行 grok CLI 登录。",
-          "2. 点击 \"📥 从 CLI 导入\" (~/.grok/auth.json)。",
-          "3. 或将 xAI API 密钥粘贴到输入框并点击 \"保存令牌\"。",
+          "1. 点击卡片上的 \"设备码登录\" (Device Login) 或 \"连接\"。",
+          "2. 界面将展示一次性设备授权码。",
+          "3. 打开 https://accounts.x.ai/oauth2/device，输入代码，并为您拥有 Grok 订阅的 xAI 账户授权。",
+          "4. 授权成功后，插件会自动捕获会话并激活 Grok 官方模型。",
+          "5. 或点击 \"📥 从 CLI 导入\" (~/.grok/auth.json) / 直接粘贴 xAI API 密钥。",
         ],
-        link: "https://x.ai",
+        link: "https://accounts.x.ai/oauth2/device",
       },
       kiro: {
         title: "AWS Kiro",
@@ -1362,7 +1366,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
 
       const connect = async (provider, index) => {
         setErr('')
-        if (provider === 'copilot') {
+        if (provider === 'copilot' || provider === 'grok') {
           return deviceStartLogin(provider, index).catch((e) => setErr(cleanErrorMessage(e.message || e)))
         }
         if (provider === 'antigravity' && (!draft || !draft.antigravityClientId || !String(draft.antigravityClientId).trim())) {
@@ -2253,7 +2257,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                     type: 'button', className: 'dsub-mini',
                     onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, on ? t('reconnect') : t('connect')),
-                  ((row.slot.provider === 'codex' || row.slot.provider === 'copilot') ? React.createElement('button', {
+                  ((row.slot.provider === 'codex' || row.slot.provider === 'copilot' || row.slot.provider === 'grok') ? React.createElement('button', {
                     type: 'button', className: 'dsub-mini',
                     onClick: () => deviceStartLogin(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, t('deviceLogin')) : null),

package/lib/vendors/grok.js

@@ -230,6 +230,84 @@ export async function usage(blob, cfg, fetchImpl) {
   }
 }
 
+const DEVICE_CODE_URL = 'https://auth.x.ai/oauth2/device/code'
+const DEVICE_AUTH_URL = 'https://accounts.x.ai/oauth2/device'
+
+export async function deviceStart(cfg, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const clientId = (cfg && cfg.clientId) || defaults().clientId
+  const params = new URLSearchParams({
+    client_id: clientId,
+    scope: SCOPE,
+  })
+  const res = await impl(DEVICE_CODE_URL, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+    },
+    body: params.toString(),
+  })
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.user_code !== 'string' || typeof json.device_code !== 'string') {
+    throw httpError(502, 'xAI device authorization response is incomplete', 'DEVICE')
+  }
+  return {
+    userCode: json.user_code,
+    deviceAuthId: json.device_code,
+    intervalMs: Math.max(parseInt(json.interval, 10) || 5, 1) * 1000,
+    authUrl: json.verification_uri_complete || json.verification_uri || DEVICE_AUTH_URL,
+  }
+}
+
+export async function devicePoll(cfg, session, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const clientId = (cfg && cfg.clientId) || defaults().clientId
+  const params = new URLSearchParams({
+    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+    client_id: clientId,
+    device_code: session.deviceAuthId,
+  })
+  const res = await impl(TOKEN, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+    },
+    body: params.toString(),
+  })
+  if (res.status === 400 || res.status === 403) {
+    const rawText = await res.text().catch(() => '')
+    let errJson = {}
+    try {
+      errJson = JSON.parse(rawText)
+    } catch (err) {
+      errJson = { error: String(err && err.message) }
+    }
+    if (errJson && (errJson.error === 'authorization_pending' || errJson.error === 'slow_down')) {
+      return { status: 'pending' }
+    }
+    if (errJson && errJson.error === 'expired_token') {
+      return { status: 'expired' }
+    }
+    if (errJson && errJson.error) {
+      throw httpError(400, errJson.error_description || errJson.error, 'DEVICE')
+    }
+    throw httpError(res.status, rawText, 'DEVICE')
+  }
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.access_token !== 'string') {
+    throw httpError(502, 'xAI device token response is incomplete', 'DEVICE')
+  }
+  const blob = tokenBlobFromOAuth(json)
+  return {
+    status: 'authorized',
+    blob: { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Grok' },
+  }
+}
+
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
   const base = (config.baseUrl || defaults().baseUrl).replace(/\/$/, '')
   let body = codexResponsesBody(options, '')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.67",
+  "version": "0.6.68",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",