@goodandready/dsh-subscriptions 0.6.71 → 0.6.82

package/lib/vendors/claude.js

@@ -2,7 +2,7 @@ import { fetchWithTimeout } from '../http.js'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { anthropicPayload, modelCatalog } from '../messages.js'
 import { jsonTokenRequest, anthropicStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
-import { emailFromToken } from '../jwt.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import { asUsageSnapshot, usageWindows, deepestUsedPercent } from '../usage.js'
 
 export const id = 'claude'
@@ -81,13 +81,19 @@ export function defaults() {
   }
 }
 
-function oauthHeaders(token) {
-  return {
+function oauthHeaders(token, blob) {
+  const h = {
     Authorization: `Bearer ${token}`,
     Accept: 'application/json',
     'anthropic-version': '2023-06-01',
     'anthropic-beta': BETA,
   }
+  const org = blob && (blob.selectedOrgId || blob.organizationId)
+  if (org) {
+    h['anthropic-organization-id'] = String(org)
+    h['x-anthropic-organization'] = String(org)
+  }
+  return h
 }
 
 export function authorizeUrl(cfg, pkce) {
@@ -104,14 +110,56 @@ export function authorizeUrl(cfg, pkce) {
 
 async function decorate(blob, fetchImpl) {
   let email = blob.email || emailFromToken(blob.accessToken)
-  if (!email && fetchImpl && blob.accessToken) {
+  let plan = blob.plan || planFromToken(blob.accessToken)
+  let avatarUrl = blob.avatarUrl || avatarFromToken(blob.accessToken)
+  let scopes = blob.scopes || scopesFromToken(blob.accessToken)
+  let orgs = Array.isArray(blob.organizations) ? [...blob.organizations] : []
+  if (fetchImpl && blob.accessToken && (!email || !plan || !orgs.length)) {
     try {
-      const res = await fetchImpl(PROFILE, { headers: oauthHeaders(blob.accessToken) })
+      const res = await fetchImpl(PROFILE, { headers: oauthHeaders(blob.accessToken, blob) })
       const json = await readJson(res)
-      email = json.email || (json.account && json.account.email) || email
+      email = email || json.email || (json.account && json.account.email) || ""
+      plan = plan || json.plan || (json.account && (json.account.plan_type || (json.account.has_team ? "Team" : (json.account.has_pro ? "Pro" : "Free")))) || ""
+      avatarUrl = avatarUrl || json.picture || (json.account && json.account.picture) || ""
+      if (json.scope && !scopes.length) scopes = String(json.scope).split(/[\s,]+/).filter(Boolean)
+      if (Array.isArray(json.organizations)) {
+        for (const o of json.organizations) {
+          if (o && (o.id || o.uuid)) orgs.push({ id: String(o.id || o.uuid), name: String(o.name || o.title || o.id) })
+        }
+      } else if (Array.isArray(json.workspaces)) {
+        for (const w of json.workspaces) {
+          if (w && (w.id || w.uuid)) orgs.push({ id: String(w.id || w.uuid), name: String(w.name || w.title || w.id) })
+        }
+      } else if (json.account && Array.isArray(json.account.memberships)) {
+        for (const m of json.account.memberships) {
+          const o = m.organization || m
+          if (o && (o.id || o.uuid)) orgs.push({ id: String(o.id || o.uuid), name: String(o.name || o.title || o.id), role: m.role ? String(m.role) : undefined })
+        }
+      }
     } catch { /* profile is optional */ }
   }
-  return { ...blob, email, label: blob.label || email || 'Claude' }
+  const dedupedOrgs = []
+  const seen = new Set()
+  for (const o of orgs) {
+    if (!seen.has(o.id)) {
+      seen.add(o.id)
+      dedupedOrgs.push(o)
+    }
+  }
+  const selectedOrgId = blob.selectedOrgId || blob.organizationId || (dedupedOrgs[0] ? dedupedOrgs[0].id : '')
+  const selectedOrgName = blob.selectedOrgName || (dedupedOrgs.find(o => o.id === selectedOrgId)?.name || selectedOrgId)
+  return {
+    ...blob,
+    email: email || "",
+    plan: plan || "Claude Pro",
+    avatarUrl: avatarUrl || "",
+    scopes,
+    selectedOrgId,
+    selectedOrgName,
+    organizationId: selectedOrgId,
+    organizations: dedupedOrgs,
+    label: blob.label || email || "Claude",
+  }
 }
 
 export async function exchangeCode(cfg, pkce, code, fetchImpl) {
@@ -302,7 +350,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     method: 'POST',
     headers: {
       ...headers,
-      ...oauthHeaders(blob.accessToken),
+      ...oauthHeaders(blob.accessToken, blob),
       'Content-Type': 'application/json',
       Accept: 'text/event-stream',
     },

package/lib/vendors/codex.js

@@ -2,7 +2,7 @@ import { isTimeoutError, fetchWithTimeout } from "../http.js"
 import { randomUUID, createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { codexResponsesBody, modelCatalog } from '../messages.js'
-import { chatgptAccountId, emailFromToken } from '../jwt.js'
+import { chatgptAccountId, emailFromToken, planFromToken, avatarFromToken, scopesFromToken, organizationsFromToken } from '../jwt.js'
 import { formTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError } from '../wire.js'
 import { asUsageSnapshot, usageWindows, deepestUsedPercent } from '../usage.js'
 
@@ -62,11 +62,13 @@ export function authorizeUrl(cfg, pkce) {
 
 function identityHeaders(blob, config, extra) {
   const originator = config.originator || 'codex_cli_rs'
+  const activeOrgId = blob.selectedOrgId || blob.accountId || ''
   return {
     Authorization: `Bearer ${blob.accessToken}`,
     originator,
-    'chatgpt-account-id': blob.accountId || '',
-    'ChatGPT-Account-ID': blob.accountId || '',
+    'chatgpt-account-id': activeOrgId,
+    'ChatGPT-Account-ID': activeOrgId,
+    ...(activeOrgId ? { 'OpenAI-Organization': activeOrgId } : {}),
     'User-Agent': `${originator}/0.0.1`,
     'OpenAI-Beta': 'responses=experimental',
     ...(extra || {}),
@@ -75,11 +77,37 @@ function identityHeaders(blob, config, extra) {
 
 function decorate(blob, json) {
   const idToken = (json && json.id_token) || blob.idToken || ''
+  const email = blob.email || emailFromToken(idToken) || emailFromToken(blob.accessToken)
+  const plan = blob.plan || planFromToken(idToken) || planFromToken(blob.accessToken)
+  const avatarUrl = blob.avatarUrl || avatarFromToken(idToken) || avatarFromToken(blob.accessToken)
+  const scopes = blob.scopes?.length ? blob.scopes : (json?.scope ? String(json.scope).split(/[\s,]+/).filter(Boolean) : scopesFromToken(idToken || blob.accessToken))
+  const parsedOrgs = [
+    ...organizationsFromToken(idToken),
+    ...organizationsFromToken(blob.accessToken),
+  ]
+  const dedupedOrgs = Array.isArray(blob.organizations) && blob.organizations.length ? [...blob.organizations] : []
+  const seen = new Set(dedupedOrgs.map(o => o.id))
+  for (const o of parsedOrgs) {
+    if (!seen.has(o.id)) {
+      seen.add(o.id)
+      dedupedOrgs.push(o)
+    }
+  }
+  const accountId = blob.accountId || chatgptAccountId(idToken) || chatgptAccountId(blob.accessToken)
+  const selectedOrgId = blob.selectedOrgId || accountId || (dedupedOrgs[0] ? dedupedOrgs[0].id : '')
+  const selectedOrgName = blob.selectedOrgName || (dedupedOrgs.find(o => o.id === selectedOrgId)?.name || selectedOrgId)
+
   return {
     ...blob,
-    accountId: blob.accountId || chatgptAccountId(idToken) || chatgptAccountId(blob.accessToken),
-    email: blob.email || emailFromToken(idToken) || emailFromToken(blob.accessToken),
-    label: blob.label || emailFromToken(idToken) || emailFromToken(blob.accessToken) || 'ChatGPT',
+    accountId,
+    selectedOrgId,
+    selectedOrgName,
+    organizations: dedupedOrgs,
+    email,
+    plan: plan || 'ChatGPT',
+    avatarUrl,
+    scopes,
+    label: blob.label || email || 'ChatGPT',
   }
 }
 

package/lib/vendors/copilot-cli.js

@@ -187,8 +187,13 @@ export function isCopilotCliAvailable(options = {}) {
  * @param {string} [_binaryPath]
  * @returns {{ args: string[], env: NodeJS.ProcessEnv, inputPayload: string }}
  */
+export const COPILOT_MODEL_PATTERN = /^[A-Za-z0-9._:/][A-Za-z0-9._:/-]{0,119}$/
+
 export function prepareCopilotCliInvocation(options, blob = {}, _binaryPath = 'copilot') {
-  const model = options.model || 'claude-3.7-sonnet'
+  const model = String(options.model || 'claude-3.7-sonnet')
+  if (!COPILOT_MODEL_PATTERN.test(model)) {
+    throw new LlmError(`Invalid Copilot model id: ${model.slice(0, 80)}`, 'INVALID_MODEL')
+  }
   const token = blob.accessToken || blob.githubToken || blob.refreshToken || ''
 
   const args = [
@@ -265,6 +270,8 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
   }
 
   if (child.stdin) {
+    // EPIPE is expected when the CLI exits before reading stdin; never let it crash the host.
+    child.stdin.on('error', () => {})
     child.stdin.write(inputPayload)
     child.stdin.end()
   }

package/lib/vendors/ernie.js

@@ -44,8 +44,15 @@ export async function listModels() {
 
 async function refreshErnieToken(apiKey, secretKey, fetchImpl) {
   const impl = fetchImpl || fetch
-  const url = `${ERNIE_OAUTH_URL}?grant_type=client_credentials&client_id=${encodeURIComponent(apiKey)}&client_secret=${encodeURIComponent(secretKey)}`
-  const res = await impl(url, { method: 'POST' })
+  const res = await impl(ERNIE_OAUTH_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'client_credentials',
+      client_id: apiKey,
+      client_secret: secretKey,
+    }),
+  })
   if (!res.ok) throw httpError(res.status, await res.text())
   return readJson(res)
 }

package/lib/vendors/grok.js

@@ -1,7 +1,8 @@
+import { createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { modelCatalog, codexResponsesBody } from '../messages.js'
 import { formTokenRequest, codexResponsesStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
-import { emailFromToken } from '../jwt.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import { asUsageSnapshot, usageWindows, grokBillingPercent } from '../usage.js'
 
 export const id = 'grok'
@@ -13,14 +14,41 @@ const BILLING = 'https://cli-chat-proxy.grok.com/v1/billing?format=credits'
 const MODELS = 'https://api.x.ai/v1/models'
 const CLI_MODELS = 'https://cli-chat-proxy.grok.com/v1/models'
 const CATALOG_TTL_MS = 5 * 60 * 1000
+const CATALOG_CACHE_MAX = 32
 const catalogCache = new Map()
 
+function catalogKey(token) {
+  return createHash('sha256').update(String(token || '')).digest('hex').slice(0, 16)
+}
+
+function pruneCatalogCache(now = Date.now()) {
+  for (const [key, entry] of catalogCache) {
+    if (now - entry.at >= CATALOG_TTL_MS) catalogCache.delete(key)
+  }
+  while (catalogCache.size > CATALOG_CACHE_MAX) {
+    catalogCache.delete(catalogCache.keys().next().value)
+  }
+}
+
+export function grokCatalogCacheSize() {
+  return catalogCache.size
+}
+
+export function clearGrokCatalogCache() {
+  catalogCache.clear()
+}
+
 async function cliCatalogCached(blob, cfg, fetchImpl) {
-  const key = String(blob.accessToken || '').slice(-24)
+  const key = catalogKey(blob.accessToken)
+  const now = Date.now()
   const hit = catalogCache.get(key)
-  if (hit && Date.now() - hit.at < CATALOG_TTL_MS) return hit.map
+  if (hit && now - hit.at < CATALOG_TTL_MS) return hit.map
+  if (hit) catalogCache.delete(key)
   const map = await cliCatalog(blob, cfg, fetchImpl)
-  if (map.size > 0) catalogCache.set(key, { at: Date.now(), map })
+  if (map.size > 0) {
+    catalogCache.set(key, { at: now, map })
+    pruneCatalogCache(now)
+  }
   return map
 }
 
@@ -78,13 +106,41 @@ function identityHeaders(blob, config) {
   }
 }
 
+const TRUSTED_AUTH_HOSTS = new Set(['api.x.ai', 'cli-chat-proxy.grok.com'])
+
+function isTrustedAuthHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  return TRUSTED_AUTH_HOSTS.has(host)
+    || host === 'grok.com'
+    || host.endsWith('.grok.com')
+    || host === 'localhost'
+    || host === '127.0.0.1'
+    || host === '::1'
+}
+
+function isGrokHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  return host === 'grok.com' || host.endsWith('.grok.com')
+}
+
 function streamHeaders(blob, config, extra) {
   const base = String(config.baseUrl || defaults().baseUrl)
+  let hostname = ''
+  try {
+    hostname = new URL(base).hostname
+  } catch {
+    hostname = ''
+  }
+  if (!isTrustedAuthHost(hostname)) {
+    const err = new Error(`Untrusted Grok baseUrl host: ${hostname || base}`)
+    err.code = 'GROK_UNTRUSTED_HOST'
+    throw err
+  }
   const headers = {
     Authorization: `Bearer ${blob.accessToken}`,
     ...(extra || {}),
   }
-  if (/grok\.com/i.test(base)) Object.assign(headers, identityHeaders(blob, config))
+  if (isGrokHost(hostname)) Object.assign(headers, identityHeaders(blob, config))
   return headers
 }
 
@@ -108,7 +164,11 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
     code_verifier: pkce.verifier,
   }, fetchImpl)
   const blob = tokenBlobFromOAuth(json)
-  return { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Grok' }
+  const email = blob.email || emailFromToken(blob.idToken || blob.accessToken)
+  const plan = blob.plan || planFromToken(blob.idToken || blob.accessToken)
+  const avatarUrl = blob.avatarUrl || avatarFromToken(blob.idToken || blob.accessToken)
+  const scopes = blob.scopes?.length ? blob.scopes : (json?.scope ? String(json.scope).split(/[\s,]+/).filter(Boolean) : scopesFromToken(blob.idToken || blob.accessToken))
+  return { ...blob, email, plan, avatarUrl, scopes, label: blob.label || email || "Grok" }
 }
 
 export async function refresh(cfg, blob, fetchImpl) {

package/lib/vendors/jetbrains.js

@@ -1,9 +1,19 @@
+// #563: JetBrains AI Assistant Subscription OAuth Vendor
+// Supports OAuth PKCE authentication, token refresh, and JetBrains AI models.
+
 import { LlmError } from '@deepseek-ai/dsh-llm'
-import { openaiMessages } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { buildAuthorizeUrl } from '../oauth.js'
+import { openaiMessages, modelCatalog } from '../messages.js'
+import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson } from '../wire.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 
 export const id = 'jetbrains'
+
+const AUTH = 'https://account.jetbrains.com/oauth2/auth'
+const TOKEN = 'https://oauth.jetbrains.com/oauth2/token'
 const JETBRAINS_API_BASE = 'https://api.jetbrains.ai'
+const USER_INFO = 'https://account.jetbrains.com/api/user'
+const SCOPE = 'openid profile email ai.assistant offline_access'
 
 const JETBRAINS_MODELS = [
   {
@@ -11,15 +21,50 @@ const JETBRAINS_MODELS = [
     name: 'Claude 3.5 Sonnet (JetBrains AI)',
     contextWindow: 200000,
     maxTokens: 8192,
-    inputModalities: ['text']
+    inputModalities: ['text'],
+  },
+  {
+    id: 'jb-claude-3.7-sonnet',
+    name: 'Claude 3.7 Sonnet (JetBrains AI)',
+    contextWindow: 200000,
+    maxTokens: 8192,
+    reasoning: {
+      efforts: [
+        { id: 'low', name: 'low' },
+        { id: 'medium', name: 'medium' },
+        { id: 'high', name: 'high' },
+      ],
+    },
+    inputModalities: ['text'],
   },
   {
     id: 'jb-gpt-4o',
     name: 'GPT-4o (JetBrains AI)',
     contextWindow: 128000,
     maxTokens: 8192,
-    inputModalities: ['text']
-  }
+    inputModalities: ['text'],
+  },
+  {
+    id: 'jb-o3-mini',
+    name: 'o3-mini (JetBrains AI)',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    reasoning: {
+      efforts: [
+        { id: 'low', name: 'low' },
+        { id: 'medium', name: 'medium' },
+        { id: 'high', name: 'high' },
+      ],
+    },
+    inputModalities: ['text'],
+  },
+  {
+    id: 'jb-deepseek-r1',
+    name: 'DeepSeek R1 (JetBrains AI)',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    inputModalities: ['text'],
+  },
 ]
 
 export function providerInfo() {
@@ -28,17 +73,92 @@ export function providerInfo() {
 
 export function defaults() {
   return {
+    clientId: 'jetbrains-ai-assistant',
+    redirectUri: 'http://localhost:1455/auth/callback',
     apiBase: JETBRAINS_API_BASE,
-    models: JETBRAINS_MODELS.map((m) => m.id)
+    models: JETBRAINS_MODELS.map((m) => m.id),
   }
 }
 
-export function authorizeUrl() {
-  return 'https://account.jetbrains.com/'
+export function authorizeUrl(cfg = {}, pkce = {}) {
+  const c = cfg || {}
+  const p = pkce || {}
+  return buildAuthorizeUrl({
+    authUrl: AUTH,
+    clientId: c.clientId || defaults().clientId,
+    redirectUri: c.redirectUri || defaults().redirectUri,
+    challenge: p.challenge || 'challenge',
+    state: p.state || 'state',
+    scope: SCOPE,
+  })
 }
 
-export async function listModels() {
-  return JETBRAINS_MODELS
+async function decorate(blob, fetchImpl) {
+  let email = blob.email || emailFromToken(blob.accessToken) || emailFromToken(blob.idToken)
+  let plan = blob.plan || planFromToken(blob.accessToken)
+  let avatarUrl = blob.avatarUrl || avatarFromToken(blob.accessToken)
+  let scopes = blob.scopes || scopesFromToken(blob.accessToken)
+
+  if (fetchImpl && blob.accessToken && (!email || !plan)) {
+    try {
+      const res = await fetchImpl(USER_INFO, {
+        headers: {
+          Authorization: `Bearer ${blob.accessToken}`,
+          Accept: 'application/json',
+        },
+      })
+      if (res.ok) {
+        const json = await readJson(res)
+        email = email || json.email || json.username || ''
+        plan = plan || json.plan || (json.has_ai_assistant ? 'JetBrains AI Pro' : 'JetBrains Account')
+        avatarUrl = avatarUrl || json.picture || json.avatar_url || ''
+        if (json.scope && !scopes.length) scopes = String(json.scope).split(/[\s,]+/).filter(Boolean)
+      }
+    } catch { /* user info is optional */ }
+  }
+
+  return {
+    ...blob,
+    email: email || '',
+    plan: plan || 'JetBrains AI Pro',
+    avatarUrl: avatarUrl || '',
+    scopes,
+    label: blob.label || email || 'JetBrains AI',
+  }
+}
+
+export async function exchangeCode(cfg, pkce, code, fetchImpl) {
+  const json = await jsonTokenRequest(TOKEN, {
+    grant_type: 'authorization_code',
+    client_id: cfg.clientId || defaults().clientId,
+    code,
+    redirect_uri: cfg.redirectUri || defaults().redirectUri,
+    code_verifier: pkce.verifier,
+    state: pkce.state,
+  }, fetchImpl)
+  return decorate(tokenBlobFromOAuth(json), fetchImpl)
+}
+
+export async function refresh(cfg, blob, fetchImpl) {
+  const json = await jsonTokenRequest(TOKEN, {
+    grant_type: 'refresh_token',
+    client_id: cfg.clientId || defaults().clientId,
+    refresh_token: blob.refreshToken,
+  }, fetchImpl)
+  return decorate(tokenBlobFromOAuth(json, { label: blob.label, email: blob.email }), fetchImpl)
+}
+
+export async function listModels(_blob, cfg) {
+  const customModels = (cfg && Array.isArray(cfg.models) && cfg.models.length) ? cfg.models : null
+  if (customModels) {
+    const enriched = customModels.map((m) => {
+      const mid = typeof m === 'string' ? m : m.id
+      const found = JETBRAINS_MODELS.find((p) => p.id === mid)
+      return found ? { ...found, ...(typeof m === 'object' ? m : {}) } : (typeof m === 'string' ? { id: m, name: m } : m)
+    })
+    return modelCatalog(id, enriched)
+  }
+  return modelCatalog(id, JETBRAINS_MODELS)
 }
 
 export async function usage() {
@@ -55,7 +175,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const body = {
     model,
     messages: openaiMessages(options),
-    stream: true
+    stream: true,
   }
 
   const res = await impl(url, {
@@ -64,10 +184,10 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
       ...headers,
       'Authorization': `Bearer ${token}`,
       'Content-Type': 'application/json',
-      'User-Agent': 'IntelliJ-IDEA/2026.1'
+      'User-Agent': 'IntelliJ-IDEA/2026.1',
     },
     body: JSON.stringify(body),
-    signal
+    signal,
   })
 
   if (!res.ok) throw httpError(res.status, await res.text())