@goodandready/dsh-subscriptions 0.6.72 → 0.6.82

package/lib/vendors/ernie.js

@@ -44,8 +44,15 @@ export async function listModels() {
 
 async function refreshErnieToken(apiKey, secretKey, fetchImpl) {
   const impl = fetchImpl || fetch
-  const url = `${ERNIE_OAUTH_URL}?grant_type=client_credentials&client_id=${encodeURIComponent(apiKey)}&client_secret=${encodeURIComponent(secretKey)}`
-  const res = await impl(url, { method: 'POST' })
+  const res = await impl(ERNIE_OAUTH_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'client_credentials',
+      client_id: apiKey,
+      client_secret: secretKey,
+    }),
+  })
   if (!res.ok) throw httpError(res.status, await res.text())
   return readJson(res)
 }

package/lib/vendors/grok.js

@@ -1,7 +1,8 @@
+import { createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { modelCatalog, codexResponsesBody } from '../messages.js'
 import { formTokenRequest, codexResponsesStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
-import { emailFromToken } from '../jwt.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import { asUsageSnapshot, usageWindows, grokBillingPercent } from '../usage.js'
 
 export const id = 'grok'
@@ -13,14 +14,41 @@ const BILLING = 'https://cli-chat-proxy.grok.com/v1/billing?format=credits'
 const MODELS = 'https://api.x.ai/v1/models'
 const CLI_MODELS = 'https://cli-chat-proxy.grok.com/v1/models'
 const CATALOG_TTL_MS = 5 * 60 * 1000
+const CATALOG_CACHE_MAX = 32
 const catalogCache = new Map()
 
+function catalogKey(token) {
+  return createHash('sha256').update(String(token || '')).digest('hex').slice(0, 16)
+}
+
+function pruneCatalogCache(now = Date.now()) {
+  for (const [key, entry] of catalogCache) {
+    if (now - entry.at >= CATALOG_TTL_MS) catalogCache.delete(key)
+  }
+  while (catalogCache.size > CATALOG_CACHE_MAX) {
+    catalogCache.delete(catalogCache.keys().next().value)
+  }
+}
+
+export function grokCatalogCacheSize() {
+  return catalogCache.size
+}
+
+export function clearGrokCatalogCache() {
+  catalogCache.clear()
+}
+
 async function cliCatalogCached(blob, cfg, fetchImpl) {
-  const key = String(blob.accessToken || '').slice(-24)
+  const key = catalogKey(blob.accessToken)
+  const now = Date.now()
   const hit = catalogCache.get(key)
-  if (hit && Date.now() - hit.at < CATALOG_TTL_MS) return hit.map
+  if (hit && now - hit.at < CATALOG_TTL_MS) return hit.map
+  if (hit) catalogCache.delete(key)
   const map = await cliCatalog(blob, cfg, fetchImpl)
-  if (map.size > 0) catalogCache.set(key, { at: Date.now(), map })
+  if (map.size > 0) {
+    catalogCache.set(key, { at: now, map })
+    pruneCatalogCache(now)
+  }
   return map
 }
 
@@ -78,13 +106,41 @@ function identityHeaders(blob, config) {
   }
 }
 
+const TRUSTED_AUTH_HOSTS = new Set(['api.x.ai', 'cli-chat-proxy.grok.com'])
+
+function isTrustedAuthHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  return TRUSTED_AUTH_HOSTS.has(host)
+    || host === 'grok.com'
+    || host.endsWith('.grok.com')
+    || host === 'localhost'
+    || host === '127.0.0.1'
+    || host === '::1'
+}
+
+function isGrokHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  return host === 'grok.com' || host.endsWith('.grok.com')
+}
+
 function streamHeaders(blob, config, extra) {
   const base = String(config.baseUrl || defaults().baseUrl)
+  let hostname = ''
+  try {
+    hostname = new URL(base).hostname
+  } catch {
+    hostname = ''
+  }
+  if (!isTrustedAuthHost(hostname)) {
+    const err = new Error(`Untrusted Grok baseUrl host: ${hostname || base}`)
+    err.code = 'GROK_UNTRUSTED_HOST'
+    throw err
+  }
   const headers = {
     Authorization: `Bearer ${blob.accessToken}`,
     ...(extra || {}),
   }
-  if (/grok\.com/i.test(base)) Object.assign(headers, identityHeaders(blob, config))
+  if (isGrokHost(hostname)) Object.assign(headers, identityHeaders(blob, config))
   return headers
 }
 
@@ -108,7 +164,11 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
     code_verifier: pkce.verifier,
   }, fetchImpl)
   const blob = tokenBlobFromOAuth(json)
-  return { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Grok' }
+  const email = blob.email || emailFromToken(blob.idToken || blob.accessToken)
+  const plan = blob.plan || planFromToken(blob.idToken || blob.accessToken)
+  const avatarUrl = blob.avatarUrl || avatarFromToken(blob.idToken || blob.accessToken)
+  const scopes = blob.scopes?.length ? blob.scopes : (json?.scope ? String(json.scope).split(/[\s,]+/).filter(Boolean) : scopesFromToken(blob.idToken || blob.accessToken))
+  return { ...blob, email, plan, avatarUrl, scopes, label: blob.label || email || "Grok" }
 }
 
 export async function refresh(cfg, blob, fetchImpl) {

package/lib/vendors/jetbrains.js

@@ -1,9 +1,19 @@
+// #563: JetBrains AI Assistant Subscription OAuth Vendor
+// Supports OAuth PKCE authentication, token refresh, and JetBrains AI models.
+
 import { LlmError } from '@deepseek-ai/dsh-llm'
-import { openaiMessages } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { buildAuthorizeUrl } from '../oauth.js'
+import { openaiMessages, modelCatalog } from '../messages.js'
+import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson } from '../wire.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 
 export const id = 'jetbrains'
+
+const AUTH = 'https://account.jetbrains.com/oauth2/auth'
+const TOKEN = 'https://oauth.jetbrains.com/oauth2/token'
 const JETBRAINS_API_BASE = 'https://api.jetbrains.ai'
+const USER_INFO = 'https://account.jetbrains.com/api/user'
+const SCOPE = 'openid profile email ai.assistant offline_access'
 
 const JETBRAINS_MODELS = [
   {
@@ -11,15 +21,50 @@ const JETBRAINS_MODELS = [
     name: 'Claude 3.5 Sonnet (JetBrains AI)',
     contextWindow: 200000,
     maxTokens: 8192,
-    inputModalities: ['text']
+    inputModalities: ['text'],
+  },
+  {
+    id: 'jb-claude-3.7-sonnet',
+    name: 'Claude 3.7 Sonnet (JetBrains AI)',
+    contextWindow: 200000,
+    maxTokens: 8192,
+    reasoning: {
+      efforts: [
+        { id: 'low', name: 'low' },
+        { id: 'medium', name: 'medium' },
+        { id: 'high', name: 'high' },
+      ],
+    },
+    inputModalities: ['text'],
   },
   {
     id: 'jb-gpt-4o',
     name: 'GPT-4o (JetBrains AI)',
     contextWindow: 128000,
     maxTokens: 8192,
-    inputModalities: ['text']
-  }
+    inputModalities: ['text'],
+  },
+  {
+    id: 'jb-o3-mini',
+    name: 'o3-mini (JetBrains AI)',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    reasoning: {
+      efforts: [
+        { id: 'low', name: 'low' },
+        { id: 'medium', name: 'medium' },
+        { id: 'high', name: 'high' },
+      ],
+    },
+    inputModalities: ['text'],
+  },
+  {
+    id: 'jb-deepseek-r1',
+    name: 'DeepSeek R1 (JetBrains AI)',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    inputModalities: ['text'],
+  },
 ]
 
 export function providerInfo() {
@@ -28,17 +73,92 @@ export function providerInfo() {
 
 export function defaults() {
   return {
+    clientId: 'jetbrains-ai-assistant',
+    redirectUri: 'http://localhost:1455/auth/callback',
     apiBase: JETBRAINS_API_BASE,
-    models: JETBRAINS_MODELS.map((m) => m.id)
+    models: JETBRAINS_MODELS.map((m) => m.id),
   }
 }
 
-export function authorizeUrl() {
-  return 'https://account.jetbrains.com/'
+export function authorizeUrl(cfg = {}, pkce = {}) {
+  const c = cfg || {}
+  const p = pkce || {}
+  return buildAuthorizeUrl({
+    authUrl: AUTH,
+    clientId: c.clientId || defaults().clientId,
+    redirectUri: c.redirectUri || defaults().redirectUri,
+    challenge: p.challenge || 'challenge',
+    state: p.state || 'state',
+    scope: SCOPE,
+  })
 }
 
-export async function listModels() {
-  return JETBRAINS_MODELS
+async function decorate(blob, fetchImpl) {
+  let email = blob.email || emailFromToken(blob.accessToken) || emailFromToken(blob.idToken)
+  let plan = blob.plan || planFromToken(blob.accessToken)
+  let avatarUrl = blob.avatarUrl || avatarFromToken(blob.accessToken)
+  let scopes = blob.scopes || scopesFromToken(blob.accessToken)
+
+  if (fetchImpl && blob.accessToken && (!email || !plan)) {
+    try {
+      const res = await fetchImpl(USER_INFO, {
+        headers: {
+          Authorization: `Bearer ${blob.accessToken}`,
+          Accept: 'application/json',
+        },
+      })
+      if (res.ok) {
+        const json = await readJson(res)
+        email = email || json.email || json.username || ''
+        plan = plan || json.plan || (json.has_ai_assistant ? 'JetBrains AI Pro' : 'JetBrains Account')
+        avatarUrl = avatarUrl || json.picture || json.avatar_url || ''
+        if (json.scope && !scopes.length) scopes = String(json.scope).split(/[\s,]+/).filter(Boolean)
+      }
+    } catch { /* user info is optional */ }
+  }
+
+  return {
+    ...blob,
+    email: email || '',
+    plan: plan || 'JetBrains AI Pro',
+    avatarUrl: avatarUrl || '',
+    scopes,
+    label: blob.label || email || 'JetBrains AI',
+  }
+}
+
+export async function exchangeCode(cfg, pkce, code, fetchImpl) {
+  const json = await jsonTokenRequest(TOKEN, {
+    grant_type: 'authorization_code',
+    client_id: cfg.clientId || defaults().clientId,
+    code,
+    redirect_uri: cfg.redirectUri || defaults().redirectUri,
+    code_verifier: pkce.verifier,
+    state: pkce.state,
+  }, fetchImpl)
+  return decorate(tokenBlobFromOAuth(json), fetchImpl)
+}
+
+export async function refresh(cfg, blob, fetchImpl) {
+  const json = await jsonTokenRequest(TOKEN, {
+    grant_type: 'refresh_token',
+    client_id: cfg.clientId || defaults().clientId,
+    refresh_token: blob.refreshToken,
+  }, fetchImpl)
+  return decorate(tokenBlobFromOAuth(json, { label: blob.label, email: blob.email }), fetchImpl)
+}
+
+export async function listModels(_blob, cfg) {
+  const customModels = (cfg && Array.isArray(cfg.models) && cfg.models.length) ? cfg.models : null
+  if (customModels) {
+    const enriched = customModels.map((m) => {
+      const mid = typeof m === 'string' ? m : m.id
+      const found = JETBRAINS_MODELS.find((p) => p.id === mid)
+      return found ? { ...found, ...(typeof m === 'object' ? m : {}) } : (typeof m === 'string' ? { id: m, name: m } : m)
+    })
+    return modelCatalog(id, enriched)
+  }
+  return modelCatalog(id, JETBRAINS_MODELS)
 }
 
 export async function usage() {
@@ -55,7 +175,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const body = {
     model,
     messages: openaiMessages(options),
-    stream: true
+    stream: true,
   }
 
   const res = await impl(url, {
@@ -64,10 +184,10 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
       ...headers,
       'Authorization': `Bearer ${token}`,
       'Content-Type': 'application/json',
-      'User-Agent': 'IntelliJ-IDEA/2026.1'
+      'User-Agent': 'IntelliJ-IDEA/2026.1',
     },
     body: JSON.stringify(body),
-    signal
+    signal,
   })
 
   if (!res.ok) throw httpError(res.status, await res.text())

package/lib/vendors/perplexity.js

@@ -1,9 +1,20 @@
+// #563: Perplexity Pro Subscription OAuth Vendor
+// Supports OAuth PKCE authentication, token refresh, and Pro subscription models.
+
 import { LlmError } from '@deepseek-ai/dsh-llm'
-import { openaiMessages } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { buildAuthorizeUrl } from '../oauth.js'
+import { openaiMessages, modelCatalog } from '../messages.js'
+import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson } from '../wire.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 
 export const id = 'perplexity'
+
+const AUTH = 'https://www.perplexity.ai/oauth/authorize'
+const TOKEN = 'https://api.perplexity.ai/oauth/token'
 const PERPLEXITY_API_BASE = 'https://api.perplexity.ai'
+const PROFILE = 'https://api.perplexity.ai/api/v1/user/profile'
+const USAGE = 'https://api.perplexity.ai/api/v1/user/usage'
+const SCOPE = 'openid profile email pro:search offline_access'
 
 const PERPLEXITY_MODELS = [
   {
@@ -11,15 +22,43 @@ const PERPLEXITY_MODELS = [
     name: 'Sonar Reasoning Pro',
     contextWindow: 128000,
     maxTokens: 8192,
-    inputModalities: ['text']
+    reasoning: {
+      efforts: [
+        { id: 'low', name: 'low' },
+        { id: 'medium', name: 'medium' },
+        { id: 'high', name: 'high' },
+      ],
+    },
+    inputModalities: ['text'],
   },
   {
     id: 'sonar-pro',
     name: 'Sonar Pro',
     contextWindow: 200000,
     maxTokens: 8192,
-    inputModalities: ['text']
-  }
+    inputModalities: ['text'],
+  },
+  {
+    id: 'sonar-reasoning',
+    name: 'Sonar Reasoning',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    inputModalities: ['text'],
+  },
+  {
+    id: 'sonar',
+    name: 'Sonar',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    inputModalities: ['text'],
+  },
+  {
+    id: 'r1-1776',
+    name: 'DeepSeek R1 (Perplexity)',
+    contextWindow: 128000,
+    maxTokens: 8192,
+    inputModalities: ['text'],
+  },
 ]
 
 export function providerInfo() {
@@ -28,24 +67,116 @@ export function providerInfo() {
 
 export function defaults() {
   return {
+    clientId: 'perplexity-cli-oauth',
+    redirectUri: 'http://localhost:1455/auth/callback',
     apiBase: PERPLEXITY_API_BASE,
-    models: PERPLEXITY_MODELS.map((m) => m.id)
+    models: PERPLEXITY_MODELS.map((m) => m.id),
   }
 }
 
-export function authorizeUrl() {
-  return 'https://www.perplexity.ai/settings/api'
+export function authorizeUrl(cfg = {}, pkce = {}) {
+  const c = cfg || {}
+  const p = pkce || {}
+  return buildAuthorizeUrl({
+    authUrl: AUTH,
+    clientId: c.clientId || defaults().clientId,
+    redirectUri: c.redirectUri || defaults().redirectUri,
+    challenge: p.challenge || 'challenge',
+    state: p.state || 'state',
+    scope: SCOPE,
+  })
 }
 
-export async function listModels() {
-  return PERPLEXITY_MODELS
+async function decorate(blob, fetchImpl) {
+  let email = blob.email || emailFromToken(blob.accessToken) || emailFromToken(blob.idToken)
+  let plan = blob.plan || planFromToken(blob.accessToken)
+  let avatarUrl = blob.avatarUrl || avatarFromToken(blob.accessToken)
+  let scopes = blob.scopes || scopesFromToken(blob.accessToken)
+
+  if (fetchImpl && blob.accessToken && (!email || !plan)) {
+    try {
+      const res = await fetchImpl(PROFILE, {
+        headers: {
+          Authorization: `Bearer ${blob.accessToken}`,
+          Accept: 'application/json',
+        },
+      })
+      if (res.ok) {
+        const json = await readJson(res)
+        email = email || json.email || ''
+        plan = plan || json.plan || (json.has_pro ? 'Perplexity Pro' : 'Free')
+        avatarUrl = avatarUrl || json.picture || json.avatar_url || ''
+        if (json.scope && !scopes.length) scopes = String(json.scope).split(/[\s,]+/).filter(Boolean)
+      }
+    } catch { /* profile is optional */ }
+  }
+
+  return {
+    ...blob,
+    email: email || '',
+    plan: plan || 'Perplexity Pro',
+    avatarUrl: avatarUrl || '',
+    scopes,
+    label: blob.label || email || 'Perplexity Pro',
+  }
 }
 
-export async function usage(blob) {
-  if (blob && (blob.accessToken || blob.apiKey)) {
-    return { usedPercent: null, plan: 'Perplexity Pro', timestamp: Date.now() }
+export async function exchangeCode(cfg, pkce, code, fetchImpl) {
+  const json = await jsonTokenRequest(TOKEN, {
+    grant_type: 'authorization_code',
+    client_id: cfg.clientId || defaults().clientId,
+    code,
+    redirect_uri: cfg.redirectUri || defaults().redirectUri,
+    code_verifier: pkce.verifier,
+    state: pkce.state,
+  }, fetchImpl)
+  return decorate(tokenBlobFromOAuth(json), fetchImpl)
+}
+
+export async function refresh(cfg, blob, fetchImpl) {
+  const json = await jsonTokenRequest(TOKEN, {
+    grant_type: 'refresh_token',
+    client_id: cfg.clientId || defaults().clientId,
+    refresh_token: blob.refreshToken,
+  }, fetchImpl)
+  return decorate(tokenBlobFromOAuth(json, { label: blob.label, email: blob.email }), fetchImpl)
+}
+
+export async function listModels(_blob, cfg) {
+  const customModels = (cfg && Array.isArray(cfg.models) && cfg.models.length) ? cfg.models : null
+  if (customModels) {
+    const enriched = customModels.map((m) => {
+      const mid = typeof m === 'string' ? m : m.id
+      const found = PERPLEXITY_MODELS.find((p) => p.id === mid)
+      return found ? { ...found, ...(typeof m === 'object' ? m : {}) } : (typeof m === 'string' ? { id: m, name: m } : m)
+    })
+    return modelCatalog(id, enriched)
   }
-  return null
+  return modelCatalog(id, PERPLEXITY_MODELS)
+}
+
+export async function usage(blob, _cfg, fetchImpl) {
+  if (!blob || (!blob.accessToken && !blob.apiKey)) return null
+  const key = blob.accessToken || blob.apiKey
+  const impl = fetchImpl || fetch
+  try {
+    const res = await impl(USAGE, {
+      headers: {
+        Authorization: `Bearer ${key}`,
+        Accept: 'application/json',
+      },
+    })
+    if (res.ok) {
+      const d = await readJson(res)
+      return {
+        usedPercent: typeof d.used_percent === 'number' ? d.used_percent : null,
+        plan: d.plan || blob.plan || 'Perplexity Pro',
+        timestamp: Date.now(),
+        quota: d.quota ? { used: d.quota.used, limit: d.quota.limit, resetAt: d.quota.reset_at } : undefined,
+      }
+    }
+  } catch { /* usage endpoint is optional */ }
+  return { usedPercent: null, plan: blob.plan || 'Perplexity Pro', timestamp: Date.now() }
 }
 
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
@@ -57,7 +188,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const body = {
     model: options.model || 'sonar-pro',
     messages: openaiMessages(options),
-    stream: true
+    stream: true,
   }
 
   const res = await impl(url, {
@@ -65,10 +196,10 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     headers: {
       ...headers,
       'Authorization': `Bearer ${key}`,
-      'Content-Type': 'application/json'
+      'Content-Type': 'application/json',
     },
     body: JSON.stringify(body),
-    signal
+    signal,
   })
 
   if (!res.ok) throw httpError(res.status, await res.text())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.72",
+  "version": "0.6.82",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",