@goodandready/dsh-subscriptions 0.7.46 → 0.7.48

package/lib/accounts.js

@@ -51,6 +51,7 @@ import { recordSwitch, recordExhaust, recordBroken, computeHealthScore, healthBa
 import { executeWithRetry } from './backoff.js'
 import { getVendor } from './vendors/index.js'
 import { versionForProvider } from './client-version-service.js'
+import { writeClaudeKeychain } from './claude-keychain.js'
 
 const SKEW_MS = 60 * 1000
 const USAGE_TTL_MS = 2 * 60 * 1000
@@ -508,6 +509,9 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
           accountId: next.accountId || blob.accountId,
         }
         if (ref) await saveBlob(ref, merged)
+        if (ref && provider === 'claude' && blob.accessToken && merged.accessToken !== blob.accessToken) {
+          writeClaudeKeychain(merged, blob.accessToken).catch(() => {})
+        }
         if (ref) refreshFailures.delete(ref)
         return merged
       } catch (e) {

package/lib/adapter-manager.js

@@ -56,6 +56,7 @@ export function createAdapterManager({
     switchAtRemaining: () => live().switchAtRemaining,
     rotationStrategy: () => live().rotationStrategy,
     modelAccountRules: () => live().modelAccountRules || [],
+    subagentSpeed: () => live().codexSubagentSpeed,
     rateLimitWait: () => live().rateLimitWait,
     rateLimitMaxWaitMs: () => live().rateLimitMaxWaitMs,
     enableSoftFailureSentinel: () => live().enableSoftFailureSentinel,

package/lib/adapter.js

@@ -6,6 +6,7 @@ import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm'
 import { displayName } from './refs.js'
 import { applyModelSettings, bestAccountPlan } from './model-settings.js'
 import { getSpeedMode } from './speed-mode.js'
+import { resolveSpeed } from './account-features.js'
 import { getVendor } from './vendors/index.js'
 import { modelCatalog } from './messages.js'
 import { streamWithRotation } from './stream-rotate.js'
@@ -205,7 +206,11 @@ export class SubscriptionAdapter extends LlmAdapter {
       const defaultRef = typeof deps.defaultAccountRef === 'function' ? deps.defaultAccountRef(provider) : null
       const streamOptions = {
         ...hydratedOptions,
-        ...(provider === 'codex' && getSpeedMode(sessionId) === 'fast' ? { service_tier: 'priority' } : {}),
+        ...(provider === 'codex' && resolveSpeed({
+          childSpeed: options.speed,
+          sessionSpeed: getSpeedMode(sessionId),
+          subagentSpeed: (options.subagent || options.parentSessionId) && typeof deps.subagentSpeed === 'function' ? deps.subagentSpeed() : undefined,
+        }) === 'fast' ? { service_tier: 'priority' } : {}),
         ...(effectiveReasoning.effort ? { reasoningEffort: effectiveReasoning.effort } : {}),
         ...(effectiveReasoning.budgetTokens ? { thinkingBudget: effectiveReasoning.budgetTokens } : {}),
         // #830: kill switch. With no default account, use a sentinel that

package/lib/antigravity-reasoning.js

@@ -0,0 +1,80 @@
+const FAMILIES = [
+  { re: /claude/i, budget: 1024, effort: 'high', levels: ['low', 'medium', 'high'] },
+  { re: /gpt-oss/i, budget: 8192, effort: 'medium', levels: ['low', 'medium', 'high'] },
+  { re: /gemini-3\./i, budgets: { low: 1024, medium: 8192, high: 24576 }, effort: 'medium', levels: ['low', 'medium', 'high'] },
+]
+
+function familyFor(model) {
+  return FAMILIES.find((family) => family.re.test(String(model || ''))) || null
+}
+
+function codedError(message, code) {
+  /** @type {Error & { code?: string }} */
+  const err = new Error(message)
+  err.code = code
+  return err
+}
+
+/** #826: family-specific Antigravity reasoning budget with explicit errors. */
+export function antigravityReasoning(model, effort, maxTokens) {
+  const family = familyFor(model)
+  if (!family) return { supported: false, thinkingBudget: null, effort: null, maxTokens }
+  const requested = String(effort || family.effort).toLowerCase()
+  if (!family.levels.includes(requested)) {
+    throw codedError('unsupported reasoning effort for ' + model + ': ' + requested, 'UNSUPPORTED_REASONING_EFFORT')
+  }
+  const thinkingBudget = family.budgets ? family.budgets[requested] : family.budget
+  if (maxTokens != null && Number(maxTokens) <= thinkingBudget) {
+    throw codedError('maxTokens must exceed thinking budget', 'UNSUPPORTED_REASONING_EFFORT')
+  }
+  return { supported: true, thinkingBudget, effort: requested, maxTokens }
+}
+
+function deref(schema, root, seen) {
+  if (!schema || typeof schema !== 'object') return schema
+  if (typeof schema.$ref === 'string') {
+    const ref = schema.$ref
+    if (!ref.startsWith('#/')) {
+      throw codedError('remote $ref is not supported', 'UNSUPPORTED_TOOL_SCHEMA')
+    }
+    if (seen.has(ref)) {
+      throw codedError('cyclic $ref is not supported', 'UNSUPPORTED_TOOL_SCHEMA')
+    }
+    const path = ref.slice(2).split('/').map((part) => part.replace(/~1/g, '/').replace(/~0/g, '~'))
+    let target = root
+    for (const key of path) target = target && target[key]
+    if (!target) {
+      throw codedError('missing local $ref: ' + ref, 'UNSUPPORTED_TOOL_SCHEMA')
+    }
+    return deref(target, root, new Set([...seen, ref]))
+  }
+  return schema
+}
+
+function strip(schema, root, seen) {
+  if (Array.isArray(schema)) return schema.map((item) => strip(item, root, seen))
+  if (!schema || typeof schema !== 'object') return schema
+  const resolved = deref(schema, root, seen)
+  if (resolved !== schema) return strip(resolved, root, seen)
+  const out = {}
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === '$schema' || key === '$id' || key === '$defs' || key === 'definitions') continue
+    out[key] = strip(value, root, seen)
+  }
+  if (Array.isArray(out.anyOf)) {
+    const variants = out.anyOf.filter((v) => v && typeof v === 'object')
+    if (variants.length === 1) return variants[0]
+    if (variants.every((v) => v.type === variants[0].type)) out.type = variants[0].type
+  }
+  if (Array.isArray(out.oneOf)) {
+    const variants = out.oneOf.filter((v) => v && typeof v === 'object')
+    if (variants.length === 1) return variants[0]
+    if (variants.every((v) => v.type === variants[0].type)) out.type = variants[0].type
+  }
+  return out
+}
+
+/** #826: expand local refs, reject cycles/remote refs, strip metadata, widen unions. */
+export function normalizeAntigravityToolSchema(schema) {
+  return strip(schema, schema, new Set())
+}

package/lib/claude-keychain.js

@@ -0,0 +1,49 @@
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
+const SERVICE = 'Claude Code-credentials'
+
+export function validClaudeBlob(blob) {
+  if (!blob || typeof blob !== 'object') return false
+  if (typeof blob.accessToken !== 'string' || !blob.accessToken) return false
+  if (typeof blob.refreshToken !== 'string' || !blob.refreshToken) return false
+  return Number.isFinite(Number(blob.expiresAt))
+}
+
+export function mergeClaudeCredentials(current, cli) {
+  if (!validClaudeBlob(current)) return validClaudeBlob(cli) ? { ...cli } : null
+  if (!validClaudeBlob(cli)) return { ...current }
+  const currentExpiry = Number(current.expiresAt) || 0
+  const cliExpiry = Number(cli.expiresAt) || 0
+  if (cli.accessToken && cli.accessToken !== current.accessToken && cliExpiry > currentExpiry) {
+    return { ...current, ...cli }
+  }
+  return { ...current }
+}
+
+export function canWriteClaudeKeychain(currentBlob, expectedAccessToken) {
+  return Boolean(currentBlob && expectedAccessToken && currentBlob.accessToken === expectedAccessToken)
+}
+
+/** macOS-only read; returns null on any failure so accounts stay usable. */
+export async function readClaudeKeychain({ exec = execFileAsync, service = SERVICE } = {}) {
+  if (process.platform !== 'darwin') return null
+  try {
+    const { stdout } = await exec('/usr/bin/security', ['find-generic-password', '-s', service, '-w'])
+    const blob = JSON.parse(String(stdout || '').trim())
+    return validClaudeBlob(blob) ? blob : null
+  } catch { return null }
+}
+
+/** Write back only when the stored blob still owns the expected old access token. */
+export async function writeClaudeKeychain(blob, expectedAccessToken, { exec = execFileAsync, service = SERVICE, account = 'claude' } = {}) {
+  if (process.platform !== 'darwin') return false
+  if (!validClaudeBlob(blob) || !expectedAccessToken) return false
+  const current = await readClaudeKeychain({ exec, service })
+  if (!canWriteClaudeKeychain(current, expectedAccessToken)) return false
+  try {
+    await exec('/usr/bin/security', ['add-generic-password', '-U', '-s', service, '-a', account, '-w', JSON.stringify(blob)])
+    return true
+  } catch { return false }
+}

package/lib/images.js

@@ -28,7 +28,7 @@ const GROK_ASPECT = {
   auto: 'auto',
 }
 
-export function codexBody({ prompt, size, quality }) {
+export function codexBody({ prompt, size, quality, referenceImages = [] }) {
   const text = String(prompt || '').trim()
   if (!text) throw new Error('prompt must be a non-empty string')
   return {
@@ -36,10 +36,13 @@ export function codexBody({ prompt, size, quality }) {
     model: CODEX_MODEL,
     ...(size ? { size } : {}),
     ...(quality ? { quality } : {}),
+    ...(Array.isArray(referenceImages) && referenceImages.length
+      ? { images: referenceImages.map((ref) => ({ image_url: ref })) }
+      : {}),
   }
 }
 
-export function grokBody({ prompt, size, quality }) {
+export function grokBody({ prompt, size, quality, referenceImages = [] }) {
   const text = String(prompt || '').trim()
   if (!text) throw new Error('prompt must be a non-empty string')
   // Grok has only two quality tiers: high is composed from medium.
@@ -52,6 +55,7 @@ export function grokBody({ prompt, size, quality }) {
     response_format: 'b64_json',
     ...(size && GROK_ASPECT[size] ? { aspect_ratio: GROK_ASPECT[size] } : {}),
     ...(level ? { quality: level } : {}),
+    ...(Array.isArray(referenceImages) && referenceImages.length ? { image_urls: referenceImages } : {}),
   }
 }
 

package/lib/import-auth.js

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
+import { readClaudeKeychain } from './claude-keychain.js'
 import { readCopilotCredentials } from './vendors/copilot-cli.js'
 import { normalizeExpiresAt } from './blob.js'
 import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
@@ -250,11 +251,17 @@ async function discoverLocalCliSessionsInner() {
   }
 
   // 8. Claude CLI Direct Import
-  const claudeCreds = await readClaudeCredentials(activeHome)
+  const fileCreds = await readClaudeCredentials(activeHome)
+  const keychainCreds = fileCreds ? null : await readClaudeKeychain()
+  const claudeCreds = fileCreds || (keychainCreds ? {
+    ...keychainCreds,
+    sourcePath: 'macOS Keychain (Claude Code-credentials)',
+    email: keychainCreds.email || '',
+  } : null)
   if (claudeCreds) {
     const claudeEntry = {
       provider: 'claude',
-      source: 'file',
+      source: fileCreds ? 'file' : 'keychain',
       path: claudeCreds.sourcePath || homeFile('.claude', '.credentials.json'),
       email: claudeCreds.email || 'Claude Code CLI User',
       hasRefreshToken: !!claudeCreds.refreshToken,

package/lib/index.js

@@ -471,6 +471,7 @@ export function apply(ctx, rawConfig) {
         prompt: request.prompt,
         size: request.size,
         quality: request.quality,
+        referenceImages: request.referenceImages,
         session,
         fetchImpl: fetchFn,
         signal: request.signal,

package/lib/media-reference.js

@@ -0,0 +1,38 @@
+export const MAX_REFERENCE_IMAGES = 5
+
+/** #801: validate attachment refs before any generation call. */
+export function validateReferenceImages(refs) {
+  if (refs == null) return { ok: true, refs: [] }
+  if (!Array.isArray(refs)) {
+    return { ok: false, error: 'referenceImages must be an array' }
+  }
+  const clean = refs.map((ref) => String(ref || '').trim()).filter(Boolean)
+  if (!clean.length) return { ok: false, error: 'referenceImages must not be empty' }
+  if (clean.length > MAX_REFERENCE_IMAGES) return { ok: false, error: 'at most 5 reference images are allowed' }
+  if (new Set(clean).size !== clean.length) return { ok: false, error: 'duplicate reference images are not allowed' }
+  return { ok: true, refs: clean }
+}
+
+/** #801: provider-specific image-edit request bodies. */
+export function referenceImageRequest(provider, { prompt, references = [], model, size } = {}) {
+  const checked = validateReferenceImages(references)
+  if (!checked.ok) {
+    const err = new Error(checked.error)
+    err.code = 'INVALID_MEDIA_REFERENCE'
+    throw err
+  }
+  if (provider === 'grok') {
+    return {
+      model: model || 'grok-2-image',
+      prompt,
+      image_urls: checked.refs,
+      ...(size ? { size } : {}),
+    }
+  }
+  return {
+    model: model || 'gpt-image-1',
+    prompt,
+    images: checked.refs.map((ref) => ({ image_url: ref })),
+    ...(size ? { size } : {}),
+  }
+}

package/lib/native-tools.js

@@ -1,5 +1,6 @@
 import { mkdir, writeFile } from 'node:fs/promises'
 import path from 'node:path'
+import { validateReferenceImages } from './media-reference.js'
 
 const TOOL_OUTPUT = {
   schema: {
@@ -86,12 +87,15 @@ export function registerSubscriptionTools(ctx, deps, options = {}) {
         provider: { type: 'string', enum: ['gpt', 'codex', 'grok'], description: 'Preferred provider' },
         size: { type: 'string', description: 'Image size, e.g. 1024x1024' },
         quality: { type: 'string', description: 'low, medium or high' },
+        referenceImages: { type: 'array', items: { type: 'string' }, maxItems: 5, description: '1–5 attachment refs for image editing' },
       },
       required: ['prompt'],
     },
     async execute(args, exec) {
       const images = deps.images && deps.images()
       if (!images || typeof images.generate !== 'function') throw new Error('subscription image service is unavailable')
+      const references = validateReferenceImages(args && args.referenceImages)
+      if (!references.ok) throw new Error(references.error)
       const preferred = String((args && args.provider) || 'gpt').toLowerCase()
       const order = preferred === 'grok' ? ['grok', 'codex'] : ['codex', 'grok']
       let lastError = null
@@ -102,6 +106,7 @@ export function registerSubscriptionTools(ctx, deps, options = {}) {
             prompt: args && args.prompt,
             size: args && args.size,
             quality: args && args.quality,
+            referenceImages: references.refs,
             signal: exec && exec.signal,
           })
           const files = await saveImages(rows, exec)

package/lib/vendors/antigravity.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { googleContents } from '../messages.js'
+import { antigravityReasoning, normalizeAntigravityToolSchema } from '../antigravity-reasoning.js'
 import { formTokenRequest, googleStream, throwHttpError, tokenBlobFromOAuth , readErrorBody } from '../wire.js'
 import { fetchWithTimeout } from '../http.js'
 import { emailFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
@@ -221,6 +222,17 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, signal, s
       if (tiered) {
         if (!request.generationConfig) request.generationConfig = {}
         request.generationConfig.thinkingConfig = /** @type {any} */ ({ thinkingLevel: tiered.thinkingLevel })
+      } else {
+        const reasoning = antigravityReasoning(options.model, options.reasoningEffort, options.maxTokens)
+        if (reasoning.supported) {
+          if (!request.generationConfig) request.generationConfig = {}
+          request.generationConfig.thinkingConfig = /** @type {any} */ ({ thinkingBudget: reasoning.thinkingBudget })
+        }
+      }
+      for (const declaration of (request.tools && request.tools[0] && request.tools[0].functionDeclarations) || []) {
+        if (declaration && declaration.parameters) {
+          declaration.parameters = normalizeAntigravityToolSchema(declaration.parameters)
+        }
       }
       const { envelope, sessionId } = streamEnvelope({
         projectId: ready.projectId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.46",
+  "version": "0.7.48",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",