@xiaoso/dsh-tool-plus 0.1.6 → 0.1.7-beta.0

package/lib/{utils-CQHPEQ3W.mjs → utils-DeWqNWV8.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { n as wrapFetchForExtraCa } from "./src-BcD0_rQR.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@17.3.5/node_modules/@oh-my-pi/pi-catalog/src/utils.ts
+import { n as wrapFetchForExtraCa } from "./src-BwW51vA5.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/utils.ts
 /**
 * Fetch implementation for catalog discovery probes: the caller's override
 * when given, otherwise global fetch wrapped for `NODE_EXTRA_CA_CERTS`.

package/lib/{vision-guard-mBmtAHx0.mjs → vision-guard-_XwsL1DF.mjs}

@@ -1,8 +1,8 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { M as isDashscopeCompatibleModeUrl, S as isQwenModelId, x as isOpenAIModelId } from "./models-DRA2c_8U.mjs";
-import "./identity-HNO1Oe9B.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/types.ts
+import "./src-BwW51vA5.mjs";
+import "./effort-BdtQMN-_.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/types.ts
 /**
 * Ceiling on the output-token count omp requests from any OpenAI-family endpoint
 * (openai-responses, azure/xai responses, and openai-completions). Mirrors
@@ -22,7 +22,7 @@ function excludesInferredOpenAIServiceTier(provider) {
 	return provider === "fireworks" || provider === "github-copilot";
 }
 function isOpenAIServiceTierModel(model) {
-	return !excludesInferredOpenAIServiceTier(model.provider) && isOpenAIServiceTierApi(model.api) && isOpenAIModelId(model.id);
+	return !excludesInferredOpenAIServiceTier(model.provider) && isOpenAIServiceTierApi(model.api) && model.identity.class === "openai";
 }
 /**
 * True when the tier should be sent on the wire as the provider's service-tier
@@ -45,7 +45,7 @@ function shouldSendServiceTier(serviceTier, target) {
 	return false;
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/vision-guard.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/vision-guard.ts
 const NON_VISION_IMAGE_PLACEHOLDER = "[image omitted: model does not support vision]";
 function partitionVisionContent(content, supportsImages) {
 	const textBlocks = content.filter((block) => block.type === "text");
@@ -63,30 +63,15 @@ function joinTextWithImagePlaceholder(text, omittedImages) {
 	return parts.join("\n");
 }
 /**
-* Detect known text-only Qwen models served via Alibaba DashScope's consumer
-* `compatible-mode` endpoint that the upstream chat-completions API rejects
-* multimodal content arrays for. The compatible-mode endpoint also serves
-* multimodal Qwen SKUs without `vl` in the id (e.g. `qwen3.7-plus`), so this
-* guard only covers families verified to be text-only for issue #1859:
-* `qwen*-coder*` and `qwen*-max` up to and including `qwen3.7-max`.
-*
-* Qwen-Max became multimodal at `qwen3.8-max` (image input, issue #8019), so
-* `-max` SKUs at version 3.8 or newer are excluded — otherwise the override
-* would strip images from a genuinely vision-capable flagship (issue #8305).
-*
-* Used as a defensive override in `convertMessages` so a misconfigured custom
-* provider (issue #1859) can't drive the request into an unrecoverable 400.
+* Evaluates whether an OpenAI-compatible Chat Completions model genuinely
+* supports multimodal image inputs on the wire. Defensive guards override
+* misconfigured provider descriptors or user model entries (e.g. text-only
+* DashScope Qwen SKUs, DeepSeek models) whose endpoints reject `image_url`.
 */
-function isDashscopeCompatibleModeTextOnlyQwen(model) {
-	if (!isDashscopeCompatibleModeUrl(model.baseUrl)) return false;
-	if (!isQwenModelId(model.id)) return false;
-	const id = model.id.toLowerCase();
-	if (/\bqwen(?:[\d.]+)?-coder\b/.test(id)) return true;
-	const maxMatch = id.match(/\bqwen(?:(\d+)(?:\.(\d+))?)?-max\b/);
-	if (!maxMatch) return false;
-	const major = maxMatch[1] ? Number.parseInt(maxMatch[1], 10) : 0;
-	const minor = maxMatch[2] ? Number.parseInt(maxMatch[2], 10) : 0;
-	return major < 3 || major === 3 && minor < 8;
+function isOpenAICompletionsVisionSupported(model) {
+	if (!model.input.includes("image")) return false;
+	if (model.compat.stripImageInput) return false;
+	return true;
 }
 //#endregion
-export { OPENAI_MAX_OUTPUT_TOKENS as a, partitionVisionContent as i, isDashscopeCompatibleModeTextOnlyQwen as n, shouldSendServiceTier as o, joinTextWithImagePlaceholder as r, NON_VISION_IMAGE_PLACEHOLDER as t };
+export { OPENAI_MAX_OUTPUT_TOKENS as a, partitionVisionContent as i, isOpenAICompletionsVisionSupported as n, shouldSendServiceTier as o, joinTextWithImagePlaceholder as r, NON_VISION_IMAGE_PLACEHOLDER as t };

package/lib/xai-oauth-CXhnz0gO.mjs

@@ -0,0 +1,210 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { r as __exportAll } from "./fs-promises-shim-Bx0fpxuk.mjs";
+import { f as OAuthError } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/xai-oauth.ts
+/**
+* xAI OAuth endpoint discovery, identity, and billing helpers.
+*/
+var xai_oauth_exports = /* @__PURE__ */ __exportAll({
+	buildXAICliBillingUrl: () => buildXAICliBillingUrl,
+	extractXAIAccessTokenSubject: () => extractXAIAccessTokenSubject,
+	fetchXAIOAuthIdentity: () => fetchXAIOAuthIdentity,
+	getXAICliBillingHeaders: () => getXAICliBillingHeaders,
+	getXAITokenEndpoint: () => getXAITokenEndpoint,
+	parseXAIAccessTokenPayload: () => parseXAIAccessTokenPayload,
+	validateXAIBillingEndpoint: () => validateXAIBillingEndpoint,
+	validateXAIEndpoint: () => validateXAIEndpoint
+});
+const XAI_OAUTH_ISSUER = "https://auth.x.ai";
+const XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
+const XAI_OAUTH_USERINFO_URL = `${XAI_OAUTH_ISSUER}/oauth2/userinfo`;
+const XAI_CLI_BILLING_BASE_URL = "https://cli-chat-proxy.grok.com";
+const XAI_CLI_BILLING_PATH = "/v1/billing";
+const XAI_CLI_BILLING_FORMAT = "credits";
+const DISCOVERY_TIMEOUT_MS = 15e3;
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* Validate an xAI OIDC endpoint against its scheme and host.
+*
+* The discovery response is long-lived and its token endpoint receives every
+* future refresh token. Rejecting non-HTTPS or non-`x.ai` / `*.x.ai` hosts
+* pins that endpoint to the xAI auth origin.
+*
+* @throws Error with message `Invalid xAI <field>: <url>` when the URL fails
+*         either scheme or host validation.
+*/
+function isXaiAuthHostname(host) {
+	return host === "x.ai" || host.endsWith(".x.ai");
+}
+/** SuperGrok CLI billing proxy host (`cli-chat-proxy.grok.com`), not the OIDC issuer. */
+function isXaiBillingHostname(host) {
+	return host === "grok.com" || host.endsWith(".grok.com");
+}
+function validateXAIEndpoint(url, field) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+			kind: "validation",
+			provider: "xai"
+		});
+	}
+	if (parsed.protocol !== "https:") throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	const host = parsed.hostname.toLowerCase();
+	if (!host || !isXaiAuthHostname(host)) throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	return url;
+}
+/**
+* Pin SuperGrok billing URLs to HTTPS `grok.com` / `*.grok.com`.
+* The CLI billing proxy is intentionally not on `*.x.ai`.
+*/
+function validateXAIBillingEndpoint(url, field = "billing_url") {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+			kind: "validation",
+			provider: "xai"
+		});
+	}
+	if (parsed.protocol !== "https:") throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	const host = parsed.hostname.toLowerCase();
+	if (!host || !isXaiBillingHostname(host)) throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	return url;
+}
+/** Fetch xAI's OIDC discovery document and validate the token endpoint. */
+async function xaiOAuthDiscovery(timeoutMs = DISCOVERY_TIMEOUT_MS, fetchOverride, signal) {
+	const fetchImpl = fetchOverride ?? fetch;
+	let response;
+	try {
+		response = await fetchImpl(XAI_OAUTH_DISCOVERY_URL, {
+			method: "GET",
+			headers: { Accept: "application/json" },
+			signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs)
+		});
+	} catch (error) {
+		throw new OAuthError(`xAI OIDC discovery failed: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "discovery",
+			provider: "xai",
+			cause: error
+		});
+	}
+	if (response.status !== 200) throw new OAuthError(`xAI OIDC discovery returned status ${response.status}.`, {
+		kind: "discovery",
+		provider: "xai",
+		status: response.status
+	});
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		throw new OAuthError(`xAI OIDC discovery returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "validation",
+			provider: "xai",
+			cause: error
+		});
+	}
+	if (!isRecord(payload)) throw new OAuthError("xAI OIDC discovery response was not a JSON object.", {
+		kind: "validation",
+		provider: "xai"
+	});
+	const tokenEndpoint = typeof payload.token_endpoint === "string" ? payload.token_endpoint.trim() : "";
+	if (!tokenEndpoint) throw new OAuthError("xAI OIDC discovery response was missing token_endpoint.", {
+		kind: "validation",
+		provider: "xai"
+	});
+	validateXAIEndpoint(tokenEndpoint, "token_endpoint");
+	return { token_endpoint: tokenEndpoint };
+}
+/** Discover and pin the xAI token endpoint used by login and refresh. */
+async function getXAITokenEndpoint(signal) {
+	return validateXAIEndpoint((await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, void 0, signal)).token_endpoint, "token_endpoint");
+}
+/** Decode an xAI access-token JWT payload without verifying its signature. */
+function parseXAIAccessTokenPayload(jwt) {
+	try {
+		if (typeof jwt !== "string" || !jwt.includes(".")) return null;
+		const parts = jwt.split(".");
+		if (parts.length < 2) return null;
+		const payloadPart = parts[1];
+		if (!payloadPart) return null;
+		const decoded = Buffer.from(payloadPart, "base64url").toString("utf8");
+		const payload = JSON.parse(decoded);
+		return isRecord(payload) && !Array.isArray(payload) ? payload : null;
+	} catch {
+		return null;
+	}
+}
+/** Extract the stable xAI subject UUID from an access token. */
+function extractXAIAccessTokenSubject(jwt) {
+	const sub = parseXAIAccessTokenPayload(jwt)?.sub;
+	return typeof sub === "string" && sub.trim() ? sub.trim() : void 0;
+}
+/** Fetch optional OIDC userinfo for a valid xAI access token. */
+async function fetchXAIOAuthIdentity(accessToken, fetchOverride, signal) {
+	const token = accessToken.trim();
+	if (!token) return null;
+	const fetchImpl = fetchOverride ?? fetch;
+	try {
+		const response = await fetchImpl(XAI_OAUTH_USERINFO_URL, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/json"
+			},
+			redirect: "error",
+			signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(DISCOVERY_TIMEOUT_MS)]) : AbortSignal.timeout(DISCOVERY_TIMEOUT_MS)
+		});
+		if (!response.ok) return null;
+		const payload = await response.json();
+		if (!isRecord(payload) || Array.isArray(payload)) return null;
+		const sub = typeof payload.sub === "string" && payload.sub.trim() ? payload.sub.trim() : void 0;
+		const email = typeof payload.email === "string" && payload.email.trim() ? payload.email.trim() : void 0;
+		const name = typeof payload.name === "string" && payload.name.trim() ? payload.name.trim() : void 0;
+		if (!sub && !email && !name) return null;
+		return {
+			...sub ? { accountId: sub } : {},
+			...email ? { email: email.toLowerCase() } : {},
+			...name ? { name } : {}
+		};
+	} catch {
+		return null;
+	}
+}
+/** Build the SuperGrok CLI billing URL. Pass `""` to omit `format` (unified monthly payload). */
+function buildXAICliBillingUrl(format = XAI_CLI_BILLING_FORMAT) {
+	const url = new URL(XAI_CLI_BILLING_PATH, XAI_CLI_BILLING_BASE_URL);
+	if (format) url.searchParams.set("format", format);
+	return validateXAIBillingEndpoint(url.toString());
+}
+/**
+* Headers for SuperGrok CLI billing (`cli-chat-proxy.grok.com`).
+* Official Grok CLI also sends `X-XAI-Token-Auth: xai-grok-cli` on this host;
+* include it so billing stays on the same product gate as chat inference.
+*/
+function getXAICliBillingHeaders(options) {
+	return {
+		Authorization: `Bearer ${options.accessToken}`,
+		Accept: "application/json",
+		"X-XAI-Token-Auth": "xai-grok-cli"
+	};
+}
+//#endregion
+export { xai_oauth_exports as a, getXAICliBillingHeaders as i, extractXAIAccessTokenSubject as n, fetchXAIOAuthIdentity as r, buildXAICliBillingUrl as t };

package/lib/{xiaomi-7mE345KX.mjs → xiaomi-psoUItal.mjs}

@@ -1,20 +1,19 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { _ as OnPromptRequiredError, c as OAuthError, h as LoginCancelledError, m as ApiKeyRequiredError } from "./error-C-f_Wnw4.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/xiaomi.ts
+import { f as OAuthError, g as OnPromptRequiredError, m as LoginCancelledError, p as ApiKeyRequiredError } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/xiaomi.ts
 /**
 * Xiaomi MiMo login flow.
 *
 * Xiaomi MiMo provides OpenAI-compatible models via
 * https://api.xiaomimimo.com/v1.
 *
-* Standard Xiaomi login opens the pay-as-you-go API key console. Token Plan
-* login opens plan management so users copy the regional `tp-...` key.
+* Standard Xiaomi login accepts both pay-as-you-go keys and regional `tp-...`
+* keys, probing the regional Token Plan clusters in fallback order.
 */
 const PROVIDER_ID = "xiaomi";
 const PROVIDER_NAME = "Xiaomi MiMo";
 const STANDARD_AUTH_URL = "https://platform.xiaomimimo.com/#/console/api-keys";
-const TOKEN_PLAN_AUTH_URL = "https://platform.xiaomimimo.com/console/plan-manage";
 const STANDARD_API_BASE_URL = "https://api.xiaomimimo.com/v1";
 const TOKEN_PLAN_KEY_PREFIX = "tp-";
 const STANDARD_VALIDATION_MODEL = "mimo-v2.5";
@@ -33,18 +32,13 @@ const TOKEN_PLAN_VALIDATION_ENDPOINTS = {
 		model: TOKEN_PLAN_VALIDATION_MODEL
 	}
 };
-const TOKEN_PLAN_REGION_NAMES = {
-	sgp: "Singapore",
-	ams: "Europe",
-	cn: "China"
-};
 function isTokenPlanKey(apiKey) {
 	return apiKey.startsWith(TOKEN_PLAN_KEY_PREFIX);
 }
 const VALIDATION_TIMEOUT_MS = 15e3;
-async function validateXiaomiApiKey(apiKey, tokenPlanRegion, signal, fetchOverride) {
+async function validateXiaomiApiKey(apiKey, signal, fetchOverride) {
 	const fetchImpl = fetchOverride ?? fetch;
-	const endpoints = tokenPlanRegion ? [TOKEN_PLAN_VALIDATION_ENDPOINTS[tokenPlanRegion]] : isTokenPlanKey(apiKey) ? [
+	const endpoints = isTokenPlanKey(apiKey) ? [
 		TOKEN_PLAN_VALIDATION_ENDPOINTS.sgp,
 		TOKEN_PLAN_VALIDATION_ENDPOINTS.ams,
 		TOKEN_PLAN_VALIDATION_ENDPOINTS.cn
@@ -127,31 +121,8 @@ async function loginXiaomi(options) {
 	const trimmed = apiKey.trim();
 	if (!trimmed) throw new ApiKeyRequiredError();
 	options.onProgress?.(`Validating ${PROVIDER_ID} API key...`);
-	await validateXiaomiApiKey(trimmed, void 0, options.signal, fetchImpl);
-	return trimmed;
-}
-/**
-* Login to a regional Xiaomi Token Plan endpoint.
-*
-* Prompts for a token-plan API key and validates it against the selected region.
-*/
-async function loginXiaomiTokenPlan(options, region) {
-	const fetchImpl = options.fetch ?? fetch;
-	if (!options.onPrompt) throw new OnPromptRequiredError(`Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]})`);
-	options.onAuth?.({
-		url: TOKEN_PLAN_AUTH_URL,
-		instructions: `Copy your token-plan API key for the ${TOKEN_PLAN_REGION_NAMES[region]} region`
-	});
-	const apiKey = await options.onPrompt({
-		message: `Paste your Xiaomi Token Plan ${TOKEN_PLAN_REGION_NAMES[region]} API key (tp-...)`,
-		placeholder: "tp-..."
-	});
-	if (options.signal?.aborted) throw new LoginCancelledError();
-	const trimmed = apiKey.trim();
-	if (!trimmed) throw new ApiKeyRequiredError();
-	options.onProgress?.(`Validating Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]}) API key...`);
-	await validateXiaomiApiKey(trimmed, region, options.signal, fetchImpl);
+	await validateXiaomiApiKey(trimmed, options.signal, fetchImpl);
 	return trimmed;
 }
 //#endregion
-export { loginXiaomi, loginXiaomiTokenPlan };
+export { loginXiaomi };

package/lib/{zai-CeNpMV3W.mjs → zai-ApJ8HBgT.mjs}

@@ -1,8 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-C-f_Wnw4.mjs";
-import { t as OAuthCallbackFlow } from "./callback-server-CFJK-jvK.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/zai.ts
+import { V as ProviderHttpError, f as OAuthError } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/zai.ts
 /**
 * Z.ai / GLM OAuth flow (GLM Coding Plan · Sign in)
 *
@@ -17,22 +16,11 @@ const env = (key) => {
 	const value = process.env[key];
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 };
-const CLIENT_ID = env("ZAI_OAUTH_CLIENT_ID") ?? "client_P8X5CMWmlaRO9gyO-KSqtg";
-const AUTHORIZE_URL = env("ZAI_OAUTH_AUTHORIZE_URL") ?? "https://chat.z.ai/api/oauth/authorize";
-const TOKEN_URL = env("ZAI_OAUTH_TOKEN_URL") ?? "https://zcode.z.ai/api/v1/oauth/token";
 const BIZ_BASE = env("ZAI_BIZ_BASE") ?? "https://api.z.ai";
 /** Business-login endpoint: exchanges the OAuth access token for a biz token. */
 const BUSINESS_LOGIN_URL = env("ZAI_BUSINESS_LOGIN_URL") ?? "https://api.z.ai/api/auth/z/login";
 /** OMP's own key name so sign-in never mutates ZCode's `zcode-api-key`. */
 const KEY_NAME = "oh-my-pi";
-const CALLBACK_PORT = 54548;
-const CALLBACK_PATH = "/callback";
-/** Durable minted key never expires; matches the perplexity NEVER_EXPIRES sentinel. */
-const NEVER_EXPIRES = 864e13;
-function formatErrorDetails(error) {
-	if (error instanceof Error) return error.message;
-	return String(error);
-}
 /**
 * Z.ai's `{ code, msg, data, success }` envelope. The OAuth token endpoint
 * signals success with `code: 0`; the biz endpoints (`api.z.ai`) use
@@ -143,61 +131,10 @@ async function mintZaiApiKey(oauthAccessToken, fetchImpl) {
 	});
 	return `${apiKey}.${secretKey}`;
 }
-var ZaiOAuthFlow = class extends OAuthCallbackFlow {
-	#fetch;
-	constructor(ctrl) {
-		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
-		this.#fetch = ctrl.fetch ?? fetch;
-	}
-	async generateAuthUrl(state, redirectUri) {
-		const authParams = new URLSearchParams({
-			redirect_uri: redirectUri,
-			response_type: "code",
-			client_id: CLIENT_ID,
-			state
-		});
-		return {
-			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
-			instructions: "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
-		};
-	}
-	async exchangeToken(code, state, redirectUri) {
-		if (this.ctrl.signal?.aborted) throw new LoginCancelledError(`OAuth callback cancelled: ${this.ctrl.signal.reason}`);
-		let body;
-		try {
-			body = await postJson(TOKEN_URL, {
-				provider: "zai",
-				code,
-				redirect_uri: redirectUri,
-				state
-			}, {}, this.#fetch);
-		} catch (error) {
-			throw new OAuthError(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; details=${formatErrorDetails(error)}`, {
-				kind: "token-exchange",
-				provider: "zai",
-				cause: error
-			});
-		}
-		const data = unwrapEnvelope(body, "token exchange");
-		const oauthAccessToken = trimmedString(data?.zai?.access_token);
-		if (!oauthAccessToken) throw new OAuthError("Z.ai token response missing access token", {
-			kind: "validation",
-			provider: "zai"
-		});
-		return {
-			access: await mintZaiApiKey(oauthAccessToken, this.#fetch),
-			refresh: "",
-			expires: NEVER_EXPIRES,
-			email: typeof data?.user?.email === "string" ? data.user.email : void 0,
-			accountId: typeof data?.user?.id === "string" || typeof data?.user?.id === "number" ? String(data.user.id) : void 0
-		};
-	}
-};
-/**
-* Login with Z.ai OAuth (GLM Coding Plan).
-*/
-async function loginZaiOAuth(ctrl) {
-	return new ZaiOAuthFlow(ctrl).login();
-}
+/** Replaces the short-lived OAuth token with the durable key minted by the Z.ai business APIs. */
+const zaiMintKeyHook = async (credentials, context) => ({
+	...credentials,
+	access: await mintZaiApiKey(credentials.access, context.fetch)
+});
 //#endregion
-export { loginZaiOAuth };
+export { zaiMintKeyHook };

package/lib/{zip-BK7UHCwX.mjs → zip-Kd602XNe.mjs}

@@ -1,6 +1,6 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { j as formatBytes } from "./src-BcD0_rQR.mjs";
+import { k as formatBytes } from "./src-BwW51vA5.mjs";
 import { n as ToolError } from "./tool-errors-DoyxivAR.mjs";
 import * as path from "node:path";
 import * as zlib from "node:zlib";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xiaoso/dsh-tool-plus",
   "description": "Oh My Pi bash runtime ported as a deepseek-harness tool plugin: persistent shell session, output minimizer, managed background jobs, command interception",
-  "version": "0.1.6",
+  "version": "0.1.7-beta.0",
   "license": "MIT",
   "keywords": [
     "deepseek-harness",
@@ -98,20 +98,20 @@
     "sharp": ">=0.33"
   },
   "dependencies": {
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
     "@deepseek-ai/schemastery": "3.18.2",
-    "@oh-my-pi/omptype": "17.3.5",
-    "@oh-my-pi/pi-agent-core": "17.3.5",
-    "@oh-my-pi/pi-ai": "17.3.5",
-    "@oh-my-pi/pi-catalog": "17.3.5",
-    "@oh-my-pi/pi-natives": "17.3.5",
-    "@oh-my-pi/pi-tui": "17.3.5",
-    "@oh-my-pi/pi-utils": "17.3.5",
+    "@oh-my-pi/omptype": "18.1.17",
+    "@oh-my-pi/pi-agent-core": "18.1.17",
+    "@oh-my-pi/pi-ai": "18.1.17",
+    "@oh-my-pi/pi-catalog": "18.1.17",
+    "@oh-my-pi/pi-natives": "18.1.17",
+    "@oh-my-pi/pi-tui": "18.1.17",
+    "@oh-my-pi/pi-utils": "18.1.17",
     "json5": "^2.2.3",
     "puppeteer-core": "^25.3.0",
     "trash": "^10.1.1",
-    "yaml": "^2.9.0",
-    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1"
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",

package/presets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaoso/dsh-tool-plus-presets",
-  "version": "0.1.6",
+  "version": "0.1.7-beta.0",
   "description": "Agent-preset installer for dsh-tool-plus: installs the standard / PTC enhanced preset templates into a DeepSeek Harness home.",
   "license": "MIT",
   "keywords": [

package/presets/tool-plus-ptc/agent.cordis.yml

@@ -139,7 +139,7 @@
 
               Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
 
-              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
 
 # ── compaction ──────────────────────────────────────────────────────────────
 

package/presets/tool-plus-standard/agent.cordis.yml

@@ -135,7 +135,7 @@
 
               Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
 
-              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
 
 # ── compaction ──────────────────────────────────────────────────────────────