dsh-claude-subscription 0.2.0 → 0.3.0

package/AGENTS.md

@@ -6,7 +6,7 @@ Use this guide when a user asks an Agent to install, update, verify, or remove
 ## Safety
 
 - Confirm the target DSH profile; use `web` only when it is the user's target.
-- Use the pinned `v0.2.0` release assets for a first install, never a moving branch.
+- Use the pinned `v0.3.0` release assets for a first install, never a moving branch.
 - Never print OAuth credentials, account IDs, authorization callbacks, or the
   credential store.
 - Do not start, stop, or restart DSH without explicit permission.
@@ -16,6 +16,10 @@ Use this guide when a user asks an Agent to install, update, verify, or remove
 
 ## Detect the installation
 
+This plugin release supports only DeepSeek Harness `0.1.2-alpha.5`. Run
+`dsh --version` first and stop on any other version; do not upgrade DSH or
+ignore peer dependency warnings without explicit permission.
+
 Check whether the plugin is already installed in the target DSH profile. When
 it is already listed, use update or uninstall instead of installing again.
 
@@ -25,7 +29,7 @@ When `dsh`, Node.js, and pnpm are already available, install the pinned npm
 package directly:
 
 ```sh
-dsh plugin --profile web add dsh-claude-subscription@0.2.0
+dsh plugin --profile web add dsh-claude-subscription@0.3.0
 ```
 
 Update with `dsh plugin --profile web update dsh-claude-subscription`.
@@ -42,7 +46,7 @@ profile (`desktop`, `web`):
 
 1. `pnpm pack` the plugin into a tarball (or download the pinned release tarball).
 2. Copy the tarball into the profile directory.
-3. Add `"dsh-claude-subscription": "file:./dsh-claude-subscription-0.2.0.tgz"` to
+3. Add `"dsh-claude-subscription": "file:./dsh-claude-subscription-0.3.0.tgz"` to
    the profile's `package.json` `dependencies` and add `dsh-claude-subscription`
    to its `dsh.profile.bundles` array.
 4. Run `pnpm install` in the profile directory.
@@ -71,8 +75,9 @@ Success requires:
 
 Do not treat `dsh plugin --profile web peers check` as the completion test.
 If the user authorizes a live check, restart DSH manually, open
-**Settings -> Claude**, and verify the page loads and reports the saved
-login. Confirm that the `anthropic` provider and its Claude models are
+**Settings -> Models**, verify the Anthropic card reports the saved login,
+and check that **Settings -> Claude subscription** loads. Confirm that the
+`anthropic` provider and its Claude models are
 selectable in the model picker. Only when the user explicitly requests a
 quota-consuming live check, ask the Agent to send one short message with a
 Claude model and confirm the reply.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 dsh-claude-subscription contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+MIT License
+
+Copyright (c) 2026 dsh-claude-subscription contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

package/README.en.md

@@ -1,6 +1,5 @@
 # DSH Claude Subscription
 
-[![CI](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml/badge.svg)](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/dsh-claude-subscription?logo=npm&label=npm)](https://www.npmjs.com/package/dsh-claude-subscription)
 [![License: MIT](https://img.shields.io/badge/license-MIT-111111.svg)](LICENSE)
 
@@ -16,7 +15,7 @@ DSH's host credential service: no token extraction, no resale, no extra billing.
 ## What it does
 
 - Uses your Claude Pro / Max subscription directly inside DSH, with no Anthropic API key required;
-- Signs in to claude.ai from Settings through the official OAuth flow and keeps credentials on the host;
+- Signs in to claude.ai from the Anthropic card under **Settings -> Models** or from **Settings -> Claude subscription**, using the official OAuth flow and keeping credentials on the host;
 - Refreshes the access token automatically with the refresh token;
 - Shows sign-in status and token expiry;
 - Shows the **subscription quota**: remaining percentage and reset time for the 5-hour, 7-day, Opus, and Sonnet windows;
@@ -25,10 +24,13 @@ DSH's host credential service: no token extraction, no resale, no extra billing.
 
 ## Prepare DSH
 
-This plugin supports DeepSeek Harness `0.1.0-rc.6` and `0.1.0-rc.7`, and
-requires a Claude Pro, Max, Team, or Enterprise subscription.
+This plugin currently supports only DeepSeek Harness `0.1.2-alpha.5` and
+requires a Claude Pro, Max, Team, or Enterprise subscription. DSH remains a
+developer preview; an npm `latest` or `next` release other than
+`0.1.2-alpha.5` is outside this plugin version's supported range.
 
-If DSH already opens normally, continue with the plugin installation below.
+Run `dsh --version` before installation. Do not merely ignore peer dependency
+warnings.
 
 ## Install
 
@@ -59,7 +61,8 @@ For DSH Desktop, put the `pnpm pack` tarball into
 `dsh.profile.bundles` entry in that profile's `package.json`, run
 `pnpm install` there, then restart DSH. After install:
 
-1. Open **Settings -> Claude subscription** in DSH.
+1. Open **Settings -> Models** and find Anthropic. Full quota details remain
+   under **Settings -> Claude subscription**.
 2. If not signed in, click **Browser sign-in** and authorize on claude.ai.
 3. Pick a Claude model under the `anthropic` provider in the model picker.
 4. Turn on **Composer quota** on the same page when you want it.

package/README.md

@@ -1,6 +1,5 @@
 # DSH Claude Subscription
 
-[![CI](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml/badge.svg)](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/dsh-claude-subscription?logo=npm&label=npm)](https://www.npmjs.com/package/dsh-claude-subscription)
 [![License: MIT](https://img.shields.io/badge/license-MIT-111111.svg)](LICENSE)
 
@@ -16,7 +15,7 @@
 ## 能做什麼
 
 - 在 DSH 中直接使用 Claude Pro / Max 訂閱，不需要 Anthropic API Key；
-- 在設定頁以官方 OAuth 流程登入 claude.ai，憑證保留在 DSH 本機；
+- 在**設定 → 模型**的 Anthropic 卡片或**設定 → Claude 訂閱**中，以官方 OAuth 流程登入 claude.ai，憑證保留在 DSH 本機；
 - access token 過期時自動以 refresh token 續期，不需手動處理；
 - 顯示登入狀態；
 - 顯示**訂閱額度**：5 小時、7 天、Opus 與 Sonnet 的剩餘百分比與重置時間；
@@ -25,10 +24,11 @@
 
 ## 準備 DSH
 
-本插件適配 DeepSeek Harness `0.1.0-rc.6` 與 `0.1.0-rc.7`，需要一個
-Claude Pro、Max、Team 或 Enterprise 訂閱帳號。
+本插件目前僅適配 DeepSeek Harness `0.1.2-alpha.5`，需要一個 Claude Pro、
+Max、Team 或 Enterprise 訂閱帳號。DSH 仍在 developer preview；npm 的
+`latest` / `next` 通道若不是 `0.1.2-alpha.5`，不在本版本的支援範圍。
 
-已經能正常打開 DSH 的使用者可以直接繼續安裝插件。
+安裝前請先以 `dsh --version` 確認版本；不要只忽略 peer dependency 警告。
 
 ## 安裝
 
@@ -58,7 +58,8 @@ DSH Desktop（桌面版）時，把 `pnpm pack` 產出的 tarball 放進
 `file:` 依賴與 `dsh.profile.bundles` 條目，然後在該目錄執行
 `pnpm install`，最後重啟 DSH。安裝後：
 
-1. 開啟 DSH 的**設定 → Claude 訂閱**。
+1. 開啟 DSH 的**設定 → 模型**，找到 Anthropic；完整額度資訊仍位於
+   **設定 → Claude 訂閱**。
 2. 若尚未登入，按**瀏覽器登入**，在 claude.ai 完成授權。
 3. 在模型選單選擇 `anthropic` provider 下的 Claude 模型。
 4. 需要時，在同一頁打開**輸入框額度**開關。

package/cordis.patch.yml

@@ -1,6 +1,6 @@
-# One plugin owns the Claude subscription provider route, host-only account
-# RPC, and settings surface. It leaves DSH's model and persistent web
-# configuration untouched.
-- insert:
-    - id: claude-subscription
+# One plugin owns the Claude subscription provider route, host-only account
+# RPC, and settings surface. It leaves DSH's model and persistent web
+# configuration untouched.
+- insert:
+    - id: claude-subscription
       name: 'dsh-claude-subscription'

package/lib/client.js

@@ -665,6 +665,37 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		function ClaudeProviderAuth({ provider, rpc, t }) {
+			const [account, setAccount] = (0, react.useState)();
+			const [error, setError] = (0, react.useState)();
+			const isClaude = provider?.provider === PROVIDER;
+			(0, react.useEffect)(() => {
+				if (!isClaude) return;
+				let live = true;
+				rpc.call(CHANNEL, "status", {}).then(unwrap).then((next) => {
+					if (live) setAccount(next);
+				}).catch(() => {
+					if (live) setError(t("loadFailed"));
+				});
+				return () => {
+					live = false;
+				};
+			}, [isClaude, rpc, t]);
+			if (!isClaude) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, {
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountCard, {
+					rpc,
+					t,
+					account,
+					setAccount,
+					onSignedOut: () => void 0
+				}), error === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "claudeSubscriptionError",
+					role: "alert",
+					children: error
+				})]
+			});
+		}
 		function ClaudeSection({ preference, rpc, t }) {
 			const [account, setAccount] = (0, react.useState)();
 			const [error, setError] = (0, react.useState)();
@@ -746,6 +777,15 @@ window.__ModuleLoader__.load({
 					t
 				})
 			}, ClaudeSection));
+			ctx.slots.inject("settings.models.provider-card", () => ctx.slots.register({
+				name: "settings.models.provider-card",
+				key: "llm-pi-ai",
+				locale: NS,
+				inject: () => ({
+					rpc: connection.rpc,
+					t
+				})
+			}, ClaudeProviderAuth));
 			ctx.slots.inject("conversation.input.right", () => ctx.slots.register({
 				name: "conversation.input.right",
 				id: "claude-subscription-quota",

package/lib/index.js

@@ -1,9 +1,11 @@
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
-import { LlmError } from "@deepseek-ai/dsh-llm";
+import { LlmError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
-import { settingsNamespace } from "@deepseek-ai/dsh-settings";
 import z from "@deepseek-ai/schemastery";
 import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve as resolvePath } from "node:path";
 import { anthropicProvider as createAnthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
 import { createModels } from "@earendil-works/pi-ai";
 //#region src/credential-store.js
@@ -448,7 +450,21 @@ function anthropicSubscriptionProvider() {
 		})
 	});
 }
-const PI_AI_RUNTIME_VERSION = "0.82.1";
+const PI_AI_RUNTIME_VERSION = "0.84.2";
+const PI_AI_AUTH_CONTEXT = Object.freeze({
+	async env(name) {
+		return process.env[name];
+	},
+	async fileExists(path) {
+		const expanded = path === "~" || path.startsWith("~/") ? resolvePath(homedir(), path.slice(1).replace(/^\//, "")) : path;
+		try {
+			await access(expanded);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+});
 //#endregion
 //#region src/settings-contract.js
 const SETTINGS_NAMESPACE = "claude-subscription";
@@ -533,7 +549,7 @@ function createClaudeUsageReader(options) {
 	const now = options.now ?? Date.now;
 	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-	const userAgent = options.userAgent ?? "dsh-claude-subscription/0.2.0";
+	const userAgent = options.userAgent ?? "dsh-claude-subscription/0.3.0";
 	let cached;
 	let inFlight;
 	const load = async (signal) => {
@@ -673,17 +689,28 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, preferences })
 	};
 }
 function apply(ctx) {
-	const settings = ctx.settings.register(settingsNamespace(SETTINGS_NAMESPACE), z.object({ [QUICK_QUOTA_FIELD]: z.boolean().default(false) }));
+	const defaultPreferences = Object.freeze({ [QUICK_QUOTA_FIELD]: false });
+	let preferenceSource = () => defaultPreferences;
+	ctx.settings.installSection(ctx, SETTINGS_NAMESPACE, z.object({ [QUICK_QUOTA_FIELD]: z.boolean().default(false) }), defaultPreferences, {
+		setSource: (current) => {
+			preferenceSource = current;
+		},
+		onChange: () => void 0
+	});
 	const preferences = {
 		status: () => ({
-			[QUICK_QUOTA_FIELD]: settings.get()[QUICK_QUOTA_FIELD],
+			[QUICK_QUOTA_FIELD]: preferenceSource()[QUICK_QUOTA_FIELD],
 			writable: ctx.settings.writable
 		}),
-		update: (patch) => settings.update(patch)
+		update: async (patch) => {
+			await ctx.settings.update(SETTINGS_NAMESPACE, patch);
+			return preferenceSource();
+		}
 	};
 	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF);
 	const provider = anthropicSubscriptionProvider();
-	const authModels = createModels({ credentials: store });
+	const auth = Object.freeze({ credentials: store, authContext: PI_AI_AUTH_CONTEXT });
+	const authModels = createModels(auth);
 	authModels.setProvider(provider);
 	const profile = Object.freeze({
 		provider: PROVIDER,
@@ -691,6 +718,10 @@ function apply(ctx) {
 		piProvider: provider,
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
 		streamIdleTimeoutMs: 600 * 1e3,
+		maxRequestImageBytes: 20 * 1024 * 1024,
+		requestImagePixelBudget: 2048 * 2048,
+		requestImageMaxBytes: 1024 * 1024,
+		retryPolicy: resolveRetryPolicy(void 0, "claude-subscription retryPolicy"),
 		cacheRetention: "short",
 		transport: "sse"
 	});
@@ -698,6 +729,7 @@ function apply(ctx) {
 	const resolveAuth = () => authModels.getAuth(PROVIDER);
 	const adapter = new PiAiAdapter({
 		profiles: () => profiles,
+		auth,
 		resolveApiKey: async () => {
 			let resolved;
 			try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-claude-subscription",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "packageManager": "pnpm@11.19.0",
   "description": "Claude Pro/Max subscription for DeepSeek Harness with official Anthropic OAuth login and automatic token refresh",
   "type": "module",
@@ -18,8 +18,6 @@
     "README.en.md",
     "AGENTS.md",
     "LICENSE",
-    "SECURITY.md",
-    "THIRD_PARTY_NOTICES.md",
     "docs/assets/*.png"
   ],
   "dsh": {
@@ -31,17 +29,17 @@
         "@deepseek-ai/dsh-api-remotes",
         "@deepseek-ai/dsh-client-connection",
         "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-runtime",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-model-selection",
         "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-settings-models",
         "@deepseek-ai/dsh-client-ui-tool"
       ],
       "platform": "web"
     }
   },
   "scripts": {
-    "build": "tsdown --config tsdown.config.mjs",
+    "build": "node --check lib/index.js && node --check lib/client.js",
     "test": "node --test tests/*.test.mjs",
     "check": "pnpm run test && pnpm run build && pnpm pack --pack-destination .artifacts"
   },
@@ -65,25 +63,21 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-api-remotes": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/dsh-settings": "0.1.0-rc.6 || 0.1.0-rc.7",
-    "@deepseek-ai/schemastery": "3.18.1",
-    "@earendil-works/pi-ai": "0.82.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-credentials": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-llm": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-alpha.5",
+    "@deepseek-ai/schemastery": "^3.18.2",
+    "@earendil-works/pi-ai": "^0.84.2",
     "react": "^18.2.0"
   },
-  "devDependencies": {
-    "tsdown": "0.22.2"
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-client-ui-primitives": { "optional": true },
+    "@deepseek-ai/dsh-credentials": { "optional": true },
+    "@deepseek-ai/dsh-llm": { "optional": true },
+    "@deepseek-ai/dsh-llm-pi-ai": { "optional": true },
+    "@deepseek-ai/schemastery": { "optional": true },
+    "@earendil-works/pi-ai": { "optional": true },
+    "react": { "optional": true }
   }
 }

package/SECURITY.md

@@ -1,31 +0,0 @@
-# Security policy
-
-## Supported version
-
-Security fixes are applied to the latest tagged release. DeepSeek Harness is a developer preview, so compatibility fixes may require upgrading both DSH and this bundle.
-
-## Reporting a vulnerability
-
-Use a private GitHub security advisory at:
-
-https://github.com/x5427876/dsh-claude-subscription/security/advisories/new
-
-Do not open a public issue containing access tokens, refresh tokens, account identifiers, callback URLs with authorization codes, raw DSH credential data, or private prompts. Include the affected version, operating system, DSH version, a minimal reproduction, and impact. Replace all credentials with unmistakably fake placeholders.
-
-## Trust boundary
-
-- The plugin runs with the privileges of the DSH host process.
-- OAuth credentials remain in DSH's host credential service.
-- The browser settings client can call only a loopback-authorized, redacted RPC surface.
-- Login links are restricted to the HTTPS `claude.ai` origin before they are returned or opened.
-- Token refresh runs host-side through pi-ai's Anthropic OAuth flow; tokens never enter the browser client.
-- The bundle defines no API-key or cross-provider fallback.
-
-Installing any DSH plugin grants its host code access to the services named in its composition. Review the tag or commit you install. Prefer a tagged version or a full commit hash over a moving branch.
-
-## Out of scope
-
-- availability or policy changes in Claude, claude.ai, Anthropic OAuth, or DeepSeek Harness
-- compromised host machines or compromised DSH installations
-- secrets deliberately pasted into prompts, logs, issues, or screenshots
-- provider billing or quota disputes

package/THIRD_PARTY_NOTICES.md

@@ -1,12 +0,0 @@
-# Third-party notices
-
-This project depends on software distributed under its own terms. The dependency lockfile records the exact resolved graph used for the release.
-
-| Project | Role | License | Source |
-| --- | --- | --- | --- |
-| DeepSeek Harness packages | Plugin host, client slots, credential and LLM interfaces | MIT | https://github.com/deepseek-ai/deepseek-harness |
-| `@earendil-works/pi-ai` 0.82.1 | Anthropic OAuth (Claude Pro/Max), model catalog, and Messages transport | MIT | https://github.com/earendil-works/pi |
-| React | DSH settings component runtime | MIT | https://github.com/facebook/react |
-| tsdown | Development-time bundler | MIT | https://github.com/rolldown/tsdown |
-
-No third-party project endorses this community plugin. See each installed package for its complete license text and transitive dependency notices.