dsh-claude-subscription 0.2.0

package/AGENTS.md

@@ -0,0 +1,85 @@
+# Agent installation guide
+
+Use this guide when a user asks an Agent to install, update, verify, or remove
+`dsh-claude-subscription`.
+
+## Safety
+
+- Confirm the target DSH profile; use `web` only when it is the user's target.
+- Use the pinned `v0.2.0` release assets for a first install, never a moving branch.
+- Never print OAuth credentials, account IDs, authorization callbacks, or the
+  credential store.
+- Do not start, stop, or restart DSH without explicit permission.
+- Preserve the DSH profile, unrelated plugins, and stored OAuth credentials.
+  Signing out requires explicit permission.
+- Do not delete any DSH profile during install, update, verification, or uninstall.
+
+## Detect the installation
+
+Check whether the plugin is already installed in the target DSH profile. When
+it is already listed, use update or uninstall instead of installing again.
+
+## Existing DSH CLI
+
+When `dsh`, Node.js, and pnpm are already available, install the pinned npm
+package directly:
+
+```sh
+dsh plugin --profile web add dsh-claude-subscription@0.2.0
+```
+
+Update with `dsh plugin --profile web update dsh-claude-subscription`.
+Uninstall the current package with:
+
+```sh
+dsh plugin --profile web remove dsh-claude-subscription
+```
+
+## Desktop profile install (DSH Desktop)
+
+The DSH Desktop app composes profiles under `~/.dsh/profiles`. For each target
+profile (`desktop`, `web`):
+
+1. `pnpm pack` the plugin into a tarball (or download the pinned release tarball).
+2. Copy the tarball into the profile directory.
+3. Add `"dsh-claude-subscription": "file:./dsh-claude-subscription-0.2.0.tgz"` to
+   the profile's `package.json` `dependencies` and add `dsh-claude-subscription`
+   to its `dsh.profile.bundles` array.
+4. Run `pnpm install` in the profile directory.
+5. The user must restart DSH once for the plugin to load.
+
+The installed package keeps its OAuth credentials in DSH's host credential
+service (`ANTHROPIC_SUBSCRIPTION_OAUTH`); never edit that store by hand while
+the plugin runs.
+
+## Verify
+
+For the existing CLI path, run:
+
+```sh
+dsh plugin --profile web list dsh-claude-subscription --depth 0
+dsh --profile web --dump-config
+```
+
+Success requires:
+
+1. The requested package version appears once.
+2. `claude-subscription` appears once in the composed config after install
+   or update, and is absent after uninstall.
+3. No unrelated profile or plugin changed.
+4. A running DSH process was not restarted by the operation.
+
+Do not treat `dsh plugin --profile web peers check` as the completion test.
+If the user authorizes a live check, restart DSH manually, open
+**Settings -> Claude**, and verify the page loads and reports the saved
+login. Confirm that the `anthropic` provider and its Claude models are
+selectable in the model picker. Only when the user explicitly requests a
+quota-consuming live check, ask the Agent to send one short message with a
+Claude model and confirm the reply.
+
+## Failure handling
+
+On any failure, report the sanitized command error, DSH version, selected
+profile, requested release, installation mode, what changed, cleanup status,
+and what remains unverified. Do not patch DSH, switch to another paid route,
+wipe credentials, delete a profile, or claim success from a partial check.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-claude-subscription contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,98 @@
+# DSH Claude Subscription
+
+[![CI](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml/badge.svg)](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/dsh-claude-subscription?logo=npm&label=npm)](https://www.npmjs.com/package/dsh-claude-subscription)
+[![License: MIT](https://img.shields.io/badge/license-MIT-111111.svg)](LICENSE)
+
+[繁體中文](README.md)
+
+Sign in to a Claude Pro / Max subscription directly in DeepSeek Harness, with
+no Anthropic API key required. Sign-in and token refresh use the official
+Anthropic OAuth flow (the same one Claude Code uses). Credentials stay in
+DSH's host credential service: no token extraction, no resale, no extra billing.
+
+[Agent install](#let-an-agent-install-it-recommended) · [Manual install](#manual-install) · [Update and uninstall](#update-and-uninstall)
+
+## What it does
+
+- Uses your Claude Pro / Max subscription directly inside DSH, with no Anthropic API key required;
+- Signs in to claude.ai from Settings through the official OAuth flow and keeps credentials on the host;
+- Refreshes the access token automatically with the refresh token;
+- Shows sign-in status and token expiry;
+- Shows the **subscription quota**: remaining percentage and reset time for the 5-hour, 7-day, Opus, and Sonnet windows;
+- Adds a **composer quota** toggle (off by default) that shows the current model's remaining quota next to the message input;
+- Fails visibly when subscription routing is unavailable instead of silently using another paid route.
+
+## Prepare DSH
+
+This plugin supports DeepSeek Harness `0.1.0-rc.6` and `0.1.0-rc.7`, and
+requires a Claude Pro, Max, Team, or Enterprise subscription.
+
+If DSH already opens normally, continue with the plugin installation below.
+
+## Install
+
+### Let an Agent install it (recommended)
+
+Send the following URL directly to your Agent. The guide contains install,
+update, uninstall, and verification steps. It preserves the DSH profile and
+sign-in and never restarts DSH without permission:
+
+[Open the Agent installation guide](https://raw.githubusercontent.com/x5427876/dsh-claude-subscription/main/AGENTS.md)
+
+```text
+https://raw.githubusercontent.com/x5427876/dsh-claude-subscription/main/AGENTS.md
+```
+
+### Manual install
+
+When the `dsh` command is available:
+
+```sh
+dsh plugin --profile web add dsh-claude-subscription
+dsh plugin --profile web list dsh-claude-subscription --depth 0
+dsh --profile web --dump-config
+```
+
+For DSH Desktop, put the `pnpm pack` tarball into
+`~/.dsh/profiles/<profile>/`, add the `file:` dependency and the
+`dsh.profile.bundles` entry in that profile's `package.json`, run
+`pnpm install` there, then restart DSH. After install:
+
+1. Open **Settings -> Claude subscription** in DSH.
+2. If not signed in, click **Browser sign-in** and authorize on claude.ai.
+3. Pick a Claude model under the `anthropic` provider in the model picker.
+4. Turn on **Composer quota** on the same page when you want it.
+
+## Quota display
+
+The **Subscription quota** card in **Settings -> Claude subscription** shows the
+quota windows reported by Anthropic. The host reads them; the browser receives
+only a percentage projection, and the access token never leaves the machine.
+Results are cached for 60 seconds, and **Refresh** reads them again immediately.
+
+With **Composer quota** on, a Claude model shows the tightest applicable window
+next to the message input (Opus and Sonnet models also count their 7-day
+window). Nothing is rendered when you are signed out or when the account
+reports no quota windows.
+
+## Update and uninstall
+
+```sh
+dsh plugin --profile web update dsh-claude-subscription
+dsh plugin --profile web remove dsh-claude-subscription
+```
+
+## Usage note
+
+- Subscriptions are for the subscriber's own use; usage from this plugin
+  counts against your subscription quota.
+- Anthropic terms allow third-party access "at Anthropic's discretion" and
+  reserve the right to charge such usage against usage credits instead of
+  subscription limits. Follow [Anthropic's terms](https://support.claude.com/en/articles/13189465-log-in-to-your-claude-account).
+- This plugin never extracts Claude Code's local OAuth token; sign-in always
+  goes through browser authorization.
+
+## License
+
+MIT License

package/README.md

@@ -0,0 +1,93 @@
+# DSH Claude Subscription
+
+[![CI](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml/badge.svg)](https://github.com/x5427876/dsh-claude-subscription/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/dsh-claude-subscription?logo=npm&label=npm)](https://www.npmjs.com/package/dsh-claude-subscription)
+[![License: MIT](https://img.shields.io/badge/license-MIT-111111.svg)](LICENSE)
+
+[English](README.en.md)
+
+在 DeepSeek Harness 中直接登入 Claude Pro / Max 訂閱並使用 Claude 模型，
+不需要 Anthropic API Key。登入與 token 續期走 Anthropic 官方 OAuth 流程
+（與 Claude Code 相同），憑證保留在 DSH 本機 credential service，
+不抽取、不轉售、不額外計費。
+
+[交給 Agent 安裝](#交給-agent推薦) · [手動安裝](#手動安裝) · [更新與解除安裝](#更新與解除安裝)
+
+## 能做什麼
+
+- 在 DSH 中直接使用 Claude Pro / Max 訂閱，不需要 Anthropic API Key；
+- 在設定頁以官方 OAuth 流程登入 claude.ai，憑證保留在 DSH 本機；
+- access token 過期時自動以 refresh token 續期，不需手動處理；
+- 顯示登入狀態；
+- 顯示**訂閱額度**：5 小時、7 天、Opus 與 Sonnet 的剩餘百分比與重置時間；
+- **輸入框額度**開關（預設關閉）：開啟後在對話輸入框右側顯示目前模型的剩餘額度；
+- 訂閱路由不可用時明確報錯，不會靜默切換到其他付費路由。
+
+## 準備 DSH
+
+本插件適配 DeepSeek Harness `0.1.0-rc.6` 與 `0.1.0-rc.7`，需要一個
+Claude Pro、Max、Team 或 Enterprise 訂閱帳號。
+
+已經能正常打開 DSH 的使用者可以直接繼續安裝插件。
+
+## 安裝
+
+### 交給 Agent（推薦）
+
+把下面的連結直接發給 Agent。文件包含安裝、更新、解除安裝與驗收步驟；
+它不會刪除 DSH profile、登入資訊，也不會未經許可重啟 DSH。
+
+[開啟 Agent 安裝文件](https://raw.githubusercontent.com/x5427876/dsh-claude-subscription/main/AGENTS.md)
+
+```text
+https://raw.githubusercontent.com/x5427876/dsh-claude-subscription/main/AGENTS.md
+```
+
+### 手動安裝
+
+已有 `dsh` 指令時：
+
+```sh
+dsh plugin --profile web add dsh-claude-subscription
+dsh plugin --profile web list dsh-claude-subscription --depth 0
+dsh --profile web --dump-config
+```
+
+DSH Desktop（桌面版）時，把 `pnpm pack` 產出的 tarball 放進
+`~/.dsh/profiles/<profile>/`，在該 profile 的 `package.json` 加入
+`file:` 依賴與 `dsh.profile.bundles` 條目，然後在該目錄執行
+`pnpm install`，最後重啟 DSH。安裝後：
+
+1. 開啟 DSH 的**設定 → Claude 訂閱**。
+2. 若尚未登入，按**瀏覽器登入**，在 claude.ai 完成授權。
+3. 在模型選單選擇 `anthropic` provider 下的 Claude 模型。
+4. 需要時，在同一頁打開**輸入框額度**開關。
+
+## 額度顯示
+
+**設定 → Claude 訂閱**的**訂閱額度**卡片顯示 Anthropic 回報的額度視窗。
+資料由 host 端讀取，瀏覽器只收到百分比投影，access token 不會離開本機。
+額度結果快取 60 秒，按**重新整理**可立即重新讀取。
+
+打開**輸入框額度**後，選用 Claude 模型時，輸入框右側顯示最緊的那個額度視窗
+（Opus 或 Sonnet 模型會納入對應的 7 天視窗）。未登入、或帳號走 API Key 計費
+而沒有額度視窗時，該處不顯示任何內容。
+
+## 更新與解除安裝
+
+```sh
+dsh plugin --profile web update dsh-claude-subscription
+dsh plugin --profile web remove dsh-claude-subscription
+```
+
+## 使用注意
+
+- 訂閱方案僅供訂閱者本人使用；本插件產生的用量會計入你的訂閱額度。
+- Anthropic 條款允許「Anthropic 自行決定」是否讓訂閱者透過第三方工具
+  存取服務，並保留改從使用額度扣款的權利。請遵守
+  [Anthropic 的使用條款](https://support.claude.com/zh-TW/articles/13189465-登入您的-claude-帳戶)。
+- 本插件不抽取 Claude Code 本機的 OAuth token；登入一律透過瀏覽器授權。
+
+## 授權
+
+MIT License

package/SECURITY.md

@@ -0,0 +1,31 @@
+# Security policy
+
+## Supported version
+
+Security fixes are applied to the latest tagged release. DeepSeek Harness is a developer preview, so compatibility fixes may require upgrading both DSH and this bundle.
+
+## Reporting a vulnerability
+
+Use a private GitHub security advisory at:
+
+https://github.com/x5427876/dsh-claude-subscription/security/advisories/new
+
+Do not open a public issue containing access tokens, refresh tokens, account identifiers, callback URLs with authorization codes, raw DSH credential data, or private prompts. Include the affected version, operating system, DSH version, a minimal reproduction, and impact. Replace all credentials with unmistakably fake placeholders.
+
+## Trust boundary
+
+- The plugin runs with the privileges of the DSH host process.
+- OAuth credentials remain in DSH's host credential service.
+- The browser settings client can call only a loopback-authorized, redacted RPC surface.
+- Login links are restricted to the HTTPS `claude.ai` origin before they are returned or opened.
+- Token refresh runs host-side through pi-ai's Anthropic OAuth flow; tokens never enter the browser client.
+- The bundle defines no API-key or cross-provider fallback.
+
+Installing any DSH plugin grants its host code access to the services named in its composition. Review the tag or commit you install. Prefer a tagged version or a full commit hash over a moving branch.
+
+## Out of scope
+
+- availability or policy changes in Claude, claude.ai, Anthropic OAuth, or DeepSeek Harness
+- compromised host machines or compromised DSH installations
+- secrets deliberately pasted into prompts, logs, issues, or screenshots
+- provider billing or quota disputes

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,12 @@
+# Third-party notices
+
+This project depends on software distributed under its own terms. The dependency lockfile records the exact resolved graph used for the release.
+
+| Project | Role | License | Source |
+| --- | --- | --- | --- |
+| DeepSeek Harness packages | Plugin host, client slots, credential and LLM interfaces | MIT | https://github.com/deepseek-ai/deepseek-harness |
+| `@earendil-works/pi-ai` 0.82.1 | Anthropic OAuth (Claude Pro/Max), model catalog, and Messages transport | MIT | https://github.com/earendil-works/pi |
+| React | DSH settings component runtime | MIT | https://github.com/facebook/react |
+| tsdown | Development-time bundler | MIT | https://github.com/rolldown/tsdown |
+
+No third-party project endorses this community plugin. See each installed package for its complete license text and transitive dependency notices.

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# One plugin owns the Claude subscription provider route, host-only account
+# RPC, and settings surface. It leaves DSH's model and persistent web
+# configuration untouched.
+- insert:
+    - id: claude-subscription
+      name: 'dsh-claude-subscription'

package/docs/assets/README.md

@@ -0,0 +1,12 @@
+# docs
+
+Press material for the DSH Claude subscription plugin.
+
+## assets
+
+Drop settings-page screenshots here and reference them from the READMEs with
+the release-asset URL pattern used by the CI release workflow:
+
+```text
+https://github.com/x5427876/dsh-claude-subscription/releases/latest/download/settings.png
+```