dsh-coding-subscription-oauth 0.5.2 → 0.5.4

package/README.ko.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.5.2 · 이전 이름 `dsh-grok-build`
+**v0.5.4 · 이전 이름 `dsh-grok-build`
 
 **[DeepSeek Harness](https://github.com/deepseek-ai/dsh)용 코딩 구독 OAuth 플러그인.** 이미 결제한 구독으로 한 번에 로그인하고, dsh 설정 페이지나 CLI에서 그 모델을 사용하세요. **채팅에 토큰을 붙여넣을 필요가 없습니다.**
 
@@ -20,11 +20,10 @@
 ## 이름 변경
 
 처음에는 Grok Build 전용 **`dsh-grok-build`** 였습니다. 지금은 SuperGrok / Codex / Kimi / Claude / Antigravity 코딩 구독 OAuth입니다.
-
 | | 이것을 쓰세요 | 계속 동작 |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build`（같은 `main`） |
-| npm | `dsh-coding-subscription-oauth@0.5.2`（현재 릴리스） | 레거시 npm 패키지는 게시된 적 없음 |
+| npm | `dsh-coding-subscription-oauth@0.5.4`（현재 릴리스） | 레거시 npm 패키지는 게시된 적 없음 |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis 플러그인 id | `llm-grok-build-oauth` | 그대로 |
 | 설정 페이지 HTTP API | `/plugins/dsh-grok-build/*` | 그대로 |
@@ -36,8 +35,11 @@
 - 🔑 **로컬 OAuth, 키 붙여넣기 불필요** — 설정 페이지나 CLI에서 인증하며, 토큰이 채팅에 들어가지 않습니다.
 - 🧩 **하나의 플러그인, 다섯 프로바이더** — Grok Build, Codex, Kimi, Claude, Google Antigravity.
 - 🛡️ **안전한 설계** — 인증 파일은 소유자 전용 `0600`, 원자적 쓰기, 크로스 프로세스 파일 잠금.
-- ⚙️ **동적 카탈로그** — 모델 선택기에 인증을 완료한 프로바이더만 표시됩니다.
+- ⚙️ **동적 카탈로그** — 선택기에는 인증을 완료한 라우트만 `(OAuth)` 라벨과 함께 표시되며, grok-4.6의 `xhigh`도 포함됩니다.
 - 🌐 **프록시 인지형** — 검증된 신뢰 가능한 구독 도메인만 프록시합니다.
+- 📥 **수동 CLI Pull** — 설정 페이지가 허용 목록에 있는 공식 Grok/Codex/Kimi/Claude CLI OAuth 파일을 읽기 전용으로 검색합니다. 미리보기와 덮어쓰기 확인 후 단방향 복사본을 가져옵니다.
+- 🗂️ **탭으로 나뉜 설정** — Accounts, Gateway, Capabilities, About. 원격 호스트에서는 device code를 우선하고 CLI missing 소음을 줄이며, 로그인된 카드는 펼칠 때까지 접혀 있습니다.
+- 🎛️ **선택적 기능 (기본 꺼짐)** — Codex 검색, 사용량/쿼터, 이미지 생성/편집, Fast, Grok Imagine은 스위치를 켜면 즉시 적용됩니다.
 - 🔌 **옵트인 로컬 API 게이트웨이** — 기본 꺼짐의 루프백 OpenAI/Anthropic 호환 서버. 내 도구 전용이며 공개 릴레이가 아닙니다.
 
 ## 이 플러그인이 푸는 연동 문제
@@ -71,7 +73,7 @@
 
 ```bash
 # 1. web 프로필에 플러그인 설치 (현재 npm 릴리스)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 2. 선택 사항 — Google Antigravity (검증된 고정 버전)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -85,9 +87,13 @@ systemctl --user restart dsh-web.service
 ## 📚 목차
 
 - [이름 변경](#이름-변경)
+- [기능](#-기능)
 - [이 플러그인이 푸는 연동 문제](#이-플러그인이-푸는-연동-문제)
+- [지원 프로바이더](#지원-프로바이더)
+- [빠른 시작](#-빠른-시작)
 - [설치](#설치)
 - [설정 페이지](#설정-페이지)
+- [선택적 기능](#선택적-기능)
 - [로컬 API 게이트웨이](#로컬-api-게이트웨이)
 - [CLI](#cli)
 - [중국에서의 Kimi](#중국에서의-kimi)
@@ -98,6 +104,7 @@ systemctl --user restart dsh-web.service
 - [기술 메모](#기술-메모)
 - [준수](#준수)
 - [문서](#문서)
+- [관련 프로젝트](#관련-프로젝트)
 - [기여](#기여)
 - [라이선스](#라이선스)
 
@@ -107,7 +114,7 @@ DeepSeek Harness `0.1.0-rc.6+` 및 Node.js 22.19+가 필요합니다. 자세한
 
 ```bash
 # 현재 npm 릴리스 (권장)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 개발/대안: GitHub에서
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -134,6 +141,25 @@ pnpm run smoke:deployed             # 실제 Codex/Kimi 도구 호출 + 두 번
 
 **Settings → Coding OAuth**를 열어 주세요:
 
+
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_accounts.png"><img src="media/settings_accounts.png" alt="Coding OAuth Accounts tab" width="280" /></a><br />
+      <sub>Accounts</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_gateway.png"><img src="media/settings_gateway.png" alt="Coding OAuth Gateway tab" width="280" /></a><br />
+      <sub>Gateway</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_capabilities.png"><img src="media/settings_capabilities.png" alt="Coding OAuth Capabilities tab" width="280" /></a><br />
+      <sub>Capabilities</sub>
+    </td>
+  </tr>
+</table>
+
 | 프로바이더 | 방식 |
 |---|---|
 | Grok | 인증 코드 · 디바이스 코드 · Grok CLI import · 모델 선택 |
@@ -201,16 +227,16 @@ Kimi Code 구독 OAuth는 `https://auth.kimi.com`, 추론은 `https://api.kimi.c
 
 OAuth 액세스 토큰은 저장된 만료 시각 **5분 전**에 선제적으로 갱신됩니다(pi-ai 0.84+). 업스트림이 로컬에서는 아직 유효한 토큰을 401/403으로 거절하면, 플러그인이 저장된 `expires`를 과거로 되돌리고 재시도 단계에서 먼저 갱신한 뒤 다시 요청합니다.
 
-요청 재시도는 harness retry 정책을 따릅니다. 일시 오류(`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`)와 **`AUTH`**는 지수 백오프로 재시도합니다(기본 2회, 500 ms → 10 s, 10% jitter). 쿼터 소진과 죽은 refresh token은 재시도하지 않습니다. 배포별 재정의:
+요청 재시도는 harness retry 정책을 따릅니다. 일시 오류(`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`)와 **`AUTH`**는 지수 백오프로 재시도합니다(기본 5회, 5 s → 10 s → 20 s → 40 s → 80 s (~155 s 누적), 10% jitter). 쿼터 소진과 죽은 refresh token은 재시도하지 않습니다. 배포별 재정의:
 
 ```yaml
 - id: llm-grok-build-oauth
   config:
     retryPolicy:
       mode: normal
-      maxRetries: 2
+      maxRetries: 5
       retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, AUTH]
-      backoff: { initialDelayMs: 500, maxDelayMs: 10000, jitterRatio: 0.1 }
+      backoff: { initialDelayMs: 5000, maxDelayMs: 80000, jitterRatio: 0.1 }
 ```
 
 ## 자격 증명

package/README.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.5.2** · formerly `dsh-grok-build`
+**v0.5.4** · formerly `dsh-grok-build`
 
 **Coding-subscription OAuth for [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Use SuperGrok / X Premium (Grok Build), ChatGPT Plus/Pro (Codex), Kimi Code, Claude Pro/Max and Google Antigravity inside DSH — without a second API-key bill and **without pasting any token into chat.**
 
@@ -23,8 +23,8 @@ Published first as **`dsh-grok-build`** when it only covered Grok Build. The cur
 
 | | Use this | Still works |
 |---|---|---|
-| npm (recommended) | Current release is `0.5.2`: `dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2` | No legacy npm package was published |
-| GitHub / development | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (same `main`) |
+| npm (recommended) | Current release is `0.5.4`: `dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4` | No legacy npm package was published |
+| GitHub / development | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | Previous GitHub repo `dsh-grok-build` was removed |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | unchanged |
 | Settings HTTP API | `/plugins/dsh-grok-build/*` | unchanged |
@@ -32,14 +32,14 @@ Published first as **`dsh-grok-build`** when it only covered Grok Build. The cur
 
 ## ✨ Features
 
-- 🧾 **Bring your own subscription** — SuperGrok, ChatGPT Plus/Pro, Kimi Code, Claude Pro/Max; no extra pay-as-you-go key.
+- 🧽 **Bring your own subscription** — SuperGrok, ChatGPT Plus/Pro, Kimi Code, Claude Pro/Max; no extra pay-as-you-go key.
 - 🔑 **Local OAuth, no key-pasting** — authorize in Settings or CLI; access/refresh tokens never enter chat, logs or HTTP status.
 - 🧩 **One plugin, five providers** — Grok Build (`cli-chat-proxy.grok.com`), Codex, Kimi Code, Claude Code and Google Antigravity.
 - 🛡️ **Secure by design** — credential files are owner-only `0600`, atomically written, cross-process locked.
 - ⚙️ **Dynamic catalog** — the selector lists only signed-in routes, labelled `(OAuth)`, including grok-4.6 `xhigh`.
 - 🌐 **Proxy-aware** — proxies only reviewed subscription domains; Kimi China stays direct by default.
 - 📥 **Manual CLI Pull** — Settings discovers allowlisted official Grok/Codex/Kimi/Claude CLI OAuth files read-only; you pull a one-way copy after preview and overwrite confirmation.
-- 🗂️ **Tabbed Settings** — Accounts, Gateway, Capabilities, and About replace the long waterfall; signed-in provider cards stay collapsed until you expand them.
+- 🗂️ **Tabbed Settings** — Accounts, Gateway, Capabilities, and About; remote hosts prefer device-code sign-in with quieter CLI-missing tips; signed-in cards stay collapsed until expanded.
 - 🎛️ **Optional capabilities, default off** — Codex search, usage/quota, image generate/edit, Fast, and Grok Imagine apply live when you turn them on.
 - 🔌 **Opt-in local API gateway** — default-off loopback OpenAI/Anthropic-compatible server for your own tools, with copyable base URLs and Bearer key; never a public relay.
 
@@ -77,7 +77,7 @@ Grok Build device login, live `/v1/models-v2` and Responses streaming are verifi
 
 ```bash
 # 1. install the current npm release into the web profile
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 2. optional — Google Antigravity (pinned, reviewed version)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -91,7 +91,10 @@ Then open **Settings → Coding OAuth** and sign in to any provider. Done — pi
 ## 📚 Table of contents
 
 - [Name change](#name-change)
+- [Features](#-features)
 - [Problems this plugin solves](#problems-this-plugin-solves)
+- [Supported providers](#supported-providers)
+- [Quick start](#-quick-start)
 - [Install](#install)
 - [Settings page](#settings-page)
 - [Optional capabilities](#optional-capabilities)
@@ -105,6 +108,7 @@ Then open **Settings → Coding OAuth** and sign in to any provider. Done — pi
 - [Technical notes](#technical-notes)
 - [Compliance](#compliance)
 - [Documentation](#documentation)
+- [Related](#related)
 - [Contributing](#contributing)
 - [License](#license)
 
@@ -114,7 +118,7 @@ Requires DeepSeek Harness `0.1.0-rc.6+` and Node.js 22.19+. Full details in the
 
 ```bash
 # current npm release
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # development / alternative: from GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -123,7 +127,7 @@ dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
 # dsh plugin --profile web add ./dsh-coding-subscription-oauth
 ```
 
-Restart `dsh web` after installing. Verification against a live deployment:
+Restart `dsh web` after installing. Maintainers can verify a live deployment from a source checkout (npm installs do not include these scripts):
 
 ```bash
 pnpm run verify:deployed            # checks real /api/llm.models + OAuth state
@@ -139,7 +143,24 @@ pnpm run smoke:deployed             # real Codex/Kimi tool-calls + second-turn r
 
 ## Settings page
 
-Open **Settings → Coding OAuth**. The page is organized into four top tabs — **Accounts**, **Gateway**, **Capabilities**, and **About** — so it no longer requires a long waterfall scroll. Signed-in provider cards collapse to a compact summary; expand one to edit models or use its CLI Pull controls. CLI previews span the full content width, and the Capabilities tab shows live optional switches plus Imagine status.
+Open **Settings → Coding OAuth**. The page is organized into four top tabs — **Accounts**, **Gateway**, **Capabilities**, and **About** — so it no longer requires a long waterfall scroll. On a remote (non-loopback) host, Accounts prefers device-code sign-in and collapses noisy CLI-missing hints into one tip. Signed-in provider cards collapse to a compact summary; expand one to edit models or use its CLI Pull controls. CLI previews span the full content width, and the Capabilities tab shows live optional switches plus Imagine status.
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_accounts.png"><img src="media/settings_accounts.png" alt="Coding OAuth Accounts tab" width="280" /></a><br />
+      <sub>Accounts</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_gateway.png"><img src="media/settings_gateway.png" alt="Coding OAuth Gateway tab" width="280" /></a><br />
+      <sub>Gateway</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_capabilities.png"><img src="media/settings_capabilities.png" alt="Coding OAuth Capabilities tab" width="280" /></a><br />
+      <sub>Capabilities</sub>
+    </td>
+  </tr>
+</table>
 
 | Provider | Methods |
 |---|---|
@@ -178,7 +199,7 @@ gateway:
 
 Endpoints: `GET /healthz`, `GET /v1/models`, `POST /v1/chat/completions`, `POST /v1/responses`, `POST /v1/messages`. A Bearer key is stored at `$DSH_HOME/.coding-oauth-gateway.json` (`0600`).
 
-On the **Gateway** tab, copy the OpenAI base URL (for example, `http://127.0.0.1:18080/v1`), the Anthropic base URL, or the current Bearer key without rotating it. Key rotation requires confirmation. Edit the listen port with **Apply** or fill it with **Random** (`18100`–`18999`); the selected port is persisted in the owner-only gateway document, and a running listener rebinds to it. Bind remains YAML-only; a non-loopback bind requires a key. This is not a remote relay.
+On the **Gateway** tab, copy the OpenAI base URL (for example, `http://127.0.0.1:18080/v1`), the Anthropic base URL, or the current Bearer key without rotating it. Key reveal is loopback-only and is never persisted to browser storage. Key rotation requires confirmation. Edit the listen port with **Apply** or fill it with **Random** (`18100`–`18999`); the selected port is persisted in the owner-only gateway document, and a running listener rebinds to it. Bind remains YAML-only; a non-loopback bind requires a key. This is not a remote relay.
 
 ## CLI
 
@@ -218,16 +239,16 @@ Only reviewed subscription domains are proxied (xAI/Grok, OpenAI Codex, Claude/A
 
 OAuth access tokens refresh proactively **five minutes** before their stored expiry (pi-ai 0.84+), so a request never rides a token into its final seconds. If an upstream still rejects a locally-valid token with 401/403 — server-side revocation or clock skew — the plugin backdates the stored credential and the retried step refreshes before reuse, recovering transparently instead of failing the turn.
 
-Request retries use the harness retry policy: transient failures (`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`) **and `AUTH`** retry with exponential backoff (default 2 retries, 500 ms → 10 s, 10% jitter). Quota exhaustion and a dead refresh token are **not** retried — they fail fast with the real message and a sign-in prompt. Override per deployment:
+Request retries use the harness retry policy: transient failures (`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`) **and `AUTH`** retry with exponential backoff (default 5 retries, 5 s → 10 s → 20 s → 40 s → 80 s, ~155 s stacked, 10% jitter). xAI “at capacity / high demand / priority processing” finish messages are remapped to `RATE_LIMIT` so they enter this policy (pi-ai would otherwise label them `PI_AI_ERROR` when upstream `error.code` is null). Quota exhaustion and a dead refresh token are **not** retried — they fail fast with the real message and a sign-in prompt. Override per deployment:
 
 ```yaml
 - id: llm-grok-build-oauth
   config:
     retryPolicy:
       mode: normal
-      maxRetries: 2
+      maxRetries: 5
       retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, AUTH]
-      backoff: { initialDelayMs: 500, maxDelayMs: 10000, jitterRatio: 0.1 }
+      backoff: { initialDelayMs: 5000, maxDelayMs: 80000, jitterRatio: 0.1 }
 ```
 
 ## Credentials

package/README.pt-BR.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.5.2 · antigo `dsh-grok-build`
+**v0.5.4 · antigo `dsh-grok-build`
 
 **Plugin de OAuth para assinaturas de codificação do [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Entre com as assinaturas que você já paga — depois use os modelos delas a partir da página de configurações do dsh ou da CLI. **Nenhum token colado no chat.**
 
@@ -24,7 +24,7 @@ O projeto começou como **`dsh-grok-build`** (só Grok Build). Agora cobre Super
 | | Use isto | Ainda funciona |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (mesmo `main`) |
-| npm | `dsh-coding-subscription-oauth@0.5.2` (versão atual) | Nenhum pacote npm legado foi publicado |
+| npm | `dsh-coding-subscription-oauth@0.5.4` (versão atual) | Nenhum pacote npm legado foi publicado |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | inalterado |
 | API HTTP das configurações | `/plugins/dsh-grok-build/*` | inalterado |
@@ -36,14 +36,16 @@ O projeto começou como **`dsh-grok-build`** (só Grok Build). Agora cobre Super
 - 🔑 **OAuth local, sem colar chave** — autorize na página de configurações ou na CLI; os tokens nunca entram no chat.
 - 🧩 **Um plugin, cinco provedores** — Grok Build, Codex, Kimi, Claude e Google Antigravity.
 - 🛡️ **Seguro por design** — arquivos de credenciais com permissão somente-dono `0600`, escrita atômica, bloqueio de arquivo entre processos.
-- ⚙️ **Catálogo dinâmico** — o seletor de modelos lista exatamente os provedores que você autenticou.
+- ⚙️ **Catálogo dinâmico** — o seletor lista apenas rotas autenticadas, rotuladas com `(OAuth)`, incluindo o `xhigh` do grok-4.6.
 - 🌐 **Ciente de proxy** — faz proxy apenas de domínios de assinatura revisados e confiáveis.
+- 📥 **CLI Pull manual** — as configurações descobrem os arquivos OAuth oficiais dos CLIs Grok/Codex/Kimi/Claude permitidos, somente leitura; você puxa uma cópia de via única após pré-visualização e confirmação de sobrescrita.
+- 🗂️ **Configurações em abas** — Accounts, Gateway, Capabilities e About; hosts remotos preferem device code com menos ruído de CLI missing; cartões conectados ficam recolhidos até serem expandidos.
+- 🎛️ **Capacidades opcionais, padrão desligado** — busca do Codex, uso/cota, geração/edição de imagens, Fast e Grok Imagine são aplicadas ao vivo quando ativadas.
 - 🔌 **Gateway de API local opt-in** — servidor loopback compatível com OpenAI/Anthropic, desligado por padrão; para as suas próprias ferramentas, nunca um relé público.
 
 ## Problemas de integração que este plugin resolve
 
 Estas são as buscas e erros do DSH que costumam trazer as pessoas até aqui.
-
 | Você buscou / viu | O que estava quebrado | O que o plugin faz |
 |---|---|---|
 | SuperGrok / X Premium no DSH, Grok Build vs `api.x.ai` | A rota `xai` é a API paga por uso. A assinatura de coding vai a `cli-chat-proxy.grok.com` | Rota `grok-build` + cabeçalhos de fingerprint da CLI (`X-XAI-Token-Auth` etc.) para evitar 403 silencioso |
@@ -71,7 +73,7 @@ Estas são as buscas e erros do DSH que costumam trazer as pessoas até aqui.
 
 ```bash
 # 1. instale o plugin no perfil web (versão atual do npm)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 2. opcional — Google Antigravity (versão fixa revisada)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -85,9 +87,13 @@ Depois abra **Settings → Coding OAuth** e faça login em qualquer provedor. Pr
 ## 📚 Sumário
 
 - [Mudança de nome](#mudança-de-nome)
+- [Recursos](#-recursos)
 - [Problemas de integração que este plugin resolve](#problemas-de-integração-que-este-plugin-resolve)
+- [Provedores suportados](#provedores-suportados)
+- [Início rápido](#-início-rápido)
 - [Instalação](#instalação)
 - [Página de configurações](#página-de-configurações)
+- [Capacidades opcionais](#capacidades-opcionais)
 - [Gateway de API local](#gateway-de-api-local)
 - [CLI](#cli)
 - [Kimi na China](#kimi-na-china)
@@ -98,6 +104,7 @@ Depois abra **Settings → Coding OAuth** e faça login em qualquer provedor. Pr
 - [Notas técnicas](#notas-técnicas)
 - [Conformidade](#conformidade)
 - [Documentação](#documentação)
+- [Relacionados](#relacionados)
 - [Contribuição](#contribuição)
 - [Licença](#licença)
 
@@ -107,7 +114,7 @@ Requer DeepSeek Harness `0.1.0-rc.6+` e Node.js 22.19+. Detalhes completos nas [
 
 ```bash
 # versão atual do npm (recomendado)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # desenvolvimento/alternativo: do GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -134,6 +141,25 @@ pnpm run smoke:deployed             # chamadas reais Codex/Kimi + replay do segu
 
 Abra **Settings → Coding OAuth**:
 
+
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_accounts.png"><img src="media/settings_accounts.png" alt="Coding OAuth Accounts tab" width="280" /></a><br />
+      <sub>Accounts</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_gateway.png"><img src="media/settings_gateway.png" alt="Coding OAuth Gateway tab" width="280" /></a><br />
+      <sub>Gateway</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_capabilities.png"><img src="media/settings_capabilities.png" alt="Coding OAuth Capabilities tab" width="280" /></a><br />
+      <sub>Capabilities</sub>
+    </td>
+  </tr>
+</table>
+
 | Provedor | Métodos |
 |---|---|
 | Grok | código de autorização · código de dispositivo · importação via CLI Grok · seleção de modelos |
@@ -201,16 +227,16 @@ Apenas domínios de assinatura revisados são usados via proxy (xAI/Grok, OpenAI
 
 Os tokens de acesso OAuth são renovados **cinco minutos** antes do vencimento armazenado (pi-ai 0.84+). Se o upstream ainda rejeitar um token localmente válido com 401/403, o plugin retrocede o `expires` gravado e o step repetido renova o token antes de reenviar.
 
-As novas tentativas seguem a política do harness: falhas transitórias (`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`) **e `AUTH`** repetem com backoff exponencial (padrão: 2 tentativas, 500 ms → 10 s, 10% de jitter). Esgotamento de cota e refresh token morto **não** são repetidos. Sobrescrita por implantação:
+As novas tentativas seguem a política do harness: falhas transitórias (`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`) **e `AUTH`** repetem com backoff exponencial (padrão: 5 tentativas, 5 s → 10 s → 20 s → 40 s → 80 s (~155 s acumulados), 10% de jitter). Esgotamento de cota e refresh token morto **não** são repetidos. Sobrescrita por implantação:
 
 ```yaml
 - id: llm-grok-build-oauth
   config:
     retryPolicy:
       mode: normal
-      maxRetries: 2
+      maxRetries: 5
       retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, AUTH]
-      backoff: { initialDelayMs: 500, maxDelayMs: 10000, jitterRatio: 0.1 }
+      backoff: { initialDelayMs: 5000, maxDelayMs: 80000, jitterRatio: 0.1 }
 ```
 
 ## Credenciais

package/README.ru.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.5.2 · ранее `dsh-grok-build`
+**v0.5.4 · ранее `dsh-grok-build`
 
 **Плагин OAuth для подписок на кодинг для [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Войдите один раз по уже оплаченным подпискам — и используйте их модели из страницы настроек или CLI dsh. **Никаких вставленных токенов в чат.**
 
@@ -24,7 +24,7 @@
 | | Используйте | По-прежнему работает |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (тот же `main`) |
-| npm | `dsh-coding-subscription-oauth@0.5.2` (текущая версия) | Старого npm-пакета не было |
+| npm | `dsh-coding-subscription-oauth@0.5.4` (текущая версия) | Старого npm-пакета не было |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | без изменений |
 | HTTP API страницы настроек | `/plugins/dsh-grok-build/*` | без изменений |
@@ -36,14 +36,16 @@
 - 🔑 **Локальный OAuth, без вставки ключа** — авторизация в странице настроек или CLI; токены никогда не попадают в чат.
 - 🧩 **Один плагин, пять провайдеров** — Grok Build, Codex, Kimi, Claude и Google Antigravity.
 - 🛡️ **Безопасность по замыслу** — файлы учётных данных только-владелец `0600`, атомарная запись, межпроцессная блокировка файла.
-- ⚙️ **Динамический каталог** — селектор моделей показывает ровно те провайдеры, которые вы авторизовали.
+- ⚙️ **Динамический каталог** — селектор показывает только авторизованные маршруты с пометкой `(OAuth)`, включая `xhigh` для grok-4.6.
 - 🌐 **С учётом прокси** — проксируется только проверенные доверенные домены подписок.
+- 📥 **Ручной CLI Pull** — настройки обнаруживают разрешённые официальные OAuth-файлы CLI Grok/Codex/Kimi/Claude только для чтения; вы забираете одностороннюю копию после предпросмотра и подтверждения перезаписи.
+- 🗂️ **Настройки во вкладках** — Accounts, Gateway, Capabilities и About; на удалённых хостах предпочтителен device code и меньше шума CLI missing; вошедшие карточки свёрнуты, пока их не развернёшь.
+- 🎛️ **Опциональные возможности, по умолчанию выключены** — поиск Codex, использование/квота, генерация/редактирование изображений, Fast и Grok Imagine применяются сразу при включении.
 - 🔌 **Локальный API-шлюз по opt-in** — по умолчанию выключенный loopback-сервер, совместимый с OpenAI/Anthropic; для ваших собственных инструментов, а не публичный relay.
 
 ## Какие проблемы подключения закрывает этот плагин
 
 Обычно сюда приходят по этим поисковым запросам и ошибкам DSH.
-
 | Искали / увидели | Что на самом деле сломано | Что делает плагин |
 |---|---|---|
 | SuperGrok / X Premium в DSH, Grok Build vs `api.x.ai` | Встроенный маршрут `xai` — это pay-as-you-go API. Подписка ходит на `cli-chat-proxy.grok.com` | Маршрут `grok-build` + отпечаток CLI (`X-XAI-Token-Auth` и др.), чтобы не ловить тихий 403 |
@@ -71,7 +73,7 @@
 
 ```bash
 # 1. установите текущую npm-версию в web-профиль
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 2. опционально — Google Antigravity (зафиксированная проверенная версия)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -85,9 +87,13 @@ systemctl --user restart dsh-web.service
 ## 📚 Содержание
 
 - [Смена имени](#смена-имени)
+- [Возможности](#-возможности)
 - [Какие проблемы подключения закрывает этот плагин](#какие-проблемы-подключения-закрывает-этот-плагин)
+- [Поддерживаемые провайдеры](#поддерживаемые-провайдеры)
+- [Быстрый старт](#-быстрый-старт)
 - [Установка](#установка)
 - [Страница настроек](#страница-настроек)
+- [Дополнительные возможности](#дополнительные-возможности)
 - [Локальный API-шлюз](#локальный-api-шлюз)
 - [CLI](#cli)
 - [Kimi в Китае](#kimi-в-китае)
@@ -98,6 +104,7 @@ systemctl --user restart dsh-web.service
 - [Технические заметки](#технические-заметки)
 - [Соответствие](#соответствие)
 - [Документация](#документация)
+- [Связанное](#связанное)
 - [Участие](#участие)
 - [Лицензия](#лицензия)
 
@@ -107,7 +114,7 @@ systemctl --user restart dsh-web.service
 
 ```bash
 # текущая npm-версия (рекомендуется)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # разработка/альтернатива: из GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -134,6 +141,25 @@ pnpm run smoke:deployed             # реальные вызовы Codex/Kimi +
 
 Откройте **Settings → Coding OAuth**:
 
+
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_accounts.png"><img src="media/settings_accounts.png" alt="Coding OAuth Accounts tab" width="280" /></a><br />
+      <sub>Accounts</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_gateway.png"><img src="media/settings_gateway.png" alt="Coding OAuth Gateway tab" width="280" /></a><br />
+      <sub>Gateway</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_capabilities.png"><img src="media/settings_capabilities.png" alt="Coding OAuth Capabilities tab" width="280" /></a><br />
+      <sub>Capabilities</sub>
+    </td>
+  </tr>
+</table>
+
 | Провайдер | Методы |
 |---|---|
 | Grok | код авторизации · код устройства · импорт CLI Grok · выбор моделей |
@@ -201,16 +227,16 @@ OAuth подписки Kimi Code использует `https://auth.kimi.com`;
 
 OAuth access token обновляется **за пять минут** до сохранённого срока (pi-ai 0.84+). Если апстрим всё же отклоняет локально ещё живой токен кодом 401/403, плагин сдвигает сохранённый `expires` в прошлое, и повторный шаг сначала обновляет токен, затем повторяет запрос.
 
-Повторы идут по политике harness: временные сбои (`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`) **и `AUTH`** повторяются с экспоненциальной задержкой (2 попытки, 500 мс → 10 с, 10% jitter). Исчерпание квоты и мёртвый refresh token **не** повторяются. Переопределение для развёртывания:
+Повторы идут по политике harness: временные сбои (`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`) **и `AUTH`** повторяются с экспоненциальной задержкой (5 попыток, 5 с → 10 с → 20 с → 40 с → 80 с (~155 с суммарно), 10% jitter). Исчерпание квоты и мёртвый refresh token **не** повторяются. Переопределение для развёртывания:
 
 ```yaml
 - id: llm-grok-build-oauth
   config:
     retryPolicy:
       mode: normal
-      maxRetries: 2
+      maxRetries: 5
       retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, AUTH]
-      backoff: { initialDelayMs: 500, maxDelayMs: 10000, jitterRatio: 0.1 }
+      backoff: { initialDelayMs: 5000, maxDelayMs: 80000, jitterRatio: 0.1 }
 ```
 
 ## Учётные данные

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.5.2** · 原名 `dsh-grok-build`
+**v0.5.4** · 原名 `dsh-grok-build`
 
 **面向 [DeepSeek Harness](https://github.com/deepseek-ai/dsh) 的编码订阅 OAuth 插件。** 把 SuperGrok / X Premium（Grok Build）、ChatGPT Plus/Pro（Codex）、Kimi Code、Claude Pro/Max 和 Google Antigravity 接到 DSH——不必再开一份按量 API-key，**也不要把 token 粘贴进聊天。**
 
@@ -23,8 +23,8 @@
 
 | | 请用这个 | 仍然可用 |
 |---|---|---|
-| npm（推荐） | 当前版本是 `0.5.2`：`dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2` | 没有发布过旧 npm 包 |
-| GitHub / 开发安装 | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build`（同一条 `main`） |
+| npm（推荐） | 当前版本是 `0.5.4`：`dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4` | 没有发布过旧 npm 包 |
+| GitHub / 开发安装 | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | 旧仓库 `dsh-grok-build` 已删除 |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis 插件 id | `llm-grok-build-oauth` | 不变 |
 | 设置页 HTTP API | `/plugins/dsh-grok-build/*` | 不变 |
@@ -32,14 +32,14 @@
 
 ## ✨ 特性
 
-- 🧾 **自带订阅** —— SuperGrok、ChatGPT Plus/Pro、Kimi Code、Claude Pro/Max，不必另开按量 API-key。
+- 🧳 **自带订阅** —— SuperGrok、ChatGPT Plus/Pro、Kimi Code、Claude Pro/Max，不必另开按量 API-key。
 - 🔑 **本地 OAuth，不用贴 key** —— 在设置页或 CLI 完成授权；access/refresh token 不进聊天、日志和 HTTP 状态。
 - 🧩 **一个插件，五大供应商** —— Grok Build（`cli-chat-proxy.grok.com`）、Codex、Kimi Code、Claude Code 与 Google Antigravity。
 - 🛡️ **安全设计** —— 凭据文件均为 owner-only `0600`、原子写、跨进程文件锁。
 - ⚙️ **动态目录** —— 选择器只列出已登录路由并标注 `(OAuth)`，含 grok-4.6 的 `xhigh`。
 - 🌐 **代理感知** —— 只代理审核过的订阅域名；Kimi 中国流量默认直连。
 - 📥 **手动 CLI 拉取** —— 设置页只读发现白名单内的官方 Grok/Codex/Kimi/Claude CLI OAuth 文件；预览并确认覆盖后，单向拉取一份副本。
-- 🗂️ **分栏设置页** —— Accounts、Gateway、Capabilities、About 四个顶部标签替代漫长瀑布流；已登录供应商卡片默认收起，展开后再编辑。
+- 🗂️ **分栏设置页** —— Accounts、Gateway、Capabilities、About；远程主机优先设备码登录并弱化 CLI 缺失提示；已登录供应商卡片默认收起，展开后再编辑。
 - 🎛️ **可选能力默认关闭** —— Codex 搜索、用量/配额、图像生成/编辑、Fast、Grok Imagine 打开后立即生效。
 - 🔌 **可选本地 API 网关** —— 默认关闭的 loopback OpenAI/Anthropic 兼容服务，支持复制 base URL 和 Bearer key，只给你自己的工具用，不是公网中继。
 
@@ -75,7 +75,7 @@
 
 ```bash
 # 1. 安装当前 npm 发布版到 web profile
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 2. 可选 —— Google Antigravity（固定审核过的版本）
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -89,7 +89,10 @@ systemctl --user restart dsh-web.service
 ## 📚 目录
 
 - [项目更名](#项目更名)
+- [特性](#-特性)
 - [本插件解决的接入问题](#本插件解决的接入问题)
+- [支持的供应商](#支持的供应商)
+- [快速开始](#-快速开始)
 - [安装](#安装)
 - [设置页](#设置页)
 - [可选能力](#可选能力)
@@ -103,6 +106,7 @@ systemctl --user restart dsh-web.service
 - [技术方案](#技术方案)
 - [合规](#合规)
 - [文档](#文档)
+- [相关项目](#相关项目)
 - [贡献](#贡献)
 - [许可证](#许可证)
 
@@ -112,7 +116,7 @@ systemctl --user restart dsh-web.service
 
 ```bash
 # 当前 npm 版本
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.2
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.4
 
 # 开发 / 备用：从 GitHub 安装
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -121,7 +125,7 @@ dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
 # dsh plugin --profile web add ./dsh-coding-subscription-oauth
 ```
 
-安装后重启 `dsh web`。对实际部署的验证：
+安装后重启 `dsh web`。维护者可在源码 checkout 中对实际部署做验证（npm 安装不包含这些脚本）：
 
 ```bash
 pnpm run verify:deployed            # 核对真实 /api/llm.models 与 OAuth 状态
@@ -137,7 +141,24 @@ pnpm run smoke:deployed             # 真实 Codex/Kimi tool-call + 第二个用
 
 ## 设置页
 
-打开 **设置 → 编码 OAuth**。页面拆成四个顶部标签：**Accounts**、**Gateway**、**Capabilities**、**About**，不再需要长距离滚动。已登录供应商卡片默认折叠，展开后可编辑模型或使用卡片内的 CLI 拉取；CLI 预览占满内容宽度，Capabilities 标签还会显示实时可选开关和 Imagine 状态。
+打开 **设置 → 编码 OAuth**。页面拆成四个顶部标签：**Accounts**、**Gateway**、**Capabilities**、**About**，不再需要长距离滚动。远程（非 loopback）主机上，Accounts 会优先设备码登录，并把嘈杂的 CLI 缺失提示收成一条；已登录供应商卡片默认折叠，展开后可编辑模型或使用卡片内的 CLI 拉取；CLI 预览占满内容宽度，Capabilities 标签还会显示实时可选开关和 Imagine 状态。
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_accounts.png"><img src="media/settings_accounts.png" alt="编码 OAuth · Accounts 标签" width="280" /></a><br />
+      <sub>Accounts</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_gateway.png"><img src="media/settings_gateway.png" alt="编码 OAuth · Gateway 标签" width="280" /></a><br />
+      <sub>Gateway</sub>
+    </td>
+    <td align="center" valign="top" width="33%">
+      <a href="media/settings_capabilities.png"><img src="media/settings_capabilities.png" alt="编码 OAuth · Capabilities 标签" width="280" /></a><br />
+      <sub>Capabilities</sub>
+    </td>
+  </tr>
+</table>
 
 | 供应商 | 方式 |
 |---|---|
@@ -176,7 +197,7 @@ gateway:
 
 端点：`GET /healthz`、`GET /v1/models`、`POST /v1/chat/completions`、`POST /v1/responses`、`POST /v1/messages`。Bearer key 保存在 `$DSH_HOME/.coding-oauth-gateway.json`（`0600`）。
 
-在 **Gateway** 标签中，可以复制 OpenAI base URL（例如 `http://127.0.0.1:18080/v1`）、Anthropic base URL，或直接复制当前 Bearer key，不必轮换；轮换 key 前必须确认。监听端口可直接 **Apply/确定**，也可用 **Random/随机** 填充（`18100`–`18999`）；选定端口会持久化到属主专用的网关文档，运行中的监听器会重新绑定。bind 仍只能写在 YAML 中；非 loopback bind 必须配置 key。这不是远程中继。
+在 **Gateway** 标签中，可以复制 OpenAI base URL（例如 `http://127.0.0.1:18080/v1`）、Anthropic base URL，或直接复制当前 Bearer key，不必轮换；密钥显示仅限 loopback，且不会写入浏览器存储；轮换 key 前必须确认。监听端口可直接 **Apply/确定**，也可用 **Random/随机** 填充（`18100`–`18999`）；选定端口会持久化到属主专用的网关文档，运行中的监听器会重新绑定。bind 仍只能写在 YAML 中；非 loopback bind 必须配置 key。这不是远程中继。
 
 ## CLI
 
@@ -216,16 +237,16 @@ Kimi Code 订阅 OAuth 使用 `https://auth.kimi.com`；推理使用 `https://ap
 
 OAuth access token 会在本地记录过期时间前 **5 分钟**主动刷新（pi-ai 0.84+），避免请求踩到令牌寿命的最后几秒。若服务端仍以 401/403 拒绝一个本地尚未过期的令牌（服务端提前吊销或时钟偏差），插件会把凭据的 `expires` 回写到过去，重试的 step 会先刷新再发请求——用户无感知自愈，而不是本轮直接失败。
 
-请求重试走 harness 的 retry 策略：瞬时故障（`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`）**以及 `AUTH`** 会按指数退避重试（默认 2 次，500 ms → 10 s，10% jitter）。配额耗尽和 refresh token 失效**不**重试——会立刻给出真实错误和重新登录提示。部署级覆盖：
+请求重试走 harness 的 retry 策略：瞬时故障（`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`/`EMPTY_RESPONSE`）**以及 `AUTH`** 会按指数退避重试（默认 5 次，5 s → 10 s → 20 s → 40 s → 80 s，约 155 s 叠加时常，10% jitter）。xAI「at capacity / high demand / priority processing」等文案会在 finish 管道重映射为 `RATE_LIMIT`，从而进入该策略（上游 `error.code: null` 时 pi-ai 会标成 `PI_AI_ERROR`）。配额耗尽和 refresh token 失效**不**重试——会立刻给出真实错误和重新登录提示。部署级覆盖：
 
 ```yaml
 - id: llm-grok-build-oauth
   config:
     retryPolicy:
       mode: normal
-      maxRetries: 2
+      maxRetries: 5
       retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, AUTH]
-      backoff: { initialDelayMs: 500, maxDelayMs: 10000, jitterRatio: 0.1 }
+      backoff: { initialDelayMs: 5000, maxDelayMs: 80000, jitterRatio: 0.1 }
 ```
 
 ## 凭据