dsh-coding-subscription-oauth 0.5.7 → 0.6.0

package/lib/invariant.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/invariant.ts"],
-  "sourcesContent": ["/**\n * Package-owned invariant companion for `dsh-coding-subscription-oauth`.\n * @module dsh-coding-subscription-oauth/invariant\n */\n\nimport type { Context } from \"@deepseek-ai/cordis\";\nimport type { InvariantInstaller } from \"@deepseek-ai/dsh-invariants\";\n\nconst PACKAGE_NAME = \"dsh-coding-subscription-oauth\";\n\nexport const name = \"grok-build-invariant\";\nexport const inject = [\"invariants\"];\n\nconst install: InvariantInstaller = () => {};\n\nexport const apply = (ctx: Context): Promise<() => void> =>\n\tPromise.resolve(ctx.invariants.register(PACKAGE_NAME, install));\n"],
+  "sourcesContent": ["/**\r\n * Package-owned invariant companion for `dsh-coding-subscription-oauth`.\r\n * @module dsh-coding-subscription-oauth/invariant\r\n */\r\n\r\nimport type { Context } from \"@deepseek-ai/cordis\";\r\nimport type { InvariantInstaller } from \"@deepseek-ai/dsh-invariants\";\r\n\r\nconst PACKAGE_NAME = \"dsh-coding-subscription-oauth\";\r\n\r\nexport const name = \"grok-build-invariant\";\r\nexport const inject = [\"invariants\"];\r\n\r\nconst install: InvariantInstaller = () => {};\r\n\r\nexport const apply = (ctx: Context): Promise<() => void> =>\r\n\tPromise.resolve(ctx.invariants.register(PACKAGE_NAME, install));\r\n"],
   "mappings": ";;;AAQA,IAAM,eAAe;AAEd,IAAM,OAAO;AACb,IAAM,SAAS,CAAC,YAAY;AAEnC,IAAM,UAA8B,MAAM;AAAC;AAEpC,IAAM,QAAQ,CAAC,QACrB,QAAQ,QAAQ,IAAI,WAAW,SAAS,cAAc,OAAO,CAAC;",
   "names": []
 }

package/lib/oauth-import-routes.d.ts

@@ -7,10 +7,8 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type OAuthImportCommitAction, type OAuthImportSessionOptions, type OAuthSourceCredential, type OAuthSourceDiscovery, type OAuthSourceKind, type OAuthSourcePathOptions } from "./oauth-sources.js";
-export declare const OAUTH_IMPORT_SOURCES_PATH = "/plugins/dsh-grok-build/oauth/sources";
-export declare const OAUTH_IMPORT_PREVIEW_PATH = "/plugins/dsh-grok-build/oauth/sources/preview";
-export declare const OAUTH_IMPORT_COMMIT_PATH = "/plugins/dsh-grok-build/oauth/sources/commit";
-export declare const OAUTH_IMPORT_CANCEL_PATH = "/plugins/dsh-grok-build/oauth/sources/cancel";
+import { type OwnerRequestPolicy } from "./web-origin.js";
+export { OAUTH_IMPORT_CANCEL_PATH, OAUTH_IMPORT_COMMIT_PATH, OAUTH_IMPORT_PREVIEW_PATH, OAUTH_IMPORT_SOURCES_PATH, } from "./ids.js";
 export interface OAuthImportRouteContext {
     webServer: {
         register(route: {
@@ -38,6 +36,7 @@ export interface OAuthImportAppliedEvent {
 }
 export interface OAuthImportRouteOptions extends OAuthImportSessionOptions, OAuthSourcePathOptions {
     onImported?: (event: OAuthImportAppliedEvent) => void | Promise<void>;
+    ownerRequestPolicy?: OwnerRequestPolicy;
 }
 export interface OAuthImportSourcesResponse {
     sources: OAuthSourceDiscovery[];

package/lib/oauth-import-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-import-routes.d.ts","sourceRoot":"","sources":["../../src/oauth-import-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EAIN,KAAK,uBAAuB,EAI5B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAGzB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,MAAM,oBAAoB,CAAC;AAK5B,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AACjF,eAAO,MAAM,yBAAyB,kDAAkD,CAAC;AACzF,eAAO,MAAM,wBAAwB,iDAAiD,CAAC;AACvF,eAAO,MAAM,wBAAwB,iDAAiD,CAAC;AAEvF,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE;QACV,QAAQ,CAAC,KAAK,EAAE;YACf,IAAI,EAAE,OAAO,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACtF,GAAG,MAAM,IAAI,CAAC;KACf,CAAC;IACF,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,GAC5F,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,sBAAsB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,2BAA2B,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG;KAAG,CAAC,IAAI,eAAe,GAAG,sBAAsB;CAAE,CAAC;AAEzF,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,EAAE,sBAAsB;IACjG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,uBAAuB,EAC5B,YAAY,EAAE,uBAAuB,EACrC,OAAO,GAAE,uBAA4B,GACnC,MAAM,IAAI,CAiGZ;AAwED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsB7D"}
+{"version":3,"file":"oauth-import-routes.d.ts","sourceRoot":"","sources":["../../src/oauth-import-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAQjE,OAAO,EAIN,KAAK,uBAAuB,EAI5B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAGzB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGzF,OAAO,EACN,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE;QACV,QAAQ,CAAC,KAAK,EAAE;YACf,IAAI,EAAE,OAAO,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACtF,GAAG,MAAM,IAAI,CAAC;KACf,CAAC;IACF,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,GAC5F,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,sBAAsB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,2BAA2B,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG;KAAG,CAAC,IAAI,eAAe,GAAG,sBAAsB;CAAE,CAAC;AAEzF,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,EAAE,sBAAsB;IACjG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,uBAAuB,EAC5B,YAAY,EAAE,uBAAuB,EACrC,OAAO,GAAE,uBAA4B,GACnC,MAAM,IAAI,CAkGZ;AAwED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsB7D"}

package/lib/proxy.d.ts

@@ -1,17 +1,4 @@
-/**
- * Scoped egress proxy for coding-subscription OAuth and inference traffic.
- * @module dsh-coding-subscription-oauth/proxy
- */
-export interface CodingOAuthProxyOptions {
-    proxyKimi?: boolean;
-}
-/** Install one process-wide dispatcher that proxies only the audited host list. */
-export declare function ensureCodingOAuthProxy(explicit?: string, options?: CodingOAuthProxyOptions): string | undefined;
-/** Backward-compatible name retained for existing callers. */
-export declare function ensureGrokBuildProxy(explicit?: string): string | undefined;
-export declare function codingOAuthProxyInEffect(): string | undefined;
-/** Appended to Grok discovery/token/catalog transport errors when a scoped proxy is installed. */
-export declare function codingOAuthProxyUnreachableHint(): string;
-/** Backward-compatible status accessor. */
-export declare function grokBuildProxyInEffect(): string | undefined;
+/** Compatibility facade for the shared process-wide coding OAuth proxy. */
+export type { CodingOAuthProxyLease, CodingOAuthProxyOptions } from "dsh-coding-oauth-core";
+export { acquireCodingOAuthProxy, codingOAuthProxyInEffect, codingOAuthProxyUnreachableHint, ensureCodingOAuthProxy, ensureGrokBuildProxy, grokBuildProxyInEffect, } from "dsh-coding-oauth-core";
 //# sourceMappingURL=proxy.d.ts.map

package/lib/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwDH,MAAM,WAAW,uBAAuB;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,GAAG,MAAM,GAAG,SAAS,CAenH;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE1E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,SAAS,CAE7D;AAED,kGAAkG;AAClG,wBAAgB,+BAA+B,IAAI,MAAM,CAExD;AAED,2CAA2C;AAC3C,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAE3D"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EACN,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,GACtB,MAAM,uBAAuB,CAAC"}

package/lib/web-origin.d.ts

@@ -1,10 +1,34 @@
 /**
- * Loopback + same-origin authorization shared by private plugin Web routes.
- * Rejecting non-loopback Host values closes DNS-rebinding access even when the
- * TCP peer itself is 127.0.0.1 or ::1.
+ * Owner-request authorization shared by private plugin Web routes.
  * @module dsh-coding-subscription-oauth/web-origin
  */
 import type { IncomingMessage } from "node:http";
-/** Authorize one browser request for owner-local exact/settings routes. */
+import type { OwnerRequestPolicy as CoreOwnerRequestPolicy } from "dsh-coding-oauth-core";
+import type { DshCompatibilityDiagnostic } from "./compatibility.js";
+export declare const OWNER_PROOF_HEADER = "x-dsh-owner-proof";
+export declare const OWNER_CSRF_HEADER = "x-dsh-csrf-token";
+export type { OwnerAccessMode } from "dsh-coding-oauth-core";
+export interface TrustedReverseProxyPolicyConfig {
+    /** Exact TCP peers allowed to inject owner-only headers. Forwarded peers never count. */
+    readonly peers?: readonly string[];
+    /** Exact browser origins allowed through the trusted proxy. */
+    readonly origins?: readonly string[];
+    /** Secret injected by the trusted proxy only after owner authentication. */
+    readonly ownerProof?: string;
+    /** Independent CSRF secret injected by the trusted proxy. */
+    readonly csrfToken?: string;
+}
+export interface OwnerRequestPolicyConfig {
+    /** Use when loopback is intentionally reached through an SSH port forward. */
+    readonly loopbackAccessMode?: "loopback" | "ssh-tunnel";
+    readonly trustedProxy?: TrustedReverseProxyPolicyConfig;
+}
+export type OwnerRequestPolicy = CoreOwnerRequestPolicy<IncomingMessage, DshCompatibilityDiagnostic>;
+/** Adapt a host-owned policy so service churn cannot escape through Web routes. */
+export declare function safeguardOwnerRequestPolicy(policy: OwnerRequestPolicy): OwnerRequestPolicy;
+/** Build an immutable owner-request policy. Partial proxy configuration is deliberately unusable. */
+export declare function createOwnerRequestPolicy(config?: OwnerRequestPolicyConfig): OwnerRequestPolicy;
+export declare const LOOPBACK_OWNER_REQUEST_POLICY: OwnerRequestPolicy;
+/** Backward-compatible loopback predicate for external callers. */
 export declare function isTrustedLoopbackWebRequest(req: IncomingMessage): boolean;
 //# sourceMappingURL=web-origin.d.ts.map

package/lib/web-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-origin.d.ts","sourceRoot":"","sources":["../../src/web-origin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,2EAA2E;AAC3E,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAezE"}
+{"version":3,"file":"web-origin.d.ts","sourceRoot":"","sources":["../../src/web-origin.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EACX,kBAAkB,IAAI,sBAAsB,EAG5C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAErE,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAEpD,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,+BAA+B;IAC/C,yFAAyF;IACzF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,+BAA+B,CAAC;CACxD;AAED,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;AAWrG,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAgC1F;AAgBD,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,MAAM,GAAE,wBAA6B,GAAG,kBAAkB,CAgDlG;AAED,eAAO,MAAM,6BAA6B,oBAA6B,CAAC;AAExE,mEAAmE;AACnE,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAEzE"}

package/lib/web-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-routes.d.ts","sourceRoot":"","sources":["../../src/web-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAC5C;AAED,6EAA6E;AAC7E,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,GACjD,MAAM,IAAI,CAqBZ;AAED,mEAAmE;AACnE,wBAAgB,2BAA2B,CAC1C,QAAQ,EAAE,sBAAsB,EAChC,MAAM,EAAE,SAAS,cAAc,EAAE,GAC/B,MAAM,IAAI,CAcZ"}
+{"version":3,"file":"web-routes.d.ts","sourceRoot":"","sources":["../../src/web-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAC5C;AAED,6EAA6E;AAC7E,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,GACjD,MAAM,IAAI,CAEZ;AAED,mEAAmE;AACnE,wBAAgB,2BAA2B,CAC1C,QAAQ,EAAE,sBAAsB,EAChC,MAAM,EAAE,SAAS,cAAc,EAAE,GAC/B,MAAM,IAAI,CAEZ"}

package/package.json

@@ -1,186 +1,223 @@
-{
-  "name": "dsh-coding-subscription-oauth",
-  "description": "DeepSeek Harness coding-subscription OAuth: SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code, Claude Code. Fixes AUTH API key is invalid, INVALID_REPLAY_STATE, grok-4.6 xhigh, Kimi Bearer vs x-api-key.",
-  "version": "0.5.7",
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org/"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/lninghaha/dsh-coding-subscription-oauth.git"
-  },
-  "bugs": "https://github.com/lninghaha/dsh-coding-subscription-oauth/issues",
-  "homepage": "https://github.com/lninghaha/dsh-coding-subscription-oauth#readme",
-  "keywords": [
-    "deepseek-harness",
-    "dsh-plugin",
-    "oauth",
-    "grok-build",
-    "super-grok",
-    "grok-4.6",
-    "cli-chat-proxy",
-    "openai-codex",
-    "chatgpt-plus",
-    "kimi-code",
-    "claude-code",
-    "google-antigravity",
-    "xhigh",
-    "device-code"
-  ],
-  "type": "module",
-  "packageManager": "pnpm@11.21.0",
-  "engines": {
-    "node": "^22.19.0 || >=24.0.0"
-  },
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "bin": {
-    "dsh-coding-oauth": "lib/bin.js",
-    "dsh-grok-build": "lib/bin.js"
-  },
+{
+  "name": "dsh-coding-subscription-oauth",
+  "description": "DeepSeek Harness coding-subscription OAuth: SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code, Claude Code. Fixes AUTH API key is invalid, INVALID_REPLAY_STATE, grok-4.6 xhigh, Kimi Bearer vs x-api-key.",
+	"version": "0.6.0",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lninghaha/dsh-coding-subscription-oauth.git"
+  },
+  "bugs": "https://github.com/lninghaha/dsh-coding-subscription-oauth/issues",
+  "homepage": "https://github.com/lninghaha/dsh-coding-subscription-oauth#readme",
+  "keywords": [
+    "deepseek-harness",
+    "dsh-plugin",
+    "oauth",
+    "grok-build",
+    "super-grok",
+    "grok-4.6",
+    "cli-chat-proxy",
+    "openai-codex",
+    "chatgpt-plus",
+    "kimi-code",
+    "claude-code",
+    "google-antigravity",
+    "xhigh",
+    "device-code"
+  ],
+  "type": "module",
+  "packageManager": "pnpm@11.21.0",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "bin": {
+    "dsh-coding-oauth": "lib/bin.js",
+    "dsh-grok-build": "lib/bin.js"
+  },
   "scripts": {
-    "clean": "node build/clean.mjs",
-    "typecheck": "tsc -b tsconfig.host.json tsconfig.client.json",
-    "build:server": "tsc -p tsconfig.build.json && tsc -p tsconfig.dts-bin.json && node build/build-server.mjs",
-    "build:client": "node build/build-client.mjs",
-    "build:artifacts": "pnpm run clean && pnpm run typecheck && pnpm run build:server && pnpm run build:client",
-    "build": "pnpm run release:build",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "lint": "biome check",
-    "check:next": "pnpm run lint && pnpm run typecheck && pnpm run test",
-    "check": "pnpm run lint && pnpm run release:build && pnpm run test",
-    "release:promote": "node build/promote-release.mjs",
-    "release:verify": "node build/verify-release.mjs",
-    "release:build": "pnpm run build:artifacts && pnpm run release:promote",
-    "release:dry": "node scripts/release.mjs --dry-run",
-    "release:pack": "node scripts/release.mjs --pack",
-    "verify:deployed": "node scripts/verify-deployed-catalog.mjs",
-    "smoke:deployed": "node scripts/smoke-deployed-routes.mjs",
-    "prepack": "pnpm run release:build"
-  },
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./invariant": {
-      "types": "./lib/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
-    "./client": "./lib/client.js",
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "src",
-    "media",
-    "cordis.patch.yml",
-    "INSTALL.md",
-    "CHANGELOG.md",
-    "CONTRIBUTING.md",
-    "docs/00-project-rules.md",
+    "check:bom": "node build/verify-dsh-bom.mjs",
+    "clean": "node build/clean.mjs",
+    "typecheck": "tsc -b tsconfig.host.json tsconfig.client.json",
+    "build:server": "tsc -p tsconfig.build.json && tsc -p tsconfig.dts-bin.json && node build/build-server.mjs",
+    "build:client": "node build/build-client.mjs",
+    "build:artifacts": "pnpm run check:bom && pnpm run clean && pnpm run typecheck && pnpm run build:server && pnpm run build:client",
+    "build": "pnpm run release:build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "biome check",
+    "check:next": "pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
+    "check": "pnpm run lint && pnpm run release:build && pnpm run test",
+    "release:promote": "node build/promote-release.mjs",
+    "release:verify": "node build/verify-release.mjs",
+    "release:build": "pnpm run build:artifacts && pnpm run release:promote",
+    "release:dry": "node scripts/release.mjs --dry-run",
+    "release:pack": "node scripts/release.mjs --pack",
+    "verify:deployed": "node scripts/verify-deployed-catalog.mjs",
+    "smoke:deployed": "node scripts/smoke-deployed-routes.mjs",
+    "prepack": "pnpm run release:build"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "media",
+    "cordis.patch.yml",
+    "INSTALL.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "docs/00-project-rules.md",
     "docs/02-architecture.md",
     "docs/02-architecture.zh-CN.md",
-    "README.zh-CN.md",
-    "README.ja.md",
-    "README.ko.md",
-    "README.pt-BR.md",
-    "README.es.md",
-    "README.fr.md",
-    "README.de.md",
-    "README.ru.md",
-    "patches/dsh-agy@0.1.2.patch",
-    "scripts/verify-deployed-catalog.mjs",
-    "scripts/smoke-deployed-routes.mjs",
-    "scripts/release.mjs",
-    "LICENSE",
-    "NOTICE"
-  ],
-  "license": "Apache-2.0",
+    "compatibility/dsh-bom.json",
+    "README.zh-CN.md",
+    "README.ja.md",
+    "README.ko.md",
+    "README.pt-BR.md",
+    "README.es.md",
+    "README.fr.md",
+    "README.de.md",
+    "README.ru.md",
+    "patches/dsh-agy@0.1.2.patch",
+    "scripts/verify-deployed-catalog.mjs",
+    "scripts/smoke-deployed-routes.mjs",
+    "scripts/release.mjs",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "license": "Apache-2.0",
   "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
+    "compatibility": {
+      "coreAbi": "dsh-coding-oauth-core/v1",
+      "verifiedBom": "./compatibility/dsh-bom.json",
+      "participant": "coding-subscription-oauth",
+      "diagnostics": "standalone",
+      "bom": {
+        "@deepseek-ai/cordis": "4.0.1",
+        "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-client-web": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+        "@deepseek-ai/schemastery": "3.18.1",
+        "@earendil-works/pi-ai": "0.84.2",
+        "react": "18.3.1",
+        "react-dom": "18.3.1"
+      }
     },
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-runtime",
-        "@deepseek-ai/dsh-client-ui-settings",
-        "@deepseek-ai/dsh-client-locale"
-      ],
-      "platform": "web"
-    }
-  },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-locale"
+      ],
+      "platform": "web"
+    }
+  },
   "dependencies": {
+	"dsh-coding-oauth-core": "0.1.0",
     "undici": "^7.24.8"
   },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1-rc.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-attachment": "*",
-    "@deepseek-ai/dsh-credentials": "*",
-    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "*",
-    "@deepseek-ai/dsh-invariants": "*",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "*",
-    "@deepseek-ai/schemastery": "3.18.1",
-    "@earendil-works/pi-ai": "0.84.2",
-    "react": "^18.2.0"
-  },
-  "peerDependenciesMeta": {
-    "@deepseek-ai/cordis": {
-      "optional": true
-    },
-    "@deepseek-ai/dsh-attachment": {
-      "optional": true
-    },
-    "@deepseek-ai/dsh-credentials": {
-      "optional": true
-    },
-    "@deepseek-ai/dsh-host-webserver": {
-      "optional": true
-    },
-    "@deepseek-ai/dsh-invariants": {
-      "optional": true
-    },
-    "@deepseek-ai/dsh-tools": {
-      "optional": true
-    },
-    "react": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^2.5.8",
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
     "@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
     "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
     "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
     "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
     "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "3.18.1",
-    "@earendil-works/pi-ai": "0.84.2",
-    "@types/node": "^22.20.0",
+    "@deepseek-ai/schemastery": "3.18.1",
+    "@earendil-works/pi-ai": "0.84.2",
+    "react": "18.3.1",
+    "react-dom": "18.3.1"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-attachment": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-credentials": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-host-webserver": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-invariants": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tools": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.8",
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-web": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": "3.18.1",
+    "@earendil-works/pi-ai": "0.84.2",
+    "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
-    "esbuild": "^0.28.2",
-    "react": "^18.2.0",
-    "typescript": "^6.0.3",
-    "undici": "^7.24.8",
-    "vitest": "^4.1.8"
-  },
-  "overrides": {
-    "@earendil-works/pi-ai": "0.84.2"
-  }
-}
+    "@types/react-dom": "18.3.7",
+    "esbuild": "^0.28.2",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "typescript": "^6.0.3",
+    "undici": "^7.24.8",
+    "vitest": "^4.1.8"
+  },
+  "overrides": {
+    "@earendil-works/pi-ai": "0.84.2"
+  }
+}

package/patches/dsh-agy@0.1.2.patch

@@ -1,25 +1,25 @@
-diff --git a/lib/plugin-common-YSDKp1DG.mjs b/lib/plugin-common-YSDKp1DG.mjs
-index 3bd4405d9010705cdbfb675e62538645c4af5321..aeb9dd8375ac4dfc0376b525f44e4cf8eba67719 100644
---- a/lib/plugin-common-YSDKp1DG.mjs
-+++ b/lib/plugin-common-YSDKp1DG.mjs
-@@ -135,12 +135,17 @@ var AgyAdapter = class extends LlmAdapter {
- 	providerInfo(_provider) {
- 		return {
- 			id: "agy",
--			name: "Antigravity (agy)"
-+			name: "Google Antigravity (OAuth)"
- 		};
- 	}
- 	async listModels(_provider) {
--		const session = await this.options.getSession();
--		return listAgyModels(session?.auth.access, session?.account.projectId);
-+		try {
-+			const session = await this.options.getSession();
-+			if (!session) return [];
-+			return listAgyModels(session.auth.access, session.account.projectId);
-+		} catch {
-+			return [];
-+		}
- 	}
- 	async resolveModel(provider, model) {
- 		return resolveAgyModel(provider, model);
+diff --git a/lib/plugin-common-YSDKp1DG.mjs b/lib/plugin-common-YSDKp1DG.mjs
+index 3bd4405d9010705cdbfb675e62538645c4af5321..aeb9dd8375ac4dfc0376b525f44e4cf8eba67719 100644
+--- a/lib/plugin-common-YSDKp1DG.mjs
++++ b/lib/plugin-common-YSDKp1DG.mjs
+@@ -135,12 +135,17 @@ var AgyAdapter = class extends LlmAdapter {
+ 	providerInfo(_provider) {
+ 		return {
+ 			id: "agy",
+-			name: "Antigravity (agy)"
++			name: "Google Antigravity (OAuth)"
+ 		};
+ 	}
+ 	async listModels(_provider) {
+-		const session = await this.options.getSession();
+-		return listAgyModels(session?.auth.access, session?.account.projectId);
++		try {
++			const session = await this.options.getSession();
++			if (!session) return [];
++			return listAgyModels(session.auth.access, session.account.projectId);
++		} catch {
++			return [];
++		}
+ 	}
+ 	async resolveModel(provider, model) {
+ 		return resolveAgyModel(provider, model);