dsh-coding-subscription-oauth 0.6.4 → 0.7.0

package/src/adapter.ts

@@ -1,348 +0,0 @@
-/** Coding-subscription adapter assembled from public dsh-llm-pi-ai extension points. */
-
-import type { AttachmentStore } from "@deepseek-ai/dsh-attachment";
-import type { RetryPolicyConfig } from "@deepseek-ai/dsh-llm";
-import { type LlmAdapter, LlmError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
-import type { PiAiAdapterOptions, ResolvedPiAiProviderProfile } from "@deepseek-ai/dsh-llm-pi-ai";
-import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
-import type { AliasLlmRoutePolicy } from "./alias-adapter.ts";
-import { AliasLlmAdapter } from "./alias-adapter.ts";
-import { preferredGrokBuildModelFrom } from "./catalog.ts";
-import { withCodexFastRouting } from "./codex-model-capabilities.ts";
-import {
-	CLAUDE_CODE_OAUTH_ROUTE,
-	CLAUDE_PI_PROVIDER,
-	CODEX_OAUTH_FAST_ROUTE,
-	CODEX_OAUTH_ROUTE,
-	CODEX_PI_PROVIDER,
-	DEFAULT_GROK_BUILD_MODEL,
-	GROK_BUILD_ROUTE,
-	GROK_BUILD_STREAM_IDLE_TIMEOUT_MS,
-	KIMI_CODE_OAUTH_ROUTE,
-	KIMI_PI_PROVIDER,
-	XAI_PI_PROVIDER,
-} from "./ids.ts";
-import type { OAuthProviderSession } from "./oauth-session.ts";
-import { grokBuildBaselineModels, grokBuildFingerprintHeaders } from "./provider.ts";
-import { safeMessage } from "./redact.ts";
-import type { GrokBuildSession } from "./session.ts";
-
-type PiAiAuthInjection = PiAiAdapterOptions["auth"];
-type PiAiCredentialStore = PiAiAuthInjection["credentials"];
-
-const REQUEST_IMAGE_POLICY = {
-	maxRequestImageBytes: 20 * 1024 * 1024,
-	requestImagePixelBudget: 2048 * 2048,
-	requestImageMaxBytes: 1024 * 1024,
-} as const;
-
-/**
- * Route pi-ai credential operations to the already owner-locked OAuth files.
- * The adapter may ask its collection about every profile, so an unknown id is
- * never allowed to reach a writable store. Reads are empty and writes fail
- * closed, preserving the existing per-provider refresh lock and file policy.
- */
-function oauthAuthInjection(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[]): PiAiAuthInjection {
-	const stores = new Map<string, PiAiCredentialStore>([
-		[XAI_PI_PROVIDER, grok.store],
-		...subscriptions.map((session) => [session.definition.nativeProviderId, session.store] as const),
-	]);
-	const storeFor = (providerId: string): PiAiCredentialStore | undefined => stores.get(providerId);
-	return {
-		credentials: {
-			async read(providerId, options) {
-				return storeFor(providerId)?.read(providerId, options);
-			},
-			async list(options) {
-				const entries = await Promise.all([...stores.values()].map((store) => store.list(options)));
-				return entries.flat();
-			},
-			async modify(providerId, fn, options) {
-				const store = storeFor(providerId);
-				if (store === undefined)
-					throw new Error(`refusing credential write for unknown OAuth provider "${providerId}"`);
-				return store.modify(providerId, fn, options);
-			},
-			async delete(providerId, options) {
-				const store = storeFor(providerId);
-				if (store === undefined)
-					throw new Error(`refusing credential deletion for unknown OAuth provider "${providerId}"`);
-				await store.delete(providerId, options);
-			},
-		},
-		authContext: {
-			// Subscription adapters obtain request credentials only from their
-			// owner-scoped stores. Do not let a foreign environment/file credential
-			// silently change a selected OAuth route.
-			env: async () => undefined,
-			fileExists: async () => false,
-		},
-	};
-}
-
-/** Prefer grok-4.6 when the current (live or baseline) list has it. */
-export function preferredGrokBuildModel(models: readonly { id: string }[] = grokBuildBaselineModels()): string {
-	return preferredGrokBuildModelFrom(models.length === 0 ? [{ id: DEFAULT_GROK_BUILD_MODEL }] : models);
-}
-
-function missingCredential(name: string): never {
-	throw new LlmError(
-		`${name} is not signed in. Open Settings → Coding OAuth and sign in with your subscription.`,
-		"MISSING_CREDENTIAL",
-	);
-}
-
-/**
- * Minimum remaining validity demanded of an exported OAuth access token.
- * pi-ai 0.84+ already refreshes five minutes before the stored expiry; this
- * explicit floor documents the plugin contract and hard-fails a refresh that
- * returns an even-shorter-lived token instead of handing it to a request.
- */
-const MIN_OAUTH_VALIDITY_MS = 60_000;
-
-/**
- * Provider retry policy for the coding-subscription routes. The harness
- * default retryable set (EMPTY_RESPONSE/RATE_LIMIT/SERVER/TIMEOUT/TRANSPORT)
- * deliberately excludes AUTH, so an upstream 401 — e.g. an access token the
- * server revoked before its local expiry — used to kill the turn outright.
- * AUTH is added here because {@link AliasLlmAdapter} invalidates the stored
- * credential on every AUTH finish, so the retried step refreshes first and
- * does not repeat the same rejected token. Quota exhaustion stays outside the
- * set: retrying a billing-limit 403 cannot succeed and only delays the real
- * message. Genuine credential death is converted to MISSING_CREDENTIAL (not
- * retryable) by the resolver below, so it cannot loop either.
- *
- * Five stacked exponential delays (5s → 10s → 20s → 40s → 80s, ~155s total)
- * pair with the xAI capacity remap in {@link AliasLlmAdapter}: "at capacity"
- * finish errors become RATE_LIMIT so they enter this policy instead of failing
- * as PI_AI_ERROR.
- */
-const CODING_OAUTH_RETRY_POLICY = {
-	mode: "normal" as const,
-	maxRetries: 5,
-	retryableCodes: ["EMPTY_RESPONSE", "RATE_LIMIT", "SERVER", "TIMEOUT", "TRANSPORT", "AUTH"],
-	backoff: { initialDelayMs: 5_000, maxDelayMs: 80_000, jitterRatio: 0.1 },
-};
-
-function profile(
-	provider: string,
-	displayName: string,
-	piProvider: ResolvedPiAiProviderProfile["piProvider"],
-	retryPolicy?: RetryPolicyConfig | undefined,
-	headers?: Record<string, string> | undefined,
-): ResolvedPiAiProviderProfile {
-	return {
-		provider,
-		displayName,
-		streamIdleTimeoutMs: GROK_BUILD_STREAM_IDLE_TIMEOUT_MS,
-		retryPolicy: resolveRetryPolicy(
-			retryPolicy ?? CODING_OAUTH_RETRY_POLICY,
-			"dsh-coding-subscription-oauth retryPolicy",
-		),
-		configuredMaxTokens: new Map(),
-		...REQUEST_IMAGE_POLICY,
-		...(headers === undefined ? {} : { headers }),
-		piProvider,
-	};
-}
-
-/** Existing Grok-only constructor retained for public API compatibility. */
-export function createGrokBuildAdapter(
-	session: GrokBuildSession,
-	resolveAttachments: () => AttachmentStore | undefined,
-): PiAiAdapter {
-	return new PiAiAdapter({
-		profiles: () =>
-			new Map<string, ResolvedPiAiProviderProfile>([
-				[
-					GROK_BUILD_ROUTE,
-					profile(GROK_BUILD_ROUTE, "xAI Grok Build", session.provider(), undefined, grokBuildFingerprintHeaders()),
-				],
-			]),
-		resolveApiKey: async () =>
-			resolveOAuthToken("Grok Build", async () => {
-				const auth = await session.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
-				return auth?.auth.apiKey;
-			}),
-		auth: oauthAuthInjection(session, []),
-		resolveAttachments,
-	});
-}
-
-/** Opt-in Codex Fast wiring; ordinary `codex-oauth` is unchanged when this is omitted. */
-export interface CodingOAuthAdapterOptions {
-	retryPolicy?: RetryPolicyConfig;
-	codexFast?: { isEligible(modelId: string): boolean };
-}
-
-function isRetryPolicyConfig(value: object): value is RetryPolicyConfig {
-	return "mode" in value;
-}
-
-function splitCodingOAuthAdapterArgs(
-	fourth?: RetryPolicyConfig | CodingOAuthAdapterOptions,
-	fifth?: CodingOAuthAdapterOptions,
-): CodingOAuthAdapterOptions {
-	if (fifth !== undefined) {
-		return {
-			...(fourth !== undefined && isRetryPolicyConfig(fourth) ? { retryPolicy: fourth } : {}),
-			...fifth,
-		};
-	}
-	if (fourth === undefined) return {};
-	if (isRetryPolicyConfig(fourth)) return { retryPolicy: fourth };
-	return {
-		...(fourth.retryPolicy === undefined ? {} : { retryPolicy: fourth.retryPolicy }),
-		...(fourth.codexFast === undefined ? {} : { codexFast: fourth.codexFast }),
-	};
-}
-
-/** Create the four-route OAuth adapter while preserving each pi-ai native id. */
-export function createCodingOAuthAdapter(
-	grok: GrokBuildSession,
-	subscriptions: readonly OAuthProviderSession[],
-	resolveAttachments: () => AttachmentStore | undefined,
-	retryPolicy?: RetryPolicyConfig,
-	options?: CodingOAuthAdapterOptions,
-): LlmAdapter;
-export function createCodingOAuthAdapter(
-	grok: GrokBuildSession,
-	subscriptions: readonly OAuthProviderSession[],
-	resolveAttachments: () => AttachmentStore | undefined,
-	options?: CodingOAuthAdapterOptions,
-): LlmAdapter;
-export function createCodingOAuthAdapter(
-	grok: GrokBuildSession,
-	subscriptions: readonly OAuthProviderSession[],
-	resolveAttachments: () => AttachmentStore | undefined,
-	retryPolicyOrOptions?: RetryPolicyConfig | CodingOAuthAdapterOptions,
-	options?: CodingOAuthAdapterOptions,
-): LlmAdapter {
-	const { retryPolicy, codexFast } = splitCodingOAuthAdapterArgs(retryPolicyOrOptions, options);
-	const byNativeId = new Map(subscriptions.map((session) => [session.definition.nativeProviderId, session]));
-	const codexSession = byNativeId.get(CODEX_PI_PROVIDER);
-	const aliases = new Map<string, string>([
-		[GROK_BUILD_ROUTE, GROK_BUILD_ROUTE],
-		[CODEX_OAUTH_ROUTE, CODEX_PI_PROVIDER],
-		[KIMI_CODE_OAUTH_ROUTE, KIMI_PI_PROVIDER],
-		[CLAUDE_CODE_OAUTH_ROUTE, CLAUDE_PI_PROVIDER],
-	]);
-	if (codexFast !== undefined && codexSession !== undefined) {
-		aliases.set(CODEX_OAUTH_FAST_ROUTE, CODEX_OAUTH_FAST_ROUTE);
-	}
-	const policies = new Map<string, AliasLlmRoutePolicy>([
-		[
-			GROK_BUILD_ROUTE,
-			{
-				displayName: "xAI Grok Build (OAuth)",
-				isAuthenticated: async () => (await grok.store.read(XAI_PI_PROVIDER))?.type === "oauth",
-				onAuthFailure: () => grok.invalidateAccessToken(),
-			},
-		],
-	]);
-	for (const session of subscriptions) {
-		policies.set(session.definition.route, {
-			displayName: `${session.definition.displayName.replace(/\s*\([^)]*\)$/u, "")} (OAuth)`,
-			isAuthenticated: async () => (await session.status()).authenticated,
-			onAuthFailure: () => session.invalidateAccessToken(),
-		});
-	}
-	if (codexFast !== undefined && codexSession !== undefined) {
-		policies.set(CODEX_OAUTH_FAST_ROUTE, {
-			displayName: "OpenAI Codex Fast requested (OAuth)",
-			isAuthenticated: async () => (await codexSession.status()).authenticated,
-			includeModel: (modelId) => codexFast.isEligible(modelId),
-			onAuthFailure: () => codexSession.invalidateAccessToken(),
-		});
-	}
-
-	const inner = new PiAiAdapter({
-		profiles: () => {
-			const profiles = new Map<string, ResolvedPiAiProviderProfile>();
-			profiles.set(
-				GROK_BUILD_ROUTE,
-				profile(GROK_BUILD_ROUTE, "xAI Grok Build", grok.provider(), retryPolicy, grokBuildFingerprintHeaders()),
-			);
-			for (const session of subscriptions) {
-				profiles.set(
-					session.definition.nativeProviderId,
-					profile(session.definition.nativeProviderId, session.definition.displayName, session.provider(), retryPolicy),
-				);
-			}
-			if (codexFast !== undefined && codexSession !== undefined) {
-				const wrapped = withCodexFastRouting(codexSession.provider(), {
-					isEligible: (modelId) => codexFast.isEligible(modelId),
-					profileProviderId: CODEX_OAUTH_FAST_ROUTE,
-					nativeProviderId: CODEX_PI_PROVIDER,
-				});
-				// Models.streamSimple dispatches on model.provider. Advertise the Fast
-				// profile id on the catalog so the wrapper runs, then restore native
-				// identity inside withCodexFastRouting before the wire call.
-				const fastProvider = {
-					...wrapped,
-					getModels: () =>
-						wrapped
-							.getModels()
-							.map((model) =>
-								model.provider === CODEX_OAUTH_FAST_ROUTE ? model : { ...model, provider: CODEX_OAUTH_FAST_ROUTE },
-							),
-				};
-				profiles.set(
-					CODEX_OAUTH_FAST_ROUTE,
-					profile(
-						CODEX_OAUTH_FAST_ROUTE,
-						"OpenAI Codex Fast requested",
-						fastProvider as unknown as ResolvedPiAiProviderProfile["piProvider"],
-						retryPolicy,
-					),
-				);
-			}
-			return profiles;
-		},
-		resolveApiKey: async (provider) => {
-			if (provider === GROK_BUILD_ROUTE) {
-				return resolveOAuthToken("Grok Build", async () => {
-					const auth = await grok.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
-					return auth?.auth.apiKey;
-				});
-			}
-			const session =
-				provider === CODEX_OAUTH_FAST_ROUTE ? byNativeId.get(CODEX_PI_PROVIDER) : byNativeId.get(provider);
-			if (session === undefined) throw new LlmError(`Unknown OAuth provider "${provider}"`, "NO_ADAPTER");
-			return resolveOAuthToken(session.definition.displayName, () => session.resolveAccessToken());
-		},
-		auth: oauthAuthInjection(grok, subscriptions),
-		resolveAttachments,
-	});
-
-	// The Fast wrapper restores wire/replay model identity to openai-codex.
-	// Keep the opaque envelope untouched and map public Fast source identity to
-	// that native replay provider before PiAiAdapter validates it.
-	const replayProviders = new Map(aliases);
-	replayProviders.set(CODEX_OAUTH_FAST_ROUTE, CODEX_PI_PROVIDER);
-	return new AliasLlmAdapter(inner, aliases, policies, replayProviders);
-}
-
-/**
- * Resolve an OAuth access token for one route, translating a failed refresh
- * (revoked refresh token, dead grant) into MISSING_CREDENTIAL so the failure
- * is not retried and the user is told to sign in again rather than shown a
- * bare upstream 401.
- */
-async function resolveOAuthToken(
-	displayName: string,
-	getAccessToken: () => Promise<string | undefined>,
-): Promise<string> {
-	let accessToken: string | undefined;
-	try {
-		accessToken = await getAccessToken();
-	} catch (error) {
-		throw new LlmError(
-			`${displayName} could not refresh its sign-in (${safeMessage(error)}).` +
-				" Open Settings → Coding OAuth and sign in again.",
-			"MISSING_CREDENTIAL",
-		);
-	}
-	if (accessToken === undefined || accessToken.length === 0) return missingCredential(displayName);
-	return accessToken;
-}

package/src/alias-adapter.ts

@@ -1,147 +0,0 @@
-/**
- * Harness route aliases over a native-id PiAiAdapter.
- * @module dsh-coding-subscription-oauth/alias-adapter
- */
-
-import type {
-	GenerateOptions,
-	LlmModelInfo,
-	LlmProviderInfo,
-	LlmResolvedModelInfo,
-	ResolvedRetryPolicy,
-	StreamChunk,
-} from "@deepseek-ai/dsh-llm";
-import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
-import { remapXaiCapacityFailure } from "./grok-errors.ts";
-import { remapAuthFailureIfContextOverflow } from "./kimi-errors.ts";
-
-export interface AliasLlmRoutePolicy {
-	/** User-facing provider name shown above models in the model selector. */
-	displayName?: string;
-	/** Return false to hide every model for this route from discovery. */
-	isAuthenticated?: () => Promise<boolean>;
-	/**
-	 * After authentication, keep only models this predicate accepts.
-	 * Used by opt-in routes (e.g. Codex Fast) so ineligible ids stay hidden
-	 * without hiding the whole authenticated catalog.
-	 */
-	includeModel?: (modelId: string) => boolean;
-	/**
-	 * Called once when a stream for this route finishes with an AUTH failure
-	 * (upstream rejected a locally-valid token). Implementations backdate the
-	 * stored credential's expiry so the retried step refreshes before reuse.
-	 * Awaiting it here keeps invalidation ordered before the retry executor
-	 * reruns the step; failures are swallowed so the original AUTH surfaces.
-	 */
-	onAuthFailure?: () => Promise<void>;
-}
-
-export function normalizeReplayForRoute(
-	message: GenerateOptions["messages"][number],
-	route: string,
-	nativeReplayProvider: string,
-): GenerateOptions["messages"][number] {
-	if (message.role !== "assistant" || message.source.kind !== "model") return message;
-	if (message.source.provider !== route) {
-		if (message.source.replayState === undefined) return message;
-		const { replayState: _foreignReplay, ...source } = message.source;
-		return { ...message, source };
-	}
-	// The rc.2 envelope stays entirely opaque. PiAiAdapter only keys replay
-	// validation from source.provider, so restore the native provider identity
-	// without inspecting or changing replayState.
-	return { ...message, source: { ...message.source, provider: nativeReplayProvider } };
-}
-
-/**
- * Keeps pi-ai model.provider identities native while exposing collision-free
- * Harness route names. Every public operation translates exactly once.
- */
-export class AliasLlmAdapter extends LlmAdapter {
-	constructor(
-		private readonly inner: LlmAdapter,
-		private readonly aliases: ReadonlyMap<string, string>,
-		private readonly policies: ReadonlyMap<string, AliasLlmRoutePolicy> = new Map(),
-		private readonly replayProviders: ReadonlyMap<string, string> = aliases,
-	) {
-		super();
-	}
-
-	private nativeProvider(route: string): string {
-		const provider = this.aliases.get(route);
-		if (provider === undefined) throw new LlmError(`OAuth adapter does not own provider "${route}"`, "NO_ADAPTER");
-		return provider;
-	}
-
-	providerInfo(provider: string): LlmProviderInfo {
-		const native = this.nativeProvider(provider);
-		const info = this.inner.providerInfo(native);
-		const displayName = this.policies.get(provider)?.displayName;
-		return { ...info, id: provider, ...(displayName === undefined ? {} : { name: displayName }) };
-	}
-
-	providerRetryPolicy(provider: string): ResolvedRetryPolicy | undefined {
-		return this.inner.providerRetryPolicy(this.nativeProvider(provider));
-	}
-
-	async listModels(provider: string): Promise<readonly LlmModelInfo[]> {
-		const native = this.nativeProvider(provider);
-		const isAuthenticated = this.policies.get(provider)?.isAuthenticated;
-		if (isAuthenticated !== undefined) {
-			try {
-				if (!(await isAuthenticated())) return [];
-			} catch {
-				// A corrupt/unreadable credential must hide models instead of breaking
-				// the entire model picker or presenting a route that cannot be used.
-				return [];
-			}
-		}
-		const listed = (await this.inner.listModels(native)).map((model) => ({ ...model, provider }));
-		const includeModel = this.policies.get(provider)?.includeModel;
-		return includeModel === undefined ? listed : listed.filter((model) => includeModel(model.id));
-	}
-
-	async resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo> {
-		const native = this.nativeProvider(provider);
-		return { ...(await this.inner.resolveModel(native, model, signal)), provider };
-	}
-
-	async *stream(options: GenerateOptions): AsyncIterable<StreamChunk> {
-		const route = options.provider;
-		const native = this.nativeProvider(route);
-		const messages = options.messages.map((message) =>
-			normalizeReplayForRoute(message, route, this.replayProviders.get(route) ?? native),
-		);
-		let authFailureNotified = false;
-		for await (const raw of this.inner.stream({ ...options, provider: native, messages })) {
-			const chunk =
-				raw.type === "finish" && raw.reason.kind === "error"
-					? {
-							...raw,
-							reason: {
-								...raw.reason,
-								failure: remapXaiCapacityFailure(remapAuthFailureIfContextOverflow(raw.reason.failure)),
-							},
-						}
-					: raw;
-			if (
-				!authFailureNotified &&
-				chunk.type === "finish" &&
-				chunk.reason.kind === "error" &&
-				chunk.reason.failure.code === "AUTH"
-			) {
-				authFailureNotified = true;
-				const onAuthFailure = this.policies.get(route)?.onAuthFailure;
-				if (onAuthFailure !== undefined) {
-					try {
-						await onAuthFailure();
-					} catch {
-						// Invalidation is best-effort: the original AUTH failure must
-						// surface unchanged even when the credential store is unreadable.
-					}
-				}
-			}
-			yield chunk;
-		}
-	}
-}