dsh-coding-subscription-oauth 0.7.1 → 0.8.0

package/scripts/smoke-deployed-routes.mjs

@@ -1,146 +1,146 @@
-#!/usr/bin/env node
-
-import { randomUUID } from "node:crypto";
-
-const base = new URL(process.env.DSH_WEB_URL ?? "http://127.0.0.1:3080");
-const origin = base.origin;
-const timeoutMs = Number.parseInt(process.env.DSH_SMOKE_TIMEOUT_MS ?? "180000", 10);
-const restoreProvider = process.env.DSH_RESTORE_PROVIDER;
-const restoreModel = process.env.DSH_RESTORE_MODEL;
-if (restoreProvider === undefined || restoreModel === undefined) {
-	throw new Error(
-		"Set DSH_RESTORE_PROVIDER and DSH_RESTORE_MODEL before running; smoke selection updates the saved default temporarily",
-	);
-}
-const restoreSelection = {
-	provider: restoreProvider,
-	model: restoreModel,
-	...(process.env.DSH_RESTORE_REASONING === undefined ? {} : { reasoningEffort: process.env.DSH_RESTORE_REASONING }),
-};
-const cases = [
-	{
-		route: "codex-oauth",
-		model: process.env.DSH_CODEX_SMOKE_MODEL ?? "gpt-5.6-sol",
-		marker: "DSH_CODEX_OAUTH_SMOKE_OK",
-	},
-	{ route: "kimi-code-oauth", model: process.env.DSH_KIMI_SMOKE_MODEL ?? "k3", marker: "DSH_KIMI_OAUTH_SMOKE_OK" },
-];
-
-async function rpc(method, payload) {
-	const rpcId = randomUUID();
-	const response = await fetch(new URL(`/api/${method}`, base), {
-		method: "POST",
-		headers: { accept: "application/json", "content-type": "application/json", origin },
-		body: JSON.stringify({ type: "client-request", rpcId, method, payload }),
-		signal: AbortSignal.timeout(30_000),
-	});
-	const envelope = await response.json().catch(() => undefined);
-	if (!response.ok) throw new Error(`${method}: HTTP ${response.status}`);
-	if (envelope?.rpcId !== rpcId || envelope?.result?.ok !== true) {
-		throw new Error(`${method}: ${envelope?.result?.error?.message ?? "invalid response"}`);
-	}
-	return envelope.result.value;
-}
-
-async function waitForIdle(sessionId) {
-	const deadline = Date.now() + timeoutMs;
-	while (Date.now() < deadline) {
-		const { items } = await rpc("session.list", {});
-		const session = items.find((item) => item.sessionId === sessionId);
-		if (session === undefined) throw new Error(`session ${sessionId} disappeared`);
-		if (!session.blank && !session.running) return;
-		await new Promise((resolve) => setTimeout(resolve, 1_000));
-	}
-	throw new Error(`session ${sessionId} did not finish within ${timeoutMs}ms`);
-}
-
-function contentBlocks(value, output = []) {
-	if (Array.isArray(value)) {
-		for (const item of value) contentBlocks(item, output);
-	} else if (value !== null && typeof value === "object") {
-		if (typeof value.type === "string" && ["tool-call", "tool-result"].includes(value.type)) output.push(value);
-		for (const child of Object.values(value)) contentBlocks(child, output);
-	}
-	return output;
-}
-
-async function runSmoke(testCase) {
-	const created = await rpc("session.create", { cwd: process.cwd() });
-	const sessionId = created.sessionId;
-	let selected = false;
-	let failure;
-	try {
-		await rpc("session.selectModel", {
-			sessionId,
-			provider: testCase.route,
-			model: testCase.model,
-			reasoningEffort: "low",
-		});
-		selected = true;
-		await rpc("session.prompt", {
-			sessionId,
-			mode: "queue",
-			clientTimeZone: "UTC",
-			content: [
-				{
-					type: "text",
-					text: `Automated OAuth smoke test. You MUST call the glob tool exactly once with pattern "package.json" in the current workspace. After receiving the tool result, reply with exactly ${testCase.marker} and no other text.`,
-				},
-			],
-		});
-		await waitForIdle(sessionId);
-		const history = await rpc("session.history", { sessionId, maxMessages: 200 });
-		const serialized = JSON.stringify(history.events);
-		const blocks = contentBlocks(history.events);
-		const toolCalls = blocks.filter((block) => block.type === "tool-call").length;
-		const toolResults = blocks.filter((block) => block.type === "tool-result").length;
-		const eventTypes = [...new Set(history.events.map((entry) => entry.event.type))];
-		const turnErrors = eventTypes.filter((type) => type.includes("error"));
-		if (!serialized.includes(testCase.marker)) throw new Error(`${testCase.route}: response marker missing`);
-		if (toolCalls === 0 || toolResults === 0) throw new Error(`${testCase.route}: tool-call round trip missing`);
-		if (turnErrors.length > 0) throw new Error(`${testCase.route}: error events: ${turnErrors.join(", ")}`);
-
-		const secondMarker = `${testCase.marker}_TURN2`;
-		await rpc("session.prompt", {
-			sessionId,
-			mode: "queue",
-			clientTimeZone: "UTC",
-			content: [
-				{ type: "text", text: `Second-turn replay test. Reply with exactly ${secondMarker} and no other text.` },
-			],
-		});
-		await waitForIdle(sessionId);
-		const secondHistory = await rpc("session.history", { sessionId, maxMessages: 200 });
-		const secondSerialized = JSON.stringify(secondHistory.events);
-		const secondEventTypes = [...new Set(secondHistory.events.map((entry) => entry.event.type))];
-		const secondTurnErrors = secondEventTypes.filter((type) => type.includes("error"));
-		if (!secondSerialized.includes(secondMarker))
-			throw new Error(`${testCase.route}: second-turn response marker missing`);
-		if (secondTurnErrors.length > 0)
-			throw new Error(`${testCase.route}: second-turn error events: ${secondTurnErrors.join(", ")}`);
-		console.log(`${testCase.route}/${testCase.model}: twoTurns=yes toolCalls=${toolCalls} toolResults=${toolResults}`);
-	} catch (error) {
-		failure = error;
-	} finally {
-		if (selected) {
-			try {
-				await rpc("session.selectModel", { sessionId, ...restoreSelection });
-			} catch (error) {
-				failure ??= new Error(
-					`${testCase.route}: failed to restore default model: ${error instanceof Error ? error.message : String(error)}`,
-				);
-			}
-		}
-		try {
-			await rpc("workspace.archiveSession", { sessionId });
-		} catch (error) {
-			failure ??= new Error(
-				`${testCase.route}: failed to archive smoke session: ${error instanceof Error ? error.message : String(error)}`,
-			);
-		}
-	}
-	if (failure !== undefined) throw failure;
-}
-
-for (const testCase of cases) await runSmoke(testCase);
-console.log("Deployed Codex/Kimi OAuth inference and tool-call smoke passed.");
+#!/usr/bin/env node
+
+import { randomUUID } from "node:crypto";
+
+const base = new URL(process.env.DSH_WEB_URL ?? "http://127.0.0.1:3080");
+const origin = base.origin;
+const timeoutMs = Number.parseInt(process.env.DSH_SMOKE_TIMEOUT_MS ?? "180000", 10);
+const restoreProvider = process.env.DSH_RESTORE_PROVIDER;
+const restoreModel = process.env.DSH_RESTORE_MODEL;
+if (restoreProvider === undefined || restoreModel === undefined) {
+	throw new Error(
+		"Set DSH_RESTORE_PROVIDER and DSH_RESTORE_MODEL before running; smoke selection updates the saved default temporarily",
+	);
+}
+const restoreSelection = {
+	provider: restoreProvider,
+	model: restoreModel,
+	...(process.env.DSH_RESTORE_REASONING === undefined ? {} : { reasoningEffort: process.env.DSH_RESTORE_REASONING }),
+};
+const cases = [
+	{
+		route: "codex-oauth",
+		model: process.env.DSH_CODEX_SMOKE_MODEL ?? "gpt-5.6-sol",
+		marker: "DSH_CODEX_OAUTH_SMOKE_OK",
+	},
+	{ route: "kimi-code-oauth", model: process.env.DSH_KIMI_SMOKE_MODEL ?? "k3", marker: "DSH_KIMI_OAUTH_SMOKE_OK" },
+];
+
+async function rpc(method, payload) {
+	const rpcId = randomUUID();
+	const response = await fetch(new URL(`/api/${method}`, base), {
+		method: "POST",
+		headers: { accept: "application/json", "content-type": "application/json", origin },
+		body: JSON.stringify({ type: "client-request", rpcId, method, payload }),
+		signal: AbortSignal.timeout(30_000),
+	});
+	const envelope = await response.json().catch(() => undefined);
+	if (!response.ok) throw new Error(`${method}: HTTP ${response.status}`);
+	if (envelope?.rpcId !== rpcId || envelope?.result?.ok !== true) {
+		throw new Error(`${method}: ${envelope?.result?.error?.message ?? "invalid response"}`);
+	}
+	return envelope.result.value;
+}
+
+async function waitForIdle(sessionId) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		const { items } = await rpc("session.list", {});
+		const session = items.find((item) => item.sessionId === sessionId);
+		if (session === undefined) throw new Error(`session ${sessionId} disappeared`);
+		if (!session.blank && !session.running) return;
+		await new Promise((resolve) => setTimeout(resolve, 1_000));
+	}
+	throw new Error(`session ${sessionId} did not finish within ${timeoutMs}ms`);
+}
+
+function contentBlocks(value, output = []) {
+	if (Array.isArray(value)) {
+		for (const item of value) contentBlocks(item, output);
+	} else if (value !== null && typeof value === "object") {
+		if (typeof value.type === "string" && ["tool-call", "tool-result"].includes(value.type)) output.push(value);
+		for (const child of Object.values(value)) contentBlocks(child, output);
+	}
+	return output;
+}
+
+async function runSmoke(testCase) {
+	const created = await rpc("session.create", { cwd: process.cwd() });
+	const sessionId = created.sessionId;
+	let selected = false;
+	let failure;
+	try {
+		await rpc("session.selectModel", {
+			sessionId,
+			provider: testCase.route,
+			model: testCase.model,
+			reasoningEffort: "low",
+		});
+		selected = true;
+		await rpc("session.prompt", {
+			sessionId,
+			mode: "queue",
+			clientTimeZone: "UTC",
+			content: [
+				{
+					type: "text",
+					text: `Automated OAuth smoke test. You MUST call the glob tool exactly once with pattern "package.json" in the current workspace. After receiving the tool result, reply with exactly ${testCase.marker} and no other text.`,
+				},
+			],
+		});
+		await waitForIdle(sessionId);
+		const history = await rpc("session.history", { sessionId, maxMessages: 200 });
+		const serialized = JSON.stringify(history.events);
+		const blocks = contentBlocks(history.events);
+		const toolCalls = blocks.filter((block) => block.type === "tool-call").length;
+		const toolResults = blocks.filter((block) => block.type === "tool-result").length;
+		const eventTypes = [...new Set(history.events.map((entry) => entry.event.type))];
+		const turnErrors = eventTypes.filter((type) => type.includes("error"));
+		if (!serialized.includes(testCase.marker)) throw new Error(`${testCase.route}: response marker missing`);
+		if (toolCalls === 0 || toolResults === 0) throw new Error(`${testCase.route}: tool-call round trip missing`);
+		if (turnErrors.length > 0) throw new Error(`${testCase.route}: error events: ${turnErrors.join(", ")}`);
+
+		const secondMarker = `${testCase.marker}_TURN2`;
+		await rpc("session.prompt", {
+			sessionId,
+			mode: "queue",
+			clientTimeZone: "UTC",
+			content: [
+				{ type: "text", text: `Second-turn replay test. Reply with exactly ${secondMarker} and no other text.` },
+			],
+		});
+		await waitForIdle(sessionId);
+		const secondHistory = await rpc("session.history", { sessionId, maxMessages: 200 });
+		const secondSerialized = JSON.stringify(secondHistory.events);
+		const secondEventTypes = [...new Set(secondHistory.events.map((entry) => entry.event.type))];
+		const secondTurnErrors = secondEventTypes.filter((type) => type.includes("error"));
+		if (!secondSerialized.includes(secondMarker))
+			throw new Error(`${testCase.route}: second-turn response marker missing`);
+		if (secondTurnErrors.length > 0)
+			throw new Error(`${testCase.route}: second-turn error events: ${secondTurnErrors.join(", ")}`);
+		console.log(`${testCase.route}/${testCase.model}: twoTurns=yes toolCalls=${toolCalls} toolResults=${toolResults}`);
+	} catch (error) {
+		failure = error;
+	} finally {
+		if (selected) {
+			try {
+				await rpc("session.selectModel", { sessionId, ...restoreSelection });
+			} catch (error) {
+				failure ??= new Error(
+					`${testCase.route}: failed to restore default model: ${error instanceof Error ? error.message : String(error)}`,
+				);
+			}
+		}
+		try {
+			await rpc("workspace.archiveSession", { sessionId });
+		} catch (error) {
+			failure ??= new Error(
+				`${testCase.route}: failed to archive smoke session: ${error instanceof Error ? error.message : String(error)}`,
+			);
+		}
+	}
+	if (failure !== undefined) throw failure;
+}
+
+for (const testCase of cases) await runSmoke(testCase);
+console.log("Deployed Codex/Kimi OAuth inference and tool-call smoke passed.");

package/scripts/verify-adapter-host.mjs

@@ -1,70 +1,70 @@
-#!/usr/bin/env node
-
-// Run against a plugin installed in an isolated host, not this checkout's peers.
-// Metadata resolution is offline and uses disposable example credentials.
-import assert from "node:assert/strict";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-const entry = process.argv[2];
-if (!entry) throw new Error("Usage: node scripts/verify-adapter-host.mjs <installed-plugin>/lib/index.js");
-const scratch = await mkdtemp(join(tmpdir(), "dsh-adapter-host-"));
-const previousHome = process.env.DSH_HOME;
-const previousFetch = globalThis.fetch;
-process.env.DSH_HOME = scratch;
-globalThis.fetch = async () => {
-	throw new Error("Model metadata checks must not make network requests");
-};
-try {
-	const plugin = await import(pathToFileURL(resolve(entry)).href);
-	const grok = new plugin.GrokBuildSession(new plugin.GrokBuildCredentialStore(join(scratch, "grok.json")));
-	const subscriptions = plugin.OAUTH_PROVIDER_DEFINITIONS.map(
-		(definition) =>
-			new plugin.OAuthProviderSession(
-				definition,
-				undefined,
-				new plugin.OAuthCredentialFileStore(
-					definition.nativeProviderId,
-					join(scratch, `${definition.slug}.json`),
-					definition.route,
-				),
-				join(scratch, `${definition.slug}-models.json`),
-			),
-	);
-	const exampleCredential = () => ({
-		type: "oauth",
-		access: "EXAMPLE_ACCESS_TOKEN",
-		refresh: "EXAMPLE_REFRESH_TOKEN",
-		expires: Date.now() + 3_600_000,
-	});
-	await grok.store.modify("xai", async () => exampleCredential());
-	for (const session of subscriptions) {
-		await session.store.modify(session.definition.nativeProviderId, async () => exampleCredential());
-	}
-	const adapter = plugin.createCodingOAuthAdapter(grok, subscriptions, () => undefined, {
-		codexFast: { isEligible: () => true },
-	});
-	for (const route of [...plugin.CODING_OAUTH_ROUTES, "codex-oauth-fast"]) {
-		const models = await adapter.listModels(route);
-		assert.ok(models.length > 0, `${route}: expected catalog entries`);
-		const model = route === "grok-build" ? models.find((item) => item.id === "grok-4.6") : models[0];
-		assert.ok(model, `${route}: expected model`);
-		const resolved = await adapter.resolveModel(route, model.id);
-		assert.equal(resolved.provider, route);
-		assert.equal(resolved.id, model.id);
-		const prepared = await adapter.prepareCall(route, model.id);
-		assert.equal(prepared.model.id, model.id);
-		await assert.rejects(adapter.resolveModel(route, "missing-example-model"), { code: "UNKNOWN_MODEL" });
-		console.log(`PASS ${route}: catalog, model resolution, request preparation, unknown-model error`);
-	}
-	const standalone = plugin.createGrokBuildAdapter(grok, () => undefined);
-	assert.equal((await standalone.resolveModel("grok-build", "grok-4.6")).id, "grok-4.6");
-	console.log("PASS standalone Grok adapter");
-} finally {
-	globalThis.fetch = previousFetch;
-	if (previousHome === undefined) delete process.env.DSH_HOME;
-	else process.env.DSH_HOME = previousHome;
-	await rm(scratch, { recursive: true, force: true });
-}
+#!/usr/bin/env node
+
+// Run against a plugin installed in an isolated host, not this checkout's peers.
+// Metadata resolution is offline and uses disposable example credentials.
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const entry = process.argv[2];
+if (!entry) throw new Error("Usage: node scripts/verify-adapter-host.mjs <installed-plugin>/lib/index.js");
+const scratch = await mkdtemp(join(tmpdir(), "dsh-adapter-host-"));
+const previousHome = process.env.DSH_HOME;
+const previousFetch = globalThis.fetch;
+process.env.DSH_HOME = scratch;
+globalThis.fetch = async () => {
+	throw new Error("Model metadata checks must not make network requests");
+};
+try {
+	const plugin = await import(pathToFileURL(resolve(entry)).href);
+	const grok = new plugin.GrokBuildSession(new plugin.GrokBuildCredentialStore(join(scratch, "grok.json")));
+	const subscriptions = plugin.OAUTH_PROVIDER_DEFINITIONS.map(
+		(definition) =>
+			new plugin.OAuthProviderSession(
+				definition,
+				undefined,
+				new plugin.OAuthCredentialFileStore(
+					definition.nativeProviderId,
+					join(scratch, `${definition.slug}.json`),
+					definition.route,
+				),
+				join(scratch, `${definition.slug}-models.json`),
+			),
+	);
+	const exampleCredential = () => ({
+		type: "oauth",
+		access: "EXAMPLE_ACCESS_TOKEN",
+		refresh: "EXAMPLE_REFRESH_TOKEN",
+		expires: Date.now() + 3_600_000,
+	});
+	await grok.store.modify("xai", async () => exampleCredential());
+	for (const session of subscriptions) {
+		await session.store.modify(session.definition.nativeProviderId, async () => exampleCredential());
+	}
+	const adapter = plugin.createCodingOAuthAdapter(grok, subscriptions, () => undefined, {
+		codexFast: { isEligible: () => true },
+	});
+	for (const route of [...plugin.CODING_OAUTH_ROUTES, "codex-oauth-fast"]) {
+		const models = await adapter.listModels(route);
+		assert.ok(models.length > 0, `${route}: expected catalog entries`);
+		const model = route === "grok-build" ? models.find((item) => item.id === "grok-4.6") : models[0];
+		assert.ok(model, `${route}: expected model`);
+		const resolved = await adapter.resolveModel(route, model.id);
+		assert.equal(resolved.provider, route);
+		assert.equal(resolved.id, model.id);
+		const prepared = await adapter.prepareCall(route, model.id);
+		assert.equal(prepared.model.id, model.id);
+		await assert.rejects(adapter.resolveModel(route, "missing-example-model"), { code: "UNKNOWN_MODEL" });
+		console.log(`PASS ${route}: catalog, model resolution, request preparation, unknown-model error`);
+	}
+	const standalone = plugin.createGrokBuildAdapter(grok, () => undefined);
+	assert.equal((await standalone.resolveModel("grok-build", "grok-4.6")).id, "grok-4.6");
+	console.log("PASS standalone Grok adapter");
+} finally {
+	globalThis.fetch = previousFetch;
+	if (previousHome === undefined) delete process.env.DSH_HOME;
+	else process.env.DSH_HOME = previousHome;
+	await rm(scratch, { recursive: true, force: true });
+}

package/scripts/verify-deployed-catalog.mjs

@@ -1,87 +1,87 @@
-#!/usr/bin/env node
-
-import { randomUUID } from "node:crypto";
-
-const base = new URL(process.env.DSH_WEB_URL ?? "http://127.0.0.1:3080");
-const origin = base.origin;
-
-async function jsonFetch(path, init = {}) {
-	const response = await fetch(new URL(path, base), {
-		...init,
-		headers: {
-			accept: "application/json",
-			origin,
-			...init.headers,
-		},
-	});
-	const value = await response.json().catch(() => undefined);
-	if (!response.ok) throw new Error(`${path}: HTTP ${response.status}`);
-	return value;
-}
-
-async function rpc(method, payload = {}) {
-	const rpcId = randomUUID();
-	const envelope = await jsonFetch(`/api/${method}`, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({ type: "client-request", rpcId, method, payload }),
-	});
-	if (envelope?.rpcId !== rpcId || envelope?.result?.ok !== true) {
-		throw new Error(`${method} failed: ${JSON.stringify(envelope?.result?.error ?? envelope)}`);
-	}
-	return envelope.result.value;
-}
-
-const status = await jsonFetch("/plugins/dsh-grok-build/oauth/status");
-const catalog = await rpc("llm.models");
-const registered = await rpc("llm.providers");
-const groups = new Map(catalog.groups.map((group) => [group.id, group]));
-const routes = [
-	["grok", "grok-build"],
-	["codex", "codex-oauth"],
-	["kimi", "kimi-code-oauth"],
-	["claude", "claude-code-oauth"],
-];
-const failures = [];
-const report = [];
-for (const [slug, route] of routes) {
-	const authenticated = status?.providers?.[slug]?.status === "signed-in";
-	const group = groups.get(route);
-	if (authenticated && group === undefined) failures.push(`${route}: authenticated but absent from model catalog`);
-	if (!authenticated && group !== undefined)
-		failures.push(`${route}: unauthenticated but still advertises ${group.models.length} model(s)`);
-	if (group !== undefined && !/\(OAuth\)$/u.test(group.name))
-		failures.push(`${route}: provider name lacks (OAuth): ${group.name}`);
-	report.push(
-		`${route}: ${authenticated ? "authenticated" : "unauthenticated"} → ${group === undefined ? "hidden" : `${group.models.length} model(s), ${group.name}`}`,
-	);
-}
-
-const providerIds = new Set(registered.providers.map((provider) => provider.provider));
-const preservedRoutes = ["openai", "xai", "kimi-coding"];
-for (const route of preservedRoutes) {
-	if (!providerIds.has(route)) failures.push(`${route}: legacy API-key route is no longer registered`);
-}
-report.push(`preserved API-key routes: ${preservedRoutes.filter((route) => providerIds.has(route)).join(", ")}`);
-
-const agyExpectation = process.env.DSH_EXPECT_AGY_AUTH ?? "signed-out";
-if (!["signed-out", "signed-in", "auto"].includes(agyExpectation)) {
-	throw new Error("DSH_EXPECT_AGY_AUTH must be signed-out, signed-in, or auto");
-}
-const agy = groups.get("agy");
-if (agyExpectation === "signed-out" && agy !== undefined)
-	failures.push(`agy: expected signed-out but advertises ${agy.models.length} model(s)`);
-if (agyExpectation === "signed-in" && agy === undefined)
-	failures.push("agy: expected signed-in but absent from model catalog");
-if (agy !== undefined && agy.name !== "Google Antigravity (OAuth)")
-	failures.push(`agy: provider name lacks OAuth label: ${agy.name}`);
-report.push(`agy: ${agy === undefined ? "hidden" : `${agy.models.length} model(s), ${agy.name}`}`);
-
-console.log(report.join("\n"));
-if (failures.length > 0) {
-	console.error("\nDeployment verification failed:");
-	for (const failure of failures) console.error(`- ${failure}`);
-	process.exitCode = 1;
-} else {
-	console.log("\nOAuth model catalog verification passed.");
-}
+#!/usr/bin/env node
+
+import { randomUUID } from "node:crypto";
+
+const base = new URL(process.env.DSH_WEB_URL ?? "http://127.0.0.1:3080");
+const origin = base.origin;
+
+async function jsonFetch(path, init = {}) {
+	const response = await fetch(new URL(path, base), {
+		...init,
+		headers: {
+			accept: "application/json",
+			origin,
+			...init.headers,
+		},
+	});
+	const value = await response.json().catch(() => undefined);
+	if (!response.ok) throw new Error(`${path}: HTTP ${response.status}`);
+	return value;
+}
+
+async function rpc(method, payload = {}) {
+	const rpcId = randomUUID();
+	const envelope = await jsonFetch(`/api/${method}`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ type: "client-request", rpcId, method, payload }),
+	});
+	if (envelope?.rpcId !== rpcId || envelope?.result?.ok !== true) {
+		throw new Error(`${method} failed: ${JSON.stringify(envelope?.result?.error ?? envelope)}`);
+	}
+	return envelope.result.value;
+}
+
+const status = await jsonFetch("/plugins/dsh-grok-build/oauth/status");
+const catalog = await rpc("llm.models");
+const registered = await rpc("llm.providers");
+const groups = new Map(catalog.groups.map((group) => [group.id, group]));
+const routes = [
+	["grok", "grok-build"],
+	["codex", "codex-oauth"],
+	["kimi", "kimi-code-oauth"],
+	["claude", "claude-code-oauth"],
+];
+const failures = [];
+const report = [];
+for (const [slug, route] of routes) {
+	const authenticated = status?.providers?.[slug]?.status === "signed-in";
+	const group = groups.get(route);
+	if (authenticated && group === undefined) failures.push(`${route}: authenticated but absent from model catalog`);
+	if (!authenticated && group !== undefined)
+		failures.push(`${route}: unauthenticated but still advertises ${group.models.length} model(s)`);
+	if (group !== undefined && !/\(OAuth\)$/u.test(group.name))
+		failures.push(`${route}: provider name lacks (OAuth): ${group.name}`);
+	report.push(
+		`${route}: ${authenticated ? "authenticated" : "unauthenticated"} → ${group === undefined ? "hidden" : `${group.models.length} model(s), ${group.name}`}`,
+	);
+}
+
+const providerIds = new Set(registered.providers.map((provider) => provider.provider));
+const preservedRoutes = ["openai", "xai", "kimi-coding"];
+for (const route of preservedRoutes) {
+	if (!providerIds.has(route)) failures.push(`${route}: legacy API-key route is no longer registered`);
+}
+report.push(`preserved API-key routes: ${preservedRoutes.filter((route) => providerIds.has(route)).join(", ")}`);
+
+const agyExpectation = process.env.DSH_EXPECT_AGY_AUTH ?? "signed-out";
+if (!["signed-out", "signed-in", "auto"].includes(agyExpectation)) {
+	throw new Error("DSH_EXPECT_AGY_AUTH must be signed-out, signed-in, or auto");
+}
+const agy = groups.get("agy");
+if (agyExpectation === "signed-out" && agy !== undefined)
+	failures.push(`agy: expected signed-out but advertises ${agy.models.length} model(s)`);
+if (agyExpectation === "signed-in" && agy === undefined)
+	failures.push("agy: expected signed-in but absent from model catalog");
+if (agy !== undefined && agy.name !== "Google Antigravity (OAuth)")
+	failures.push(`agy: provider name lacks OAuth label: ${agy.name}`);
+report.push(`agy: ${agy === undefined ? "hidden" : `${agy.models.length} model(s), ${agy.name}`}`);
+
+console.log(report.join("\n"));
+if (failures.length > 0) {
+	console.error("\nDeployment verification failed:");
+	for (const failure of failures) console.error(`- ${failure}`);
+	process.exitCode = 1;
+} else {
+	console.log("\nOAuth model catalog verification passed.");
+}