dsh-connect-minimaxcode 0.0.0-stage → 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jiafeng Xu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,242 @@
-# Temporary Holding Version
+# DSH Connect MiniMax Code (`dsh-connect-minimaxcode`)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+把本机已登录的 **MiniMax Code 桌面 App（国内版）** 的模型接入 **DeepSeek Harness（DSH）**，装好即用，无需配置 API Key。
+
+![license](https://img.shields.io/badge/license-MIT-blue.svg)
+![version](https://img.shields.io/badge/version-0.2.1-cornflowerblue.svg)
+
+## 灵感来源
+
+本插件的思路直接来自 **[dsh-connect-workbuddy](https://github.com/dingminhua/dsh-connect-workbuddy)**（作者 dingminhua）。
+
+它证明了这样一件事：**桌面 App 已经登录的模型，可以零配置地搬进 DSH**——不去碰账号密码，不引入新的鉴权体系，只是把本机已有的登录态接上一个 provider。本插件把同一套做法用在了 MiniMax Code 上：
+
+| | dsh-connect-workbuddy | 本插件 |
+|---|---|---|
+| 数据来源 | WorkBuddy 桌面 App 的本地登录态 | MiniMax Code 桌面 App 的本地登录态 |
+| 接入方式 | 注册 DSH provider，暴露已登录模型 | 同左 |
+| 目录来源 | 上游实时模型列表 | 同左 |
+
+该项目的架构（插件结构、provider 注册、只读复用登录态）也是本插件的主要参照，致谢见文末。
+
+---
+
+## ⚠️ 重要声明（请先阅读）
+
+- **本项目仅供学习与研究使用**，不面向生产环境，也不提供任何商业支持。
+- **本项目为非官方插件**，与 MiniMax、DeepSeek 均无关联，未获其认可或授权。
+- 本插件仅**读取你自己本机上 MiniMax Code 已登录的凭证**，仅驱动**你自己的账号在你自己的电脑上**调用。
+- **禁止**将本插件用于商业用途、超出个人合理使用范围的场景，或任何批量/多账号/规避限额的目的。
+- 本插件依赖 MiniMax 客户端的**非公开接口**。MiniMax 更新客户端后，接口可能变更导致插件失效。
+- 使用者需自行遵守 [MiniMax 的服务条款](https://agent.minimax.cn/doc/zh/terms-of-service.html)。因使用本插件产生的一切后果（账号受限、额度清空、服务中断等）由使用者自行承担。
+- 本项目作者不对任何因使用或不当使用本插件造成的直接或间接损失负责。
+
+---
+
+## 特点
+
+- **零配置**：自动读取 MiniMax Code 桌面 App 的登录态，不在 DSH 中存储任何明文 Token
+- **动态模型目录**：从上游接口实时拉取，模型增减无需更新插件
+- **复用官方适配器**：上游为标准 Anthropic Messages 协议，直接复用 DSH 自带 provider，工具调用、推理块、上下文压缩均由 DSH 托管
+- **只读**：插件不写入、不修改 MiniMax 的任何文件，也不执行任何登录或续期动作
+- **不含客户端 UI**：不注册浏览器侧插件，因此不会影响 DSH 的启动（见「已知限制」）
+
+## 前置条件
+
+1. 已安装并**登录 MiniMax Code 桌面 App（国内版）**
+2. DSH 桌面版（内置内核 `0.2.0` 系列）或 Web profile
+
+## 安装
+
+**方式一：从 Git 仓库安装**（推荐，拿到最新代码）
+
+```bash
+dsh plugin --profile desktop add github:JeffTsuiCUG/dsh-connect-minimaxcode
+```
+
+**方式二：npm 安装**（发布后可用）
+
+```bash
+dsh plugin --profile desktop add dsh-connect-minimaxcode
+```
+
+Web profile 把 `--profile desktop` 换成 `--profile web`。
+
+> 桌面版的 profile 由 Electron 应用独占，若 `dsh` 命令不在 PATH 中，请使用 DSH 应用自带的载体 CLI（路径随安装位置而变，例如 `<DSH安装目录>\resources\runtime\cli\bin\dsh.cmd`）。
+
+安装后**无需重启**，插件会热加载；模型随后出现在模型选择器的 **MiniMax Code** 分组中。
+
+### 若安装被 `allowBuilds` 拦截
+
+本仓库把构建产物 `lib/` 一并提交，因此正常情况下安装不会触发构建。若你看到：
+
+```text
+[ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED] Failed to prepare git-hosted package
+```
+
+说明你使用的是**某个早于 `0.2.1` 的提交**（那些版本尚未提交 `lib/`）。解决办法二选一：
+
+- 改用上面写法指定版本：`github:JeffTsuiCUG/dsh-connect-minimaxcode#v0.2.1`
+- 或在该 profile 的 `pnpm-workspace.yaml` 中加入 pnpm 提示的 `allowBuilds` 条目后重试
+
+## 使用流程
+
+1. **确认桌面 App 已登录**
+   打开 MiniMax Code 桌面 App，确认处于已登录状态。插件读取的是 App 写入的本地登录态。
+
+2. **安装插件**（见上一步的命令），等待热加载完成。
+
+3. **选择模型**
+   打开 DSH 的模型选择器，在 **MiniMax Code** 分组下选择模型。可用模型来自上游实时目录，例如 `M2.7`、`M2.7-highspeed`、`M3`、`M3.1-Flash-Preview`。
+
+4. **正常对话**
+   直接使用即可。工具调用由 DSH 本地工具执行，插件只负责提供模型通路。
+
+5. **令牌过期时重新登录**
+   MiniMax Code 的登录令牌为短期 JWT（通常约 15 天），本插件**不会自动续期**。过期后：
+
+   | 现象 | 含义 | 处理方式 |
+   |---|---|---|
+   | 正常使用 | 令牌有效 | — |
+   | 剩余不足 24 小时 | 令牌即将失效 | 打开一次 MiniMax Code 桌面 App 刷新 |
+   | 请求返回鉴权错误 | 令牌已失效 | 在 MiniMax Code 中**重新登录**，然后重启 DSH |
+
+   > 令牌过期不会丢失数据。在 MiniMax Code 桌面 App 重新登录后，它会自动写入新的令牌，插件下次启动即可读到。
+
+### 关于响应速度
+
+MiniMax 的这些模型**强制要求先推理再输出**，思考无法关闭。因此：
+
+- 首个字符出现前会有一段等待（实测 M3.1-Flash-Preview 约 3 秒）
+- 推理过程会以 `thinking` 块实时返回，可以在界面中看到模型"在想什么"
+- 这是模型本身的行为，**不是插件造成的延迟**
+
+若更看重流式体感的即时反馈，建议同时保留 DSH 官方模型或其他 provider 作为备选。
+
+## 工作原理
+
+1. 读取 `~/.minimax/local-runtime.auth.json`（MiniMax Code 写入的明文登录信息），**仅在内存中**解析其 JWT
+2. 调用 `GET /mavis/api/v1/models` 获取实时模型目录（含上下文长度、多模态、工具调用等能力声明）
+3. 注册 `minimaxcode` provider，指向 `POST /mavis/api/v1/llm/v1/messages`（标准 Anthropic Messages 协议）
+
+### 与网关对接时的三个兼容处理
+
+这些是实测中必须处理的差异，也是本插件与"直接改个 URL 就能用"的主要差异所在：
+
+| # | 现象 | 处理 |
+|---|---|---|
+| 1 | 网关只认 `Authorization: Bearer`，而 pi-ai 默认发 `x-api-key`，后者单独出现会返回 `401 token is required` | 在模型描述符上附带 `Authorization` 头（网关同时接受两个头） |
+| 2 | Anthropic SDK 会自己在 `baseUrl` 后追加 `/v1/messages`；若 `baseUrl` 已以 `/v1` 结尾，请求路径会变成 `/v1/v1/messages`，网关返回 `503 direct_route_not_configured` | `baseUrl` 收到版本段之前，由 SDK 补齐 |
+| 3 | 所有模型强制要求推理，而"关闭推理"会让 pi-ai 发出 `thinking: {type: "disabled"}`，网关返回 `400 ... requires adaptive thinking` | 将"关闭"级别标记为不支持，使该字段被省略（网关接受） |
+
+插件**不**包含任何硬编码的 Token、账号或接口密钥。
+
+## 为什么没有额度显示
+
+「显示剩余额度」这个功能被实测排除过，结论写在这里以免后来者重复调查。
+
+**额度数据是真实存在的**。逆向 MiniMax Code 客户端可确认它使用了这样一组字段：
+
+```
+op_credit_summary: {
+  total_remaining_amount,      // 总剩余额度
+  purchased_remaining_amount,  // 购买额度剩余
+  free_remaining_amount        // 免费额度剩余
+}
+```
+
+**但找不到为它服务的接口**。已验证的部分：
+
+| 尝试 | 结果 |
+|---|---|
+| `GET /v1/api/user/info` + 模型网关令牌 | `401`，两类凭证互不通用 |
+| `GET /v1/api/user/info` + 客户端 OAuth 令牌（`mmoat_`） | `200`，但响应只有昵称、头像、`vipInfo` 等账户资料，**不含任何额度字段** |
+| 14 个候选额度路径（`user/credits`、`user/quota`、`workspace/list`、`credit/summary` 等） | 全部 `404` |
+| `account.minimax.cn` 同一批路径 | 同样无额度字段 |
+
+上述额度字段只出现在客户端**已混淆的前端 bundle** 中，属于渲染逻辑；真正提供数据的接口路径未能定位。实测所用的 OAuth 凭证有效期约 1 小时，由客户端自动续期，不适合作为插件的长期依赖。
+
+因此本插件不显示额度。若你已知可用路径，欢迎提Issue 或 PR；额度请直接在 MiniMax Code 客户端中查看。
+
+## 已知限制
+
+- **仅支持国内版（`agent.minimax.cn`）**。国际版网关是否可用**未经验证**，请勿据此推断其他区域可用。
+- **必须开启推理**。MiniMax 的全部模型都声明需要推理，关不掉。首字延迟因此高于非推理模型。
+- **未登录时模型列表是内置兜底**。此时选择器中仍会显示 `M2.7`、`M3` 两个内置条目，但它们无法真正调用；登录后才会切换为上游实时目录。判断是否可用，请以实际调用结果为准。
+- **不提供余额/用量显示**。这一项经过实测后确认无法实现，原因记录在下方「为什么没有额度显示」中。
+- **不自动续期令牌**，请参照上方「令牌有效期」。
+- **不提供设置界面卡片**。本插件为纯宿主侧插件，不在 DSH 设置页注册任何卡片，因此不会参与浏览器端的启动流程（这同时也是它不会导致 DSH 启动失败的原因）。
+- **上游接口非公开**，MiniMax 客户端更新后可能失效。
+
+## 卸载
+
+```bash
+dsh plugin --profile desktop remove dsh-connect-minimaxcode
+```
+
+## 开发
+
+```bash
+pnpm install
+pnpm test        # 单元测试 + 宿主集成测试
+pnpm typecheck   # 类型检查
+pnpm build       # 构建
+```
+
+构建依赖 `@earendil-works/pi-ai`，需与宿主中 `dsh-llm-pi-ai` 解析出的版本一致（当前为 `0.85.x`），否则类型不兼容。
+
+**`lib/` 是纳入版本管理的构建产物**，不是生成物。这是刻意为之：git 源安装拿到的是仓库原样内容，若不含 `lib/`，pnpm 会判定该包"需要构建"并触发 `prepare`，随即被构建脚本白名单拦下。改动源码后请重新构建并提交：
+
+```bash
+pnpm build && git add lib
+```
+
+## 同类插件
+
+这些插件与本插件的思路一致——**复用你本机桌面 App 已有的登录态，把模型接进 DSH**，无需另配 API Key。它们由不同作者独立开发，与本项目无隶属关系。
+
+| 插件 | 数据来源 | 每日签到领免费额度 | 额度 / 用量显示 |
+|---|---|---|---|
+| **dsh-connect-trae** | Trae（国内版 + 国际版） | ✅ 国内版 | ✅ Work / 通用积分概览 |
+| **dsh-qoder-connect** | Qoder（国内版 + 国际版，PAT） | ✅ 每日 100 Credits | ✅ 侧栏额度小卡 + 明细 |
+| **dsh-workbuddy-connect** | WorkBuddy（国内版 + 国际版） | — | ✅ 剩余积分 + 明细 |
+
+> 各插件的签到规则、额度口径与限制以各自文档为准。本表只列出经其 README 明确写出的功能，未逐项实测。
+
+### [dsh-connect-trae](https://github.com/dingminhua/dsh-connect-trae)
+
+把本机已登录的 Trae 接入 DSH，国内版与国际版可同时使用。国内版支持每日签到领积分，并提供 Work / 通用积分的只读概览。注意 Trae 的签到按「每台设备每天一次」限制。
+
+```bash
+dsh plugin --profile desktop add dsh-connect-trae
+```
+
+### [dsh-qoder-connect](https://github.com/masknull/dsh-qoder-connect)
+
+以个人访问令牌（PAT）接入 Qoder，双区域独立配置。每日自动签到领取 100 Credits 算力额度，签到时刻可自定义（默认 10:00，UTC+8），并带开机防漏补签；另有侧栏额度展示与逐包明细。
+
+```bash
+dsh plugin --profile desktop add dsh-qoder-connect
+```
+
+### [dsh-workbuddy-connect](https://github.com/corrinehu/dsh-workbuddy-connect)
+
+接入 WorkBuddy 桌面 App，国内版与国际版可并存，各自使用自己的账号与积分。提供账号信息、令牌有效期与剩余积分查看，并带 CLI：
+
+```bash
+dsh plugin --profile web exec dsh-workbuddy-connect status
+```
+
+> 该插件的版本需与你的 DSH 内核严格对应（不同内核线用不同版本），安装前请见其 README 的版本对应表。
+
+## 致谢
+
+- **[dsh-connect-workbuddy](https://github.com/dingminhua/dsh-connect-workbuddy)** — 本插件的灵感来源，架构与"复用本机登录态接入 DSH"的整体思路均源自该项目
+- [dsh-connect-trae](https://github.com/dingminhua/dsh-connect-trae) — 同作者的 DSH 插件，可作为 DSH 插件结构的参照
+- [dsh-workbuddy-connect](https://github.com/corrinehu/dsh-workbuddy-connect) — 客户端 bundle 规范与凭据复用的设计参照
+
+> 上方「同类插件」中的项目均为独立开发者的作品，与本项目无隶属或背书关系，各自遵循其自身的许可与免责声明。
+
+## 许可证
+
+[MIT](./LICENSE)

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# Register the MiniMax Code provider without changing the profile's default
+# model. The plugin reuses the MiniMax Code desktop app's existing sign-in; no
+# separate login flow is started.
+- insert:
+    - id: llm-minimaxcode
+      name: dsh-connect-minimaxcode

package/lib/index.d.ts

@@ -0,0 +1,297 @@
+import "@earendil-works/pi-ai";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/auth.d.ts
+/** File the desktop app writes its runtime auth context into. */
+declare const MINIMAX_AUTH_FILENAME = "local-runtime.auth.json";
+/** Directory holding it, relative to the user's home. */
+declare const MINIMAX_DATA_DIR = ".minimax";
+/** Region-specific gateways the desktop app ships with. */
+declare const MINIMAX_GATEWAYS: {
+  readonly cn: "https://agent.minimax.cn";
+  readonly io: "https://agent.minimax.io";
+  readonly com: "https://agent.minimaxi.com";
+};
+/** A gateway this plugin knows how to talk to. */
+type MinimaxRegion = keyof typeof MINIMAX_GATEWAYS;
+/** Every region, for a fallback sweep when the configured one fails. */
+declare const MINIMAX_REGIONS: readonly MinimaxRegion[];
+/**
+ * Base URL for pi-ai's anthropic client on a region gateway.
+ *
+ * This must stop *before* the API version segment: the Anthropic SDK appends
+ * `/v1/messages` itself, so a base ending in `/v1` produced the doubled path
+ * `/mavis/api/v1/llm/v1/v1/messages`, which the gateway answers with
+ * `503 direct_route_not_configured`. The correct request URL is therefore
+ * `<this>/v1/messages`.
+ */
+declare function chatBaseUrl(region: MinimaxRegion): string;
+/** Base URL of the authoritative model catalog on a region gateway. */
+declare function catalogUrl(region: MinimaxRegion): string;
+/** Default data directory, honouring the app's own override variables. */
+declare function dataDir(env?: NodeJS.ProcessEnv): string;
+/** Absolute path of the auth file this plugin reads. */
+declare function authPath(env?: NodeJS.ProcessEnv): string;
+/** The JWT claims this plugin acts on. */
+interface TokenClaims {
+  /** Expiry, seconds since the epoch. */
+  exp: number;
+  /** Account id the issuer embedded, when present. */
+  userId?: string;
+  /** Display name the issuer embedded, when present. */
+  name?: string;
+}
+/** A decoded, still-valid-at-read-time credential. */
+interface Credential {
+  token: string;
+  claims: TokenClaims;
+  /** Milliseconds since the epoch, from the file's own `updatedAtMs`. */
+  updatedAtMs?: number;
+}
+/** Why a credential could not be used, in a form the UI can render. */
+type AuthFailure = {
+  state: 'signed-out';
+  reason: 'app-missing' | 'not-signed-in' | 'unreadable' | 'malformed';
+} | {
+  state: 'expired';
+  expiresAtMs: number;
+};
+type AuthState = {
+  state: 'signed-in';
+  credential: Credential;
+} | AuthFailure;
+/**
+ * Decode a JWT payload without verifying its signature.
+ *
+ * Only the expiry is trusted, and only to decide how loudly to warn: a token we
+ * cannot parse is reported as malformed rather than silently accepted, and a
+ * token that verifies as expired is reported as expired rather than sent. The
+ * issuer remains the sole authority on both questions.
+ */
+declare function decodeClaims(token: string): TokenClaims | undefined;
+/** Milliseconds until the token expires; negative once it has. */
+declare function expiresInMs(claims: TokenClaims, now?: number): number;
+/** How a remaining lifetime should be presented to the user. */
+type ExpiryLevel = 'healthy' | 'expiring' | 'expired';
+/** Classify a token's remaining lifetime for display. */
+declare function expiryLevel(claims: TokenClaims, now?: number): ExpiryLevel;
+/** Whole days left, rounded up so 1 hour reads as "1 day", not "0 days". */
+declare function daysRemaining(claims: TokenClaims, now?: number): number;
+/**
+ * Parse the app's auth document into a state.
+ *
+ * Shared by the async and sync readers so the two can never disagree about what
+ * counts as signed in.
+ *
+ * @param text - Raw file contents.
+ * @param now - Clock, injected so expiry is testable.
+ * @returns The usable credential, or why there is none.
+ */
+declare function parseAuthDocument(text: string, now?: number): AuthState;
+/**
+ * Read the desktop app's credential.
+ *
+ * Every failure mode is a state rather than an exception: a user who has not
+ * installed or signed in yet is a normal condition the card renders, not an
+ * error the host logs on every start.
+ *
+ * @param env - Environment used to locate the data directory.
+ * @param now - Clock, injected so expiry is testable.
+ * @returns The usable credential, or why there is none.
+ */
+declare function readCredential(env?: NodeJS.ProcessEnv, now?: number): Promise<AuthState>;
+/**
+ * The bearer token for the current request, or `undefined`.
+ *
+ * pi-ai's anthropic-messages client sends the resolved `apiKey` as `x-api-key`,
+ * but MiniMax's gateway answers `{"code":401,"message":"token is required"}`
+ * unless an `Authorization: Bearer` header is also present. That header has to
+ * ride on the model descriptor ({@link Model.headers}), which is built inside
+ * the provider's synchronous `getModels()` — hence the synchronous read here.
+ * pi-ai calls `getModels()` once per operation, so the token is re-read per
+ * request and a re-login takes effect without a restart.
+ *
+ * @param env - Environment used to locate the data directory.
+ * @param now - Clock, injected so expiry is testable.
+ * @returns The token, or `undefined` when there is no usable one.
+ */
+declare function bearerToken(env?: NodeJS.ProcessEnv, now?: number): string | undefined;
+//#endregion
+//#region src/catalog.d.ts
+/** One model as the upstream describes it. */
+interface CatalogModel {
+  id: string;
+  name: string;
+  contextWindow: number;
+  maxOutputTokens?: number;
+  /** Whether the model accepts tool definitions and emits `tool_use`. */
+  toolCall: boolean;
+  /** Whether the model emits reasoning blocks. */
+  reasoning: boolean;
+  /** Input modalities, e.g. `text`, `image`, `video`. */
+  inputModalities: string[];
+  /** Whether the model accepts images at all. */
+  attachment: boolean;
+}
+/** Provider id registered with DSH, distinct from the upstream one. */
+declare const MINIMAXCODE_PROVIDER_ID = "minimaxcode";
+/**
+ * Used when the catalog cannot be fetched, so the picker still offers the
+ * models the desktop app is known to ship.
+ *
+ * Deliberately small and conservative: a fallback entry overstates nothing we
+ * could not confirm.
+ */
+declare const FALLBACK_MODELS: readonly CatalogModel[];
+/** Where the currently served list came from. */
+type CatalogSource = 'live' | 'fallback';
+/**
+ * Parse the upstream catalog document.
+ *
+ * Unknown providers are ignored rather than rejected: the endpoint serves every
+ * provider the desktop app is configured for, and only MiniMax models belong in
+ * this plugin's picker.
+ *
+ * @param document - Decoded response body.
+ * @returns Models in upstream order, or an empty list when none qualify.
+ */
+declare function parseCatalog(document: unknown): CatalogModel[];
+/**
+ * Holds the catalog and answers the picker's questions about it.
+ *
+ * Refreshes are explicit: the plugin refreshes at startup and on demand, and
+ * keeps serving the last good snapshot while a refresh is in flight, so a
+ * network blip never empties the model list.
+ */
+declare class MinimaxCatalog {
+  #private;
+  /** The models to serve right now. */
+  current(): CatalogModel[];
+  /** Provenance of {@link current}. */
+  get source(): CatalogSource;
+  /** When {@link current} was fetched, when it came from upstream. */
+  get fetchedAtMs(): number | undefined;
+  /** Why the last refresh failed, if one did. */
+  get error(): string | undefined;
+  /**
+   * Replace the served list, adopting upstream's own ordering.
+   *
+   * @returns Whether anything changed, so callers can skip a needless reload.
+   */
+  set(models: readonly CatalogModel[], source: CatalogSource, fetchedAtMs?: number): boolean;
+  /** Drop back to the built-in list, e.g. when the account signs out. */
+  invalidate(): void;
+  /**
+   * Fetch the live catalog for a credential.
+   *
+   * Serialised through a single in-flight promise: a second caller joins the
+   * first run rather than starting a duplicate request.
+   *
+   * @returns Whether the served list changed.
+   */
+  refresh(region: MinimaxRegion, credential: Credential, fetchImpl?: typeof fetch): Promise<boolean>;
+  /** Identity the served catalog belongs to, if any. */
+  get identity(): string | undefined;
+}
+//#endregion
+//#region src/status-route.d.ts
+/** Route this plugin mounts, matching its settings card. */
+declare const MINIMAX_STATUS_PATH = "/plugins/dsh-connect-minimaxcode/status";
+/** What the card renders. */
+interface StatusDocument {
+  state: 'signed-in' | 'signed-out' | 'expired';
+  /** Human-readable next step, present when not signed in. */
+  hint?: string;
+  /** Whole days until expiry; absent when unknown. */
+  daysRemaining?: number;
+  /** Traffic-light state for the expiry warning. */
+  expiry?: 'healthy' | 'expiring' | 'expired';
+  region?: string;
+  /** Provenance of the model list. */
+  catalogSource?: 'live' | 'fallback';
+  catalogError?: string;
+  models?: {
+    id: string;
+    name: string;
+    contextWindow: number;
+  }[];
+  /** Whether a catalog refresh is in flight. */
+  refreshing?: boolean;
+}
+/** Inputs the document is derived from. */
+interface StatusDeps {
+  auth: {
+    state: 'signed-in' | 'signed-out' | 'expired';
+    daysRemaining?: number;
+    expiry?: 'healthy' | 'expiring' | 'expired';
+    reason?: string;
+  };
+  region: string;
+  catalogSource: 'live' | 'fallback';
+  catalogError?: string;
+  models: {
+    id: string;
+    name: string;
+    contextWindow: number;
+  }[];
+  refreshing: boolean;
+}
+/**
+ * Build the card's status document.
+ *
+ * The three non-signed-in states carry different remedies, and the difference
+ * is the whole point of the card: a user who has never installed the app needs
+ * a different next step than one whose token simply aged out.
+ */
+declare function statusDocument(deps: StatusDeps): StatusDocument;
+//#endregion
+//#region src/adapter.d.ts
+/** How long a silent stream may last before the transport gives up. */
+declare const MINIMAX_STREAM_IDLE_TIMEOUT_MS: number;
+/** Options for building the provider. */
+interface AdapterOptions {
+  catalog: MinimaxCatalog;
+  /** Region whose gateway the models are served from. */
+  region: () => MinimaxRegion;
+  /** Live token, read fresh per call so a re-login takes effect at once. */
+  resolveApiKey: () => Promise<string | undefined>;
+  /**
+   * Live token for the `Authorization` header, read synchronously because the
+   * model descriptors that carry it are built inside `getModels()`.
+   */
+  bearerToken: () => string | undefined;
+}
+/** What {@link createMinimaxCodeAdapter} hands back. */
+interface AdapterBundle {
+  adapter: PiAiAdapter;
+  /** Drop cached profiles so the next pick rebuilds them. */
+  invalidate: () => void;
+}
+/**
+ * Build the DSH adapter that serves the catalog.
+ *
+ * The model list is rebuilt on demand rather than snapshotted, which is what
+ * lets a refresh upstream appear without restarting the host.
+ *
+ * @param options - Catalog, region and token resolution.
+ * @returns The adapter plus a way to drop its cached profiles.
+ */
+declare function createMinimaxCodeAdapter(options: AdapterOptions): AdapterBundle;
+//#endregion
+//#region src/index.d.ts
+/** Loader entry name; also the id the bundle patch inserts. */
+declare const name = "dsh-connect-minimaxcode";
+/** Services this plugin needs before it can serve anything. */
+declare const inject: string[];
+/**
+ * Compose the plugin.
+ *
+ * The credential is re-read on every request rather than cached at start: the
+ * desktop app refreshes its token independently, and a long-lived host would
+ * otherwise pin an expired one for the rest of the process.
+ *
+ * @param ctx - Service container.
+ */
+declare function apply(ctx: Context): void;
+//#endregion
+export { type AuthState, type CatalogModel, type CatalogSource, type Credential, FALLBACK_MODELS, MINIMAXCODE_PROVIDER_ID, MINIMAX_AUTH_FILENAME, MINIMAX_DATA_DIR, MINIMAX_GATEWAYS, MINIMAX_REGIONS, MINIMAX_STATUS_PATH, MINIMAX_STREAM_IDLE_TIMEOUT_MS, MinimaxCatalog, type MinimaxRegion, type StatusDocument, type TokenClaims, apply, authPath, bearerToken, catalogUrl, chatBaseUrl, createMinimaxCodeAdapter, dataDir, daysRemaining, decodeClaims, expiresInMs, expiryLevel, inject, name, parseAuthDocument, parseCatalog, readCredential, statusDocument };

package/lib/index.js

@@ -0,0 +1,715 @@
+import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createProvider } from "@earendil-works/pi-ai";
+import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+//#region src/auth.ts
+/**
+* Reading the MiniMax Code desktop app's own sign-in.
+*
+* The desktop app persists its bearer token as plaintext JSON under its data
+* directory. This module reads that file, decodes the JWT without verifying it
+* (the signature exists to stop *tampering*, and nobody tampers with a token we
+* only ever send back to the issuer), and reports expiry so the UI can warn
+* before the models go dark.
+*
+* Nothing here performs a login, a refresh, or any write. The token's lifetime
+* is owned by the desktop app: renewing it means signing in there again, which
+* is a deliberate step the user takes in the app, never one this plugin makes
+* on their behalf.
+*
+* @module dsh-connect-minimaxcode/auth
+*/
+/** File the desktop app writes its runtime auth context into. */
+const MINIMAX_AUTH_FILENAME = "local-runtime.auth.json";
+/** Directory holding it, relative to the user's home. */
+const MINIMAX_DATA_DIR = ".minimax";
+/** Region-specific gateways the desktop app ships with. */
+const MINIMAX_GATEWAYS = {
+	cn: "https://agent.minimax.cn",
+	io: "https://agent.minimax.io",
+	com: "https://agent.minimaxi.com"
+};
+/** Every region, for a fallback sweep when the configured one fails. */
+const MINIMAX_REGIONS = [
+	"cn",
+	"io",
+	"com"
+];
+/**
+* Base URL for pi-ai's anthropic client on a region gateway.
+*
+* This must stop *before* the API version segment: the Anthropic SDK appends
+* `/v1/messages` itself, so a base ending in `/v1` produced the doubled path
+* `/mavis/api/v1/llm/v1/v1/messages`, which the gateway answers with
+* `503 direct_route_not_configured`. The correct request URL is therefore
+* `<this>/v1/messages`.
+*/
+function chatBaseUrl(region) {
+	return `${MINIMAX_GATEWAYS[region]}/mavis/api/v1/llm`;
+}
+/** Base URL of the authoritative model catalog on a region gateway. */
+function catalogUrl(region) {
+	return `${MINIMAX_GATEWAYS[region]}/mavis/api/v1/models`;
+}
+/** Default data directory, honouring the app's own override variables. */
+function dataDir(env = process.env) {
+	return env.MINIMAX_DATA_DIR ?? env.MAVIS_DATA_DIR ?? join(homedir(), ".minimax");
+}
+/** Absolute path of the auth file this plugin reads. */
+function authPath(env = process.env) {
+	return join(dataDir(env), MINIMAX_AUTH_FILENAME);
+}
+/**
+* Decode a JWT payload without verifying its signature.
+*
+* Only the expiry is trusted, and only to decide how loudly to warn: a token we
+* cannot parse is reported as malformed rather than silently accepted, and a
+* token that verifies as expired is reported as expired rather than sent. The
+* issuer remains the sole authority on both questions.
+*/
+function decodeClaims(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3) return void 0;
+	try {
+		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		if (typeof payload.exp !== "number") return void 0;
+		const user = payload.user;
+		const claims = { exp: payload.exp };
+		if (typeof user?.id === "string") claims.userId = user.id;
+		if (typeof user?.name === "string") claims.name = user.name;
+		return claims;
+	} catch {
+		return;
+	}
+}
+/** Milliseconds until the token expires; negative once it has. */
+function expiresInMs(claims, now = Date.now()) {
+	return claims.exp * 1e3 - now;
+}
+/** Warn inside the last day, and treat anything past it as already gone. */
+const EXPIRING_THRESHOLD_MS = 864e5;
+/** Classify a token's remaining lifetime for display. */
+function expiryLevel(claims, now = Date.now()) {
+	const remaining = expiresInMs(claims, now);
+	if (remaining <= 0) return "expired";
+	if (remaining <= EXPIRING_THRESHOLD_MS) return "expiring";
+	return "healthy";
+}
+/** Whole days left, rounded up so 1 hour reads as "1 day", not "0 days". */
+function daysRemaining(claims, now = Date.now()) {
+	const remaining = expiresInMs(claims, now);
+	return remaining <= 0 ? 0 : Math.ceil(remaining / 864e5);
+}
+/**
+* Parse the app's auth document into a state.
+*
+* Shared by the async and sync readers so the two can never disagree about what
+* counts as signed in.
+*
+* @param text - Raw file contents.
+* @param now - Clock, injected so expiry is testable.
+* @returns The usable credential, or why there is none.
+*/
+function parseAuthDocument(text, now = Date.now()) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return {
+			state: "signed-out",
+			reason: "unreadable"
+		};
+	}
+	const token = parsed.auth?.accessToken;
+	if (typeof token !== "string" || token.length === 0) return {
+		state: "signed-out",
+		reason: "not-signed-in"
+	};
+	const claims = decodeClaims(token);
+	if (claims === void 0) return {
+		state: "signed-out",
+		reason: "malformed"
+	};
+	if (expiresInMs(claims, now) <= 0) return {
+		state: "expired",
+		expiresAtMs: claims.exp * 1e3
+	};
+	return {
+		state: "signed-in",
+		credential: {
+			token,
+			claims,
+			updatedAtMs: typeof parsed.updatedAtMs === "number" ? parsed.updatedAtMs : void 0
+		}
+	};
+}
+/**
+* Read the desktop app's credential.
+*
+* Every failure mode is a state rather than an exception: a user who has not
+* installed or signed in yet is a normal condition the card renders, not an
+* error the host logs on every start.
+*
+* @param env - Environment used to locate the data directory.
+* @param now - Clock, injected so expiry is testable.
+* @returns The usable credential, or why there is none.
+*/
+async function readCredential(env = process.env, now = Date.now()) {
+	let text;
+	try {
+		text = await readFile(authPath(env), "utf8");
+	} catch {
+		return {
+			state: "signed-out",
+			reason: "app-missing"
+		};
+	}
+	return parseAuthDocument(text, now);
+}
+/**
+* The bearer token for the current request, or `undefined`.
+*
+* pi-ai's anthropic-messages client sends the resolved `apiKey` as `x-api-key`,
+* but MiniMax's gateway answers `{"code":401,"message":"token is required"}`
+* unless an `Authorization: Bearer` header is also present. That header has to
+* ride on the model descriptor ({@link Model.headers}), which is built inside
+* the provider's synchronous `getModels()` — hence the synchronous read here.
+* pi-ai calls `getModels()` once per operation, so the token is re-read per
+* request and a re-login takes effect without a restart.
+*
+* @param env - Environment used to locate the data directory.
+* @param now - Clock, injected so expiry is testable.
+* @returns The token, or `undefined` when there is no usable one.
+*/
+function bearerToken(env = process.env, now = Date.now()) {
+	let text;
+	try {
+		text = readFileSync(authPath(env), "utf8");
+	} catch {
+		return;
+	}
+	const state = parseAuthDocument(text, now);
+	return state.state === "signed-in" ? state.credential.token : void 0;
+}
+/**
+* Inert pi-ai auth plane.
+*
+* The minimaxcode route authenticates only through `resolveApiKey`, which reads
+* the desktop app's token per request, so pi-ai's own credential lifecycle and
+* ambient discovery must never manufacture a credential for it — otherwise a
+* stale or absent store would shadow the real token.
+*
+* `PiAiAdapterOptions.auth` is required and takes the pi-ai pair
+* `{ credentials, authContext }`, not a request-shaped object; every ambient
+* question here answers "nothing stored, nothing set", and a login is refused
+* outright rather than silently accepted.
+*/
+const INERT_AUTH = {
+	credentials: {
+		async read() {},
+		async list() {
+			return [];
+		},
+		async modify() {
+			throw new Error("dsh-connect-minimaxcode: the minimaxcode route has no pi-ai credential lifecycle");
+		},
+		async delete() {}
+	},
+	authContext: {
+		async env() {},
+		async fileExists() {
+			return false;
+		}
+	}
+};
+/** Provider id registered with DSH, distinct from the upstream one. */
+const MINIMAXCODE_PROVIDER_ID = "minimaxcode";
+/**
+* Used when the catalog cannot be fetched, so the picker still offers the
+* models the desktop app is known to ship.
+*
+* Deliberately small and conservative: a fallback entry overstates nothing we
+* could not confirm.
+*/
+const FALLBACK_MODELS = [{
+	id: "MiniMax-M2.7",
+	name: "M2.7",
+	contextWindow: 2e5,
+	maxOutputTokens: 128e3,
+	toolCall: true,
+	reasoning: true,
+	inputModalities: ["text"],
+	attachment: false
+}, {
+	id: "MiniMax-M3",
+	name: "M3",
+	contextWindow: 512e3,
+	maxOutputTokens: 128e3,
+	toolCall: true,
+	reasoning: true,
+	inputModalities: [
+		"text",
+		"image",
+		"video"
+	],
+	attachment: true
+}];
+/** Model with the same id, from a newer snapshot. */
+function sameCatalog(a, b) {
+	if (a.length !== b.length) return false;
+	return a.every((model, index) => {
+		const other = b[index];
+		return model.id === other.id && model.contextWindow === other.contextWindow && model.toolCall === other.toolCall && model.reasoning === other.reasoning && model.attachment === other.attachment;
+	});
+}
+/** Keep only models whose id the upstream keys them by. */
+function usable(id, raw) {
+	return id.length > 0 && id.startsWith("MiniMax-") && typeof raw === "object" && raw !== null;
+}
+/** Read the fields the upstream sends, tolerating their absence. */
+function readModel(id, raw) {
+	const limit = raw.limit ?? {};
+	const modalities = raw.modalities ?? {};
+	const input = Array.isArray(modalities.input) ? modalities.input.filter((m) => typeof m === "string") : ["text"];
+	const contextWindow = typeof limit.context === "number" ? limit.context : 2e5;
+	return {
+		id,
+		name: typeof raw.name === "string" ? raw.name : id,
+		contextWindow,
+		maxOutputTokens: typeof limit.output === "number" ? limit.output : void 0,
+		toolCall: raw.tool_call === true,
+		reasoning: raw.reasoning === true,
+		inputModalities: input,
+		attachment: raw.attachment === true || input.includes("image")
+	};
+}
+/**
+* Parse the upstream catalog document.
+*
+* Unknown providers are ignored rather than rejected: the endpoint serves every
+* provider the desktop app is configured for, and only MiniMax models belong in
+* this plugin's picker.
+*
+* @param document - Decoded response body.
+* @returns Models in upstream order, or an empty list when none qualify.
+*/
+function parseCatalog(document) {
+	if (typeof document !== "object" || document === null) return [];
+	const providers = document.providers;
+	if (!Array.isArray(providers)) return [];
+	const models = [];
+	for (const entry of providers) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const provider = entry;
+		if (provider.providerId !== "minimax") continue;
+		const declared = (provider.config ?? {}).models;
+		if (typeof declared !== "object" || declared === null) continue;
+		for (const [id, raw] of Object.entries(declared)) {
+			if (!usable(id, raw)) continue;
+			models.push(readModel(id, raw));
+		}
+	}
+	return models;
+}
+/**
+* Holds the catalog and answers the picker's questions about it.
+*
+* Refreshes are explicit: the plugin refreshes at startup and on demand, and
+* keeps serving the last good snapshot while a refresh is in flight, so a
+* network blip never empties the model list.
+*/
+var MinimaxCatalog = class {
+	#snapshot = {
+		models: [...FALLBACK_MODELS],
+		source: "fallback"
+	};
+	#inflight;
+	#lastIdentity;
+	/** The models to serve right now. */
+	current() {
+		return this.#snapshot.models;
+	}
+	/** Provenance of {@link current}. */
+	get source() {
+		return this.#snapshot.source;
+	}
+	/** When {@link current} was fetched, when it came from upstream. */
+	get fetchedAtMs() {
+		return this.#snapshot.fetchedAtMs;
+	}
+	/** Why the last refresh failed, if one did. */
+	get error() {
+		return this.#snapshot.error;
+	}
+	/**
+	* Replace the served list, adopting upstream's own ordering.
+	*
+	* @returns Whether anything changed, so callers can skip a needless reload.
+	*/
+	set(models, source, fetchedAtMs) {
+		if (source === this.#snapshot.source && sameCatalog(this.#snapshot.models, models)) {
+			if (source === "live") this.#snapshot.fetchedAtMs = fetchedAtMs ?? this.#snapshot.fetchedAtMs;
+			return false;
+		}
+		this.#snapshot = {
+			models: [...models],
+			source,
+			fetchedAtMs,
+			error: void 0
+		};
+		return true;
+	}
+	/** Drop back to the built-in list, e.g. when the account signs out. */
+	invalidate() {
+		this.#snapshot = {
+			models: [...FALLBACK_MODELS],
+			source: "fallback"
+		};
+	}
+	/**
+	* Fetch the live catalog for a credential.
+	*
+	* Serialised through a single in-flight promise: a second caller joins the
+	* first run rather than starting a duplicate request.
+	*
+	* @returns Whether the served list changed.
+	*/
+	async refresh(region, credential, fetchImpl = fetch) {
+		const identity = credential.claims.userId ?? credential.claims.exp.toString();
+		if (this.#inflight !== void 0) {
+			await this.#inflight;
+			return false;
+		}
+		this.#lastIdentity = identity;
+		this.#inflight = (async () => {
+			try {
+				const response = await fetchImpl(catalogUrl(region), { headers: { authorization: `Bearer ${credential.token}` } });
+				if (!response.ok) throw new Error(`HTTP ${response.status}`);
+				const models = parseCatalog(await response.json());
+				if (models.length === 0) throw new Error("catalog contained no MiniMax models");
+				this.set(models, "live", Date.now());
+			} catch (error) {
+				this.#snapshot.error = error instanceof Error ? error.message : String(error);
+				if (this.#snapshot.source !== "live") this.set(FALLBACK_MODELS, "fallback");
+			}
+		})();
+		try {
+			await this.#inflight;
+		} finally {
+			this.#inflight = void 0;
+		}
+		return true;
+	}
+	/** Identity the served catalog belongs to, if any. */
+	get identity() {
+		return this.#lastIdentity;
+	}
+};
+//#endregion
+//#region src/adapter.ts
+/**
+* Registering MiniMax Code's models as a DSH provider.
+*
+* The upstream endpoint is a standard Anthropic Messages API, so this plugin
+* reuses the shared pi-ai adapter rather than implementing a transport: the
+* work here is deciding *which* models to publish, pointing them at the right
+* base URL, and keeping that in step with the live catalog.
+*
+* @module dsh-connect-minimaxcode/adapter
+*/
+/** How long a silent stream may last before the transport gives up. */
+const MINIMAX_STREAM_IDLE_TIMEOUT_MS = 6e5;
+/**
+* Adapter-owned defaults a resolved route must carry.
+*
+* `PiAiAdapterOptions.profiles` wants a *resolved* route, so the image bounds
+* below are the schema's own defaults (20MiB base64 payload, 2048px pixel
+* budget, 1MiB per inline version). The retry policy is resolved by the
+* library's public helper rather than hand-written. Both were previously hidden
+* behind a cast, which is also what hid the missing required `auth` option.
+*/
+const REQUEST_IMAGE_BUDGETS = {
+	maxRequestImageBytes: 20971520,
+	requestImagePixelBudget: 4194304,
+	requestImageMaxBytes: 1048576
+};
+/** Unknown price, stated as zero rather than invented. */
+const NO_COST = {
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0
+};
+/**
+* Translate one catalog entry into the descriptor pi-ai expects.
+*
+* Capabilities come from upstream rather than being assumed, so a model that
+* loses tool support upstream stops advertising it here. `video` is dropped from
+* the declared input modalities because pi-ai models images, not video.
+*
+* Two gateway quirks are encoded here, both measured against the live endpoint:
+*
+* - `authorization` is why this descriptor carries `headers` at all. pi-ai's
+*   anthropic client sends the resolved apiKey as `x-api-key`, and MiniMax
+*   rejects that alone with 401 "token is required"; it accepts both headers, so
+*   the bearer value is added alongside rather than replacing it.
+* - `thinkingLevelMap.off = null` marks "thinking off" as unsupported. Every
+*   MiniMax model here requires reasoning, and pi-ai answers an explicit
+*   `thinkingEnabled: false` with `thinking: {type: "disabled"}`, which the
+*   gateway refuses with `400 ... requires adaptive thinking`. Marking the level
+*   unsupported makes pi-ai omit the field instead, which the gateway accepts
+*   (and, correctly, hides the option that cannot work).
+*
+* @param model - Catalog entry to describe.
+* @param baseUrl - Region gateway base the anthropic client extends.
+* @param authorization - Value for the `Authorization` header, when signed in.
+* @returns The pi-ai model descriptor.
+*/
+function toPiModel(model, baseUrl, authorization) {
+	const input = model.inputModalities.includes("image") ? ["text", "image"] : ["text"];
+	return {
+		id: model.id,
+		name: model.name,
+		api: "anthropic-messages",
+		provider: MINIMAXCODE_PROVIDER_ID,
+		baseUrl,
+		reasoning: model.reasoning,
+		input: [...input],
+		cost: { ...NO_COST },
+		contextWindow: model.contextWindow,
+		maxTokens: model.maxOutputTokens ?? 128e3,
+		...authorization === void 0 ? {} : { headers: { authorization } },
+		...model.reasoning ? { thinkingLevelMap: { off: null } } : {}
+	};
+}
+/**
+* Build the DSH adapter that serves the catalog.
+*
+* The model list is rebuilt on demand rather than snapshotted, which is what
+* lets a refresh upstream appear without restarting the host.
+*
+* @param options - Catalog, region and token resolution.
+* @returns The adapter plus a way to drop its cached profiles.
+*/
+function createMinimaxCodeAdapter(options) {
+	const { catalog } = options;
+	const buildModels = () => {
+		const token = options.bearerToken();
+		const authorization = token === void 0 ? void 0 : `Bearer ${token}`;
+		return catalog.current().map((model) => toPiModel(model, chatBaseUrl(options.region()), authorization));
+	};
+	const provider = {
+		...createProvider({
+			id: MINIMAXCODE_PROVIDER_ID,
+			name: "MiniMax Code",
+			auth: { apiKey: {
+				name: "MiniMax Code access token",
+				async resolve({ credential }) {
+					const apiKey = credential?.key;
+					return apiKey === void 0 || apiKey.length === 0 ? void 0 : {
+						auth: { apiKey },
+						source: "MiniMax Code"
+					};
+				}
+			} },
+			models: buildModels(),
+			api: anthropicMessagesApi()
+		}),
+		getModels: () => buildModels()
+	};
+	/**
+	* Build a fresh route map for the catalog and region of this moment.
+	*
+	* `getModels` already reads the live catalog on every call, so the model list
+	* needs no invalidation; what a refresh does invalidate is the per-model state
+	* carried by the route — configured maxTokens and recorded model errors, which
+	* would otherwise outlive a catalog or region change.
+	*/
+	const buildProfiles = () => {
+		const route = {
+			provider: MINIMAXCODE_PROVIDER_ID,
+			displayName: "MiniMax Code",
+			streamIdleTimeoutMs: MINIMAX_STREAM_IDLE_TIMEOUT_MS,
+			retryPolicy: resolveRetryPolicy(void 0, "dsh-connect-minimaxcode retryPolicy"),
+			configuredMaxTokens: /* @__PURE__ */ new Map(),
+			modelErrors: /* @__PURE__ */ new Map(),
+			...REQUEST_IMAGE_BUDGETS,
+			piProvider: provider
+		};
+		return /* @__PURE__ */ new Map([[MINIMAXCODE_PROVIDER_ID, route]]);
+	};
+	let profiles = buildProfiles();
+	return {
+		adapter: new PiAiAdapter({
+			profiles: () => profiles,
+			resolveApiKey: options.resolveApiKey,
+			auth: INERT_AUTH
+		}),
+		invalidate: () => {
+			profiles = buildProfiles();
+		}
+	};
+}
+//#endregion
+//#region src/status-route.ts
+/** Route this plugin mounts, matching its settings card. */
+const MINIMAX_STATUS_PATH = "/plugins/dsh-connect-minimaxcode/status";
+const HINTS = {
+	"app-missing": "未找到 MiniMax Code 的登录信息。请先安装并登录 MiniMax Code 桌面 App，然后重启 DSH。",
+	"not-signed-in": "MiniMax Code 尚未登录。请在 MiniMax Code 桌面 App 中登录后重启 DSH。",
+	unreadable: "登录信息文件无法读取。请确认 MiniMax Code 仍处于登录状态。",
+	malformed: "登录令牌格式无法解析。请在 MiniMax Code 中重新登录后重启 DSH。"
+};
+/**
+* Build the card's status document.
+*
+* The three non-signed-in states carry different remedies, and the difference
+* is the whole point of the card: a user who has never installed the app needs
+* a different next step than one whose token simply aged out.
+*/
+function statusDocument(deps) {
+	const { auth } = deps;
+	const base = {
+		state: auth.state,
+		region: deps.region,
+		catalogSource: deps.catalogSource,
+		...deps.catalogError === void 0 ? {} : { catalogError: deps.catalogError },
+		models: deps.models,
+		refreshing: deps.refreshing
+	};
+	if (auth.state === "expired") return {
+		...base,
+		expiry: "expired",
+		daysRemaining: 0,
+		hint: "登录令牌已过期。请打开并登录 MiniMax Code 桌面 App 以获取新令牌，然后重启 DSH。"
+	};
+	if (auth.state === "signed-out") return {
+		...base,
+		hint: HINTS[auth.reason ?? "not-signed-in"] ?? HINTS["not-signed-in"]
+	};
+	return {
+		...base,
+		expiry: auth.expiry,
+		daysRemaining: auth.daysRemaining
+	};
+}
+/** Only loopback callers may read the document. */
+function isLoopback(host) {
+	if (host === void 0) return false;
+	const name = host.replace(/:\d+$/, "");
+	return name === "127.0.0.1" || name === "localhost" || name === "[::1]" || name === "::1";
+}
+//#endregion
+//#region src/index.ts
+/** Loader entry name; also the id the bundle patch inserts. */
+const name = "dsh-connect-minimaxcode";
+/** Services this plugin needs before it can serve anything. */
+const inject = ["llm"];
+/** Which gateway a given account should be served from. */
+function pickRegion(preferred) {
+	if (preferred !== void 0 && MINIMAX_REGIONS.includes(preferred)) return preferred;
+	return "cn";
+}
+/** How often the card may pull a fresh catalog. */
+const CATALOG_TTL_MS = 3e5;
+/**
+* Compose the plugin.
+*
+* The credential is re-read on every request rather than cached at start: the
+* desktop app refreshes its token independently, and a long-lived host would
+* otherwise pin an expired one for the rest of the process.
+*
+* @param ctx - Service container.
+*/
+function apply(ctx) {
+	const catalog = new MinimaxCatalog();
+	let region = "cn";
+	let credential;
+	let lastCatalogAtMs = 0;
+	let refreshing = false;
+	const readNow = async () => {
+		const state = await readCredential();
+		if (state.state !== "signed-in") {
+			credential = void 0;
+			catalog.invalidate();
+			return;
+		}
+		credential = state.credential;
+		return credential;
+	};
+	/** Refresh the catalog at most once per TTL, never blocking a request. */
+	const refreshCatalog = async (current) => {
+		if (refreshing || Date.now() - lastCatalogAtMs < CATALOG_TTL_MS) return;
+		refreshing = true;
+		try {
+			await catalog.refresh(region, current);
+			lastCatalogAtMs = Date.now();
+		} finally {
+			refreshing = false;
+		}
+	};
+	const { adapter, invalidate } = createMinimaxCodeAdapter({
+		catalog,
+		region: () => region,
+		resolveApiKey: async () => (await readNow())?.token,
+		bearerToken: () => bearerToken()
+	});
+	ctx.llm.registerAdapter(["minimaxcode"], adapter);
+	/** Build the document the card renders, without ever exposing the token. */
+	const buildStatus = async () => {
+		const state = await readCredential();
+		return statusDocument({
+			auth: state.state === "signed-in" ? {
+				state: "signed-in",
+				daysRemaining: Math.ceil(expiresInMs(state.credential.claims) / 864e5),
+				expiry: expiryLevel(state.credential.claims)
+			} : state.state === "expired" ? { state: "expired" } : {
+				state: "signed-out",
+				reason: state.reason
+			},
+			region,
+			catalogSource: catalog.source,
+			catalogError: catalog.error,
+			models: catalog.current().map(({ id, name: modelName, contextWindow }) => ({
+				id,
+				name: modelName,
+				contextWindow
+			})),
+			refreshing
+		});
+	};
+	(async () => {
+		const current = await readNow();
+		if (current !== void 0) {
+			region = pickRegion(void 0);
+			await refreshCatalog(current);
+			invalidate();
+		}
+	})();
+	ctx.inject(["webServer"], (webCtx) => {
+		webCtx.effect(() => webCtx.webServer.register({
+			kind: "exact",
+			path: MINIMAX_STATUS_PATH,
+			handler: async (req, res) => {
+				if (!isLoopback(req.headers.host)) {
+					res.writeHead(403, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: "loopback only" }));
+					return;
+				}
+				try {
+					res.writeHead(200, { "Content-Type": "application/json" });
+					res.end(JSON.stringify(await buildStatus()));
+				} catch (error) {
+					res.writeHead(500, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+				}
+			}
+		}));
+	});
+}
+//#endregion
+export { FALLBACK_MODELS, MINIMAXCODE_PROVIDER_ID, MINIMAX_AUTH_FILENAME, MINIMAX_DATA_DIR, MINIMAX_GATEWAYS, MINIMAX_REGIONS, MINIMAX_STATUS_PATH, MINIMAX_STREAM_IDLE_TIMEOUT_MS, MinimaxCatalog, apply, authPath, bearerToken, catalogUrl, chatBaseUrl, createMinimaxCodeAdapter, dataDir, daysRemaining, decodeClaims, expiresInMs, expiryLevel, inject, name, parseAuthDocument, parseCatalog, readCredential, statusDocument };

package/package.json

@@ -1,6 +1,80 @@
-{
-  "name": "dsh-connect-minimaxcode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+{
+  "name": "dsh-connect-minimaxcode",
+  "displayName": "DSH Connect MiniMax Code",
+  "description": "把本机已登录的 MiniMax Code 桌面 App 的模型接入 DeepSeek Harness：复用其登录态，提供 Anthropic Messages 兼容接入与动态模型目录。",
+  "version": "0.2.1",
+  "author": "JeffTsuiCUG",
+  "license": "MIT",
+  "private": false,
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/JeffTsuiCUG/dsh-connect-minimaxcode.git"
+  },
+  "homepage": "https://github.com/JeffTsuiCUG/dsh-connect-minimaxcode#readme",
+  "bugs": {
+    "url": "https://github.com/JeffTsuiCUG/dsh-connect-minimaxcode/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "prepack": "npm run build",
+    "build": "tsdown",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "check": "npm run typecheck && npm run test && npm run build"
+  },
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "minimax",
+    "minimax-code",
+    "model-provider"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.4 <5.0.0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.7-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1 <0.3.0-0",
+    "@deepseek-ai/schemastery": ">=3.18.4 <4.0.0",
+    "@earendil-works/pi-ai": ">=0.85.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/schemastery": "3.18.4",
+    "@earendil-works/pi-ai": "^0.85.1",
+    "@types/node": "^22.20.0",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.8"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
 }