dsh-connect-minimaxcode 0.5.4 → 0.5.6

package/lib/index.js

@@ -693,7 +693,9 @@ const HINTS = {
 	"app-missing": "未找到 MiniMax Code 的登录信息。请先安装并登录 MiniMax Code 桌面 App，然后重启 DSH。",
 	"not-signed-in": "MiniMax Code 尚未登录。请在 MiniMax Code 桌面 App 中登录后重启 DSH。",
 	unreadable: "登录信息文件无法读取。请确认 MiniMax Code 仍处于登录状态。",
-	malformed: "登录令牌格式无法解析。请在 MiniMax Code 中重新登录后重启 DSH。"
+	malformed: "登录令牌格式无法解析。请在 MiniMax Code 中重新登录后重启 DSH。",
+	"credential-revoked": "登录凭据已被服务器撤销，模型请求无法通过。请点击下方登录按钮重新登录 MiniMax Code。",
+	"credential-expired": "登录凭据已过期。请点击下方登录按钮重新登录 MiniMax Code。"
 };
 /**
 * Build the card's status document.
@@ -712,6 +714,7 @@ function statusDocument(deps) {
 		models: deps.models,
 		refreshing: deps.refreshing,
 		...deps.credits === void 0 ? {} : { credits: deps.credits },
+		...deps.rateLimit === void 0 ? {} : { rateLimit: deps.rateLimit },
 		...deps.usage === void 0 ? {} : { usage: deps.usage },
 		...deps.signin === void 0 ? {} : { signin: deps.signin },
 		...deps.login === void 0 ? {} : { login: deps.login }
@@ -720,7 +723,7 @@ function statusDocument(deps) {
 		...base,
 		expiry: "expired",
 		daysRemaining: 0,
-		hint: "登录令牌已过期。请打开并登录 MiniMax Code 桌面 App 以获取新令牌，然后重启 DSH。"
+		hint: HINTS[auth.reason ?? ""] ?? "登录令牌已过期。请打开并登录 MiniMax Code 桌面 App 以获取新令牌，然后重启 DSH。"
 	};
 	if (auth.state === "signed-out") return {
 		...base,
@@ -780,10 +783,18 @@ const MINIMAX_ACCOUNT_HOSTS = {
 	io: "https://agent.minimax.io",
 	com: "https://agent.minimaxi.com"
 };
+/** Open-platform account API, which serves the per-model usage summary. */
+const MINIMAX_OPEN_HOSTS = {
+	cn: "https://www.minimaxi.com",
+	io: "https://www.minimaxi.com",
+	com: "https://www.minimaxi.com"
+};
 /** Membership endpoint: carries the credit summary. */
 const MEMBERSHIP_PATH = "/matrix/api/v1/commerce/get_membership_info";
 /** Credit ledger endpoint: per-grant amounts and expiry. */
 const CREDIT_DETAILS_PATH = "/minimax-cloud/api/v1/credit/details";
+/** Rate-limit window endpoint: the 5-hour and weekly usage the plan meters. */
+const REMAINS_PERCENT_PATH = "/backend/account/token_plan/remains_percent";
 /** OAuth token endpoint. */
 const TOKEN_PATH$1 = "/oauth2/token";
 /** Absolute path of the app's credential file for a region. */
@@ -1088,6 +1099,84 @@ async function fetchCreditLots(credential, region, fetchImpl = fetch) {
 	return lots;
 }
 /**
+* Read the two rate-limit windows out of a remains-percent response.
+*
+* The upstream answers with one entry per metered group; the general one is
+* the only one the plan meters today, and the first entry is used when it is
+* absent. The percents arrive as strings ("19%"), and the counts arrive as -1
+* when the plan does not meter by count, so only the percents and the window
+* edges are read. The window length is derived from the entry's own endpoints
+* rather than assumed to be five hours or seven days — the plan's terms have
+* changed before, and the display should follow whatever the server says.
+*
+* A window the server marks as unlimited (`current_*_status` of 3) carries no
+* allowance to be a percentage of, so it produces no window at all: reporting
+* "0%" of an unlimited quota would be a number nobody can act on.
+*/
+function parseRateLimitWindows(document) {
+	if (typeof document !== "object" || document === null) return void 0;
+	const remains = document.model_remains;
+	if (!Array.isArray(remains) || remains.length === 0) return void 0;
+	const entry = remains.find((item) => typeof item === "object" && item !== null && item.model_name === "general") ?? remains[0];
+	if (typeof entry !== "object" || entry === null) return void 0;
+	const record = entry;
+	const interval = readWindow(record.current_interval_used_percent, record.start_time, record.end_time, record.current_interval_status);
+	const weekly = readWindow(record.current_weekly_used_percent, record.weekly_start_time, record.weekly_end_time, record.current_weekly_status);
+	if (interval === void 0 || weekly === void 0) return void 0;
+	return {
+		interval,
+		weekly
+	};
+}
+/**
+* The status the upstream gives a window that is not limited at all.
+*
+* The desktop app reads it the same way: `isUnlimited: 3 === status`.
+*/
+const UNLIMITED_STATUS = 3;
+/** Assemble one window from its percent and edge fields; all must be present. */
+function readWindow(percent, startAtMs, resetAtMs, status) {
+	if (status === UNLIMITED_STATUS) return void 0;
+	const usedPercent = parsePercent(percent);
+	const start = toNumber$1(startAtMs);
+	const reset = toNumber$1(resetAtMs);
+	if (usedPercent === void 0 || start === void 0 || reset === void 0) return void 0;
+	return {
+		usedPercent,
+		startAtMs: start,
+		resetAtMs: reset
+	};
+}
+/**
+* Read "19%" as 19, and a bare 19 as 19 as well.
+*
+* The desktop app parses both shapes, so both are accepted here: anything
+* unreadable stays unreadable rather than becoming a zero.
+*/
+function parsePercent(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value !== "string") return void 0;
+	const parsed = Number(value.replace(/%\s*$/, ""));
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Fetch the plan's two rate-limit windows.
+*
+* The endpoint lives on the open-platform host, like the usage summary, and
+* answers the same OAuth credential the membership endpoint takes. The JWT the
+* model gateway accepts does not work here: this is an account endpoint.
+*
+* @returns The windows, or `undefined` when the response carries none.
+*/
+async function fetchRateLimitWindows(credential, region, fetchImpl = fetch) {
+	const response = await fetchImpl(`${MINIMAX_OPEN_HOSTS[region]}${REMAINS_PERCENT_PATH}?business=Agent&device_platform=desktop`, { headers: {
+		accept: "application/json",
+		authorization: `Bearer ${credential.token}`
+	} });
+	if (!response.ok) throw new Error(`rate-limit window request failed: HTTP ${response.status}`);
+	return parseRateLimitWindows(await response.json());
+}
+/**
 * Summarize what is about to expire.
 *
 * Only lots that still hold credits count: a lot that was granted and used up
@@ -1124,6 +1213,9 @@ var MinimaxCredits = class {
 	#expiry;
 	#ledgerAtMs;
 	#ledgerError;
+	#rateLimit;
+	#rateLimitError;
+	#rateLimitAtMs;
 	/** The balance as last read. */
 	get snapshot() {
 		return this.#snapshot;
@@ -1148,12 +1240,26 @@ var MinimaxCredits = class {
 	get ledgerError() {
 		return this.#ledgerError;
 	}
+	/** The plan's rate-limit windows as last read. */
+	get rateLimit() {
+		return this.#rateLimit;
+	}
+	/** Why the windows could not be read, when they could not. */
+	get rateLimitError() {
+		return this.#rateLimitError;
+	}
+	/** When the windows were last read. */
+	get rateLimitAtMs() {
+		return this.#rateLimitAtMs;
+	}
 	/**
 	* Read the balance and record how much was consumed since the last read.
 	*
 	* The credit ledger is read alongside it, but a ledger that cannot be read
 	* never hides the balance: the two come from different endpoints and only
-	* the balance is essential.
+	* the balance is essential. The rate-limit windows ride along under the
+	* same rule — they come from yet another endpoint, and none of the three
+	* takes the others down with it.
 	*
 	* @returns Whether the balance changed.
 	*/
@@ -1176,6 +1282,7 @@ var MinimaxCredits = class {
 			this.#error = error instanceof Error ? error.message : String(error);
 		}
 		await this.refreshLedger(credential, region, fetchImpl, now);
+		await this.refreshRateLimit(credential, region, fetchImpl, now);
 		return changed;
 	}
 	/**
@@ -1196,6 +1303,22 @@ var MinimaxCredits = class {
 			this.#ledgerError = error instanceof Error ? error.message : String(error);
 		}
 	}
+	/**
+	* Read the plan's rate-limit windows.
+	*
+	* Same rule as the ledger: a failure is remembered but never thrown, and a
+	* window that cannot be read leaves the last one on display.
+	*/
+	async refreshRateLimit(credential, region, fetchImpl = fetch, now = Date.now()) {
+		try {
+			const windows = await fetchRateLimitWindows(credential, region, fetchImpl);
+			this.#rateLimit = windows;
+			this.#rateLimitError = windows === void 0 ? "response carried no rate-limit windows" : void 0;
+			this.#rateLimitAtMs = now;
+		} catch (error) {
+			this.#rateLimitError = error instanceof Error ? error.message : String(error);
+		}
+	}
 };
 //#endregion
 //#region src/credentials.ts
@@ -1284,6 +1407,11 @@ async function readPluginCredential(env = process.env) {
 async function writePluginCredential(credential, env = process.env) {
 	await writePrivate(pluginCredentialPath(env), credential);
 }
+/** Remove the plugin's own credential, which is what signing out means. */
+async function deletePluginCredential(env = process.env) {
+	const { rm } = await import("node:fs/promises");
+	await rm(pluginCredentialPath(env), { force: true });
+}
 /** Read the plugin's own state. */
 async function readPluginState(env = process.env) {
 	let text;
@@ -1891,6 +2019,25 @@ var UsageMeter = class {
 //#endregion
 //#region src/index.ts
 /** Loader entry name; also the id the bundle patch inserts. */
+/**
+* Whether a message says the server refused the credential itself.
+*
+* The account and catalog endpoints answer a revoked or unknown bearer with
+* `401`, and the only place that surfaces is the message the request layer
+* built. Matching the status code rather than the wording keeps this working
+* whatever language the message is written in.
+*/
+const isUnauthorized = (message) => message !== void 0 && /\bHTTP 401\b/.test(message);
+/**
+* Whether a failed refresh means the credential can never be used again.
+*
+* The authorization server answers a revoked or already-spent refresh token
+* with `400`/`401`, and a credential that carries no refresh token can never
+* be renewed at all. Both are final. A `5xx` or a dropped connection is not:
+* throwing the credential away over a bad minute upstream would sign the
+* person out for nothing.
+*/
+const isRefreshRefused = (message) => message.includes("没有可用于续期的 refresh token") || /\bHTTP (400|401)\b/.test(message);
 const name = "dsh-connect-minimaxcode";
 /** Services this plugin needs before it can serve anything. */
 const inject = ["llm"];
@@ -1951,14 +2098,50 @@ function apply(ctx) {
 	let loginSource;
 	/** Whether a device login is waiting to be authorized. */
 	let loginPending = false;
+	/** Whether the server refused the plugin's own credential. */
+	let revokedByServer = false;
+	/**
+	* Give up on the plugin's own credential after the server refused it.
+	*
+	* A revoked token keeps its expiry date, so every later call would send the
+	* same dead token and fail the same way. The only way back is a new sign-in,
+	* so the credential is deleted, the cached views of the account it belonged
+	* to are dropped, and the card is left asking for one.
+	*/
+	const revokePluginCredential = async () => {
+		await deletePluginCredential();
+		if (pluginState.deviceLogin !== void 0) {
+			pluginState = {
+				...pluginState,
+				deviceLogin: void 0
+			};
+			await writePluginState(pluginState);
+		}
+		revokedByServer = true;
+		modelToken = void 0;
+		loginSource = void 0;
+		loginPending = false;
+		creditState = "signed-out";
+		signinPanel = void 0;
+		signinClaim = void 0;
+		signinError = void 0;
+		catalog.invalidate();
+		lastCreditAtMs = Date.now();
+		lastSigninAtMs = Date.now();
+		lastCatalogAtMs = 0;
+	};
 	/**
 	* The credential the model gateway is called with.
 	*
 	* The plugin's own sign-in comes first: it is the credential the person
 	* chose, and on a machine where the desktop app was never installed it is
-	* the only one there is. The desktop app's token is the fallback, and the
-	* two are interchangeable as far as the gateway is concerned — it accepts
-	* either bearer.
+	* the only one there is.
+	*
+	* The desktop app's OAuth grant is next, and it is not a mere fallback: it
+	* is the credential a current install actually holds. Its `mmoat_` bearer is
+	* what the gateway accepts, while the legacy JWT older installs left behind
+	* is refused with `401 auth failed` — so the OAuth file has to be consulted
+	* before that JWT, or a working machine looks broken.
 	*/
 	const resolveGatewayCredential = async () => {
 		const own = await readPluginCredential();
@@ -1968,11 +2151,18 @@ function apply(ctx) {
 				await writePluginCredential(next);
 				loginSource = "plugin";
 				modelToken = next.accessToken;
+				revokedByServer = false;
 				return {
 					token: next.accessToken,
 					claims: { exp: Math.floor((next.expiresAtMs ?? Date.now()) / 1e3) }
 				};
-			} catch {}
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				if (isRefreshRefused(message)) {
+					await revokePluginCredential();
+					return;
+				}
+			}
 			else {
 				loginSource = "plugin";
 				modelToken = own.accessToken;
@@ -1982,6 +2172,15 @@ function apply(ctx) {
 				};
 			}
 		}
+		const oauth = await ensureOAuthCredential(region, process.env);
+		if (oauth.state === "signed-in") {
+			loginSource = "desktop-app";
+			modelToken = oauth.credential.token;
+			return {
+				token: oauth.credential.token,
+				claims: { exp: Math.floor((oauth.credential.expiresAtMs ?? Date.now()) / 1e3) }
+			};
+		}
 		const state = await readCredential();
 		if (state.state !== "signed-in") {
 			loginSource = void 0;
@@ -2009,7 +2208,15 @@ function apply(ctx) {
 					state: "signed-in",
 					credential: toOAuthCredential(next)
 				};
-			} catch {
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				if (isRefreshRefused(message)) {
+					await revokePluginCredential();
+					return {
+						state: "signed-out",
+						reason: "not-signed-in"
+					};
+				}
 				return {
 					state: "expired",
 					credential: toOAuthCredential(own)
@@ -2064,6 +2271,15 @@ function apply(ctx) {
 		}
 		await credits.refresh(state.credential, region, fetch, now);
 		creditState = credits.snapshot === void 0 ? "unavailable" : "ok";
+		if ([
+			credits.error,
+			credits.ledgerError,
+			credits.rateLimitError
+		].find((message) => isUnauthorized(message)) !== void 0) {
+			await revokePluginCredential();
+			return;
+		}
+		if (credits.snapshot !== void 0) revokedByServer = false;
 	};
 	/**
 	* Read the check-in cycle, and claim the day's grant when asked to.
@@ -2089,7 +2305,12 @@ function apply(ctx) {
 			signinPanel = panel;
 			signinError = void 0;
 		} catch (error) {
-			signinError = error instanceof Error ? error.message : String(error);
+			const message = error instanceof Error ? error.message : String(error);
+			if (isUnauthorized(message)) {
+				await revokePluginCredential();
+				return;
+			}
+			signinError = message;
 			return;
 		}
 		if (!pluginState.autoCheckin || panel === void 0) return;
@@ -2120,7 +2341,12 @@ function apply(ctx) {
 			refreshCredits();
 			return claim;
 		} catch (error) {
-			signinError = error instanceof Error ? error.message : String(error);
+			const message = error instanceof Error ? error.message : String(error);
+			if (isUnauthorized(message)) {
+				await revokePluginCredential();
+				return;
+			}
+			signinError = message;
 			return;
 		}
 	};
@@ -2150,6 +2376,21 @@ function apply(ctx) {
 			...credits.ledgerError === void 0 ? {} : { ledgerError: credits.ledgerError }
 		};
 	};
+	/** The plan's rolling usage windows as the card reads them. */
+	const buildRateLimitStatus = () => {
+		if (creditState === "signed-out" || creditState === "expired") return { state: creditState };
+		const windows = credits.rateLimit;
+		if (windows === void 0) return {
+			state: "unavailable",
+			...credits.rateLimitError === void 0 ? {} : { error: credits.rateLimitError }
+		};
+		return {
+			state: "ok",
+			interval: windows.interval,
+			weekly: windows.weekly,
+			...credits.rateLimitAtMs === void 0 ? {} : { updatedAtMs: credits.rateLimitAtMs }
+		};
+	};
 	/** What this host's own requests have used. */
 	const buildUsageStatus = () => {
 		const totals = meter.totals();
@@ -2227,21 +2468,47 @@ function apply(ctx) {
 		}
 	});
 	ctx.llm.registerAdapter(["minimaxcode"], adapter);
-	/** Build the document the card renders, without ever exposing the token. */
-	const buildStatus = async () => {
+	/**
+	* The sign-in state the card reports.
+	*
+	* It describes the credential the gateway will actually be called with, not
+	* a particular file on disk: the card exists to answer "will a request
+	* work", and a token the server refused is not a sign-in however unexpired
+	* it looks. Reading the legacy JWT alone is what made a machine whose model
+	* gateway was working report a signed-out, expired card.
+	*/
+	const buildAuthStatus = async () => {
+		if (revokedByServer) return {
+			state: "signed-out",
+			reason: "credential-revoked"
+		};
+		const current = await readNow();
+		if (current !== void 0) {
+			const remaining = expiresInMs(current.claims);
+			if (remaining <= 0) return {
+				state: "expired",
+				reason: "credential-expired"
+			};
+			return {
+				state: "signed-in",
+				daysRemaining: Math.ceil(remaining / 864e5),
+				expiry: expiryLevel(current.claims)
+			};
+		}
 		const state = await readCredential();
-		const auth = state.state === "signed-in" ? {
-			state: "signed-in",
-			daysRemaining: Math.ceil(expiresInMs(state.credential.claims) / 864e5),
-			expiry: expiryLevel(state.credential.claims)
-		} : state.state === "expired" ? { state: "expired" } : {
+		if (state.state === "expired") return { state: "expired" };
+		if (state.state === "signed-out") return {
 			state: "signed-out",
 			reason: state.reason
 		};
+		return { state: "signed-in" };
+	};
+	/** Build the document the card renders, without ever exposing the token. */
+	const buildStatus = async () => {
 		await refreshCredits();
 		await refreshSignin();
 		return statusDocument({
-			auth,
+			auth: await buildAuthStatus(),
 			region,
 			catalogSource: catalog.source,
 			catalogError: catalog.error,
@@ -2252,6 +2519,7 @@ function apply(ctx) {
 			})),
 			refreshing,
 			credits: buildCreditStatus(),
+			rateLimit: buildRateLimitStatus(),
 			usage: buildUsageStatus(),
 			signin: buildSigninStatus(),
 			login: buildLoginStatus()
@@ -2328,6 +2596,7 @@ function apply(ctx) {
 					};
 					await writePluginState(pluginState);
 					loginPending = false;
+					revokedByServer = false;
 					loginSource = "plugin";
 					modelToken = result.credential.accessToken;
 					catalog.invalidate();
@@ -2445,4 +2714,4 @@ async function readRequestBody(req) {
 	return text;
 }
 //#endregion
-export { DEVICE_CODE_GRANT, DEVICE_CODE_PATH, EMPTY_USAGE, FALLBACK_MODELS, MEMBERSHIP_PATH, MINIMAXCODE_PROVIDER_ID, MINIMAX_ACTION_PATH, MINIMAX_AUTH_FILENAME, MINIMAX_DATA_DIR, MINIMAX_GATEWAYS, MINIMAX_OAUTH_CLIENT_ID, MINIMAX_REGIONS, MINIMAX_STATUS_PATH, MINIMAX_STREAM_IDLE_TIMEOUT_MS, MODEL_PRICES, MinimaxCatalog, MinimaxCredits, PLUGIN_CREDENTIAL_FILENAME, PLUGIN_STATE_FILENAME, SIGNIN_CLAIM_PATH, SIGNIN_CLAIM_RESULT, SIGNIN_CYCLE_DAYS, SIGNIN_DAY_STATUS, SIGNIN_PANEL_PATH, UsageMeter, apply, authPath, bearerToken, catalogUrl, chatBaseUrl, claimSignin, createMinimaxCodeAdapter, dataDir, daysRemaining, decodeClaims, dshHome, ensureOAuthCredential, estimateCny, expiresInMs, expiryLevel, fetchCreditSummary, fetchSigninPanel, inject, localDay, makePkce, name, parseAuthDocument, parseCatalog, parseCreditSummary, parseOAuthDocument, parseSigninClaim, parseSigninPanel, pluginCredentialPath, pluginStatePath, pollDeviceLogin, priceFor, readCredential, readOAuthCredential, readPluginCredential, readPluginState, refreshOAuthCredential, refreshPluginCredential, startDeviceLogin, statusDocument, timezoneId, writeOAuthCredential, writePluginCredential, writePluginState };
+export { DEVICE_CODE_GRANT, DEVICE_CODE_PATH, EMPTY_USAGE, FALLBACK_MODELS, MEMBERSHIP_PATH, MINIMAXCODE_PROVIDER_ID, MINIMAX_ACTION_PATH, MINIMAX_AUTH_FILENAME, MINIMAX_DATA_DIR, MINIMAX_GATEWAYS, MINIMAX_OAUTH_CLIENT_ID, MINIMAX_REGIONS, MINIMAX_STATUS_PATH, MINIMAX_STREAM_IDLE_TIMEOUT_MS, MODEL_PRICES, MinimaxCatalog, MinimaxCredits, PLUGIN_CREDENTIAL_FILENAME, PLUGIN_STATE_FILENAME, REMAINS_PERCENT_PATH, SIGNIN_CLAIM_PATH, SIGNIN_CLAIM_RESULT, SIGNIN_CYCLE_DAYS, SIGNIN_DAY_STATUS, SIGNIN_PANEL_PATH, UsageMeter, apply, authPath, bearerToken, catalogUrl, chatBaseUrl, claimSignin, createMinimaxCodeAdapter, dataDir, daysRemaining, decodeClaims, deletePluginCredential, dshHome, ensureOAuthCredential, estimateCny, expiresInMs, expiryLevel, fetchCreditSummary, fetchRateLimitWindows, fetchSigninPanel, inject, localDay, makePkce, name, parseAuthDocument, parseCatalog, parseCreditSummary, parseOAuthDocument, parseRateLimitWindows, parseSigninClaim, parseSigninPanel, pluginCredentialPath, pluginStatePath, pollDeviceLogin, priceFor, readCredential, readOAuthCredential, readPluginCredential, readPluginState, refreshOAuthCredential, refreshPluginCredential, startDeviceLogin, statusDocument, timezoneId, writeOAuthCredential, writePluginCredential, writePluginState };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-minimaxcode",
   "displayName": "DSH Connect MiniMax Code",
   "description": "把本机已登录的 MiniMax Code 桌面 App 模型接入 DeepSeek Harness：零配置、Anthropic Messages 兼容、动态模型目录，并显示积分余额与到期 — bring MiniMax Code desktop app models into DSH with a dynamic model catalog and a credit balance with expiry details.",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "author": "JeffTsuiCUG",
   "contributors": [
     {
@@ -13,9 +13,13 @@
       "name": "eghrhegpe",
       "url": "https://github.com/eghrhegpe"
     },
+    {
+      "name": "qzz19970504",
+      "url": "https://github.com/qzz19970504"
+    },
     {
-      "name": "qzz19970504",
-      "url": "https://github.com/qzz19970504"
+      "name": "azsora",
+      "url": "https://github.com/azsora"
     }
   ],
   "license": "MIT",