dsh-grok-subscription 1.0.11 → 1.0.18

package/README.en.md

@@ -31,7 +31,7 @@ Models, reasoning effort, and weekly quota all stay inside DSH.
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
    ```
 
-2. **Sign in to the subscription.** Open **Settings → Grok Subscription** and click **CLI login** or **Device-code login**, then finish the official prompt in the terminal that started DSH. If you already ran `grok login` yourself, just click **Pull from Grok CLI** — nothing has to be pasted.
+2. **Sign in to the subscription.** Open **Settings → Grok Subscription** and click **CLI login** or **Device-code login**. The plugin runs the official `grok login`, hands the link the CLI prints to your browser, and shows the one-time code plus a clickable link in the panel; the session syncs itself once you authorize. If you already ran `grok login` yourself, just click **Pull from Grok CLI** — nothing has to be pasted.
 3. **Start using it.** Pick a model such as Grok 4.7 in the model picker. The round badge next to the picker shows weekly remaining quota, and the model menu offers reasoning effort levels.
 
 Restart `dsh web` after installing or upgrading, otherwise the old `lib/` keeps running.
@@ -209,6 +209,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 
 - **`dsh` is not recognized**: the official npm route never creates a global `dsh` command — use the full `npx -y @deepseek-ai/dsh@0.1.5-rc.2 ...` command above;
 - **The model list is empty**: nothing is exposed while signed out. Finish signing in, then click **Pull from Grok CLI**;
+- **Sign-in opens no browser / chat fails with `fetch failed` / usage says "Billing request timed out"**: all three have one cause — `accounts.x.ai` and `cli-chat-proxy.grok.com` need a tunnel on some networks. Add `GROK_PROXY=http://127.0.0.1:10808` to `~/.dsh/.env`: it applies to **this plugin's Grok requests** (catalog, usage, chat) and to the **`grok` CLI** it spawns (sign-in, renewal), while DSH and every other provider stay direct — an `http_proxy` line there would route them all through the tunnel and break them whenever it is down. Restart the client afterwards; the sign-in link is handed to your browser and the panel also shows the one-time code and a clickable link. Standard proxy variables already present in the environment are inherited by the CLI too;
 - **Nothing changed after upgrading**: the plugin keeps running the old `lib/` — reinstall the plugin, restart `dsh web`, and hard-refresh (Ctrl+Shift+R);
 - **It reports `auth.json` permissions**: apply the `chmod 600` above; the plugin refuses symlinks and group- or other-readable files;
 - **"No reply" after sending a message**: upgrade to `1.0.1` or later. `1.0.0` had a defect where tool-calling turns aborted with a non-serializable stream chunk, leaving no reply in the UI at all.

package/README.md

@@ -31,7 +31,7 @@
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
    ```
 
-2. **登录订阅**：打开 **设置 → Grok 订阅**，点击 **CLI 登录** 或 **设备码登录**，在启动 DSH 的终端里完成官方提示。已经自己跑过 `grok login` 的话，直接点 **从 Grok CLI 拉取** 即可，不需要粘贴任何 token。
+2. **登录订阅**：打开 **设置 → Grok 订阅**，点击 **CLI 登录** 或 **设备码登录**。插件会运行官方 `grok login`，把 CLI 打印的登录链接交给浏览器，并在面板里显示一次性验证码与可点的链接；授权完成后自动同步。已经自己跑过 `grok login` 的话，直接点 **从 Grok CLI 拉取** 即可，不需要粘贴任何 token。
 3. **开始使用**：在模型选择器中选择 Grok 4.7 等模型。输入框旁的圆形徽章显示每周剩余额度，模型菜单里有推理档位。
 
 安装或升级后需要重启 `dsh web`，否则会继续运行旧的 `lib/`。
@@ -209,6 +209,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 
 - **`dsh` 无法识别**：官方 npm 方式本来就不会创建全局 `dsh` 命令，请使用上面的完整 `npx -y @deepseek-ai/dsh@0.1.5-rc.2 ...` 命令；
 - **模型列表是空的**：未登录时插件不暴露任何模型。先完成登录，再点 **从 Grok CLI 拉取**；
+- **登录不弹浏览器 / 聊天报 `fetch failed` / 用量「Billing request timed out」**：这三件事都指向同一个原因——`accounts.x.ai` 与 `cli-chat-proxy.grok.com` 在部分网络里必须走隧道。在 `~/.dsh/.env` 写一行 `GROK_PROXY=http://127.0.0.1:10808` 即可：它只作用于**本插件的 Grok 请求**（模型目录、用量、聊天）和它启动的 **`grok` CLI**（登录、续期），DSH 自身与其他 provider 仍走直连——把 `http_proxy` 写在这里会让所有 provider 一起走隧道，隧道一停就全连不上。写好后重启客户端；登录链接会交给系统浏览器打开，面板里同时显示一次性验证码与可点链接。环境里已有的标准代理变量同样会被 CLI 继承；
 - **升级后界面没变化**：插件会继续运行旧的 `lib/`，请重新安装插件并重启 `dsh web`，然后硬刷新（Ctrl+Shift+R）；
 - **提示 `auth.json` 权限不正确**：按上面的 `chmod 600` 处理；插件拒绝读取符号链接或组/其他用户可读的文件；
 - **出现「没有回复」**：请升级到 `1.0.1` 或更高版本。`1.0.0` 存在一个缺陷：工具调用轮次会因流片段无法无损序列化而整轮中止，界面上完全没有回复。

package/lib/client.js

@@ -39,7 +39,7 @@ var import_react2 = require("react");
 var zh = {
   nav: "Grok \u8BA2\u9605",
   title: "Grok \u8BA2\u9605",
-  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.11",
+  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.18",
   signedIn: "\u5DF2\u767B\u5F55",
   signedOut: "\u672A\u767B\u5F55",
   account: "\u8D26\u6237",
@@ -54,8 +54,12 @@ var zh = {
   loginDevice: "\u8BBE\u5907\u7801\u767B\u5F55",
   pull: "\u4ECE Grok CLI \u62C9\u53D6",
   logout: "\u9000\u51FA\u767B\u5F55",
-  loginHint: "\u4F1A\u5728\u542F\u52A8 DSH \u7684\u7EC8\u7AEF\u4E2D\u8FD0\u884C grok login\u3002\u8BF7\u5728\u7EC8\u7AEF\u6216\u6D4F\u89C8\u5668\u4E2D\u5B8C\u6210\u6388\u6743\uFF0C\u7136\u540E\u7B49\u5F85\u540C\u6B65\u3002",
-  deviceHint: "\u8BBE\u5907\u7801\u63D0\u793A\u4F1A\u51FA\u73B0\u5728 DSH \u7EC8\u7AEF\u3002\u4E5F\u53EF\u624B\u52A8\u8FD0\u884C grok login --device-auth\uFF0C\u5B8C\u6210\u540E\u70B9\u201C\u4ECE Grok CLI \u62C9\u53D6\u201D\u3002",
+  loginHint: "\u70B9\u51FB\u540E\u5728\u672C\u673A\u8FD0\u884C grok login\uFF0C\u5E76\u628A CLI \u6253\u5370\u7684\u767B\u5F55\u94FE\u63A5\u4EA4\u7ED9\u6D4F\u89C8\u5668\uFF1B\u6388\u6743\u5B8C\u6210\u540E\u8FD9\u91CC\u4F1A\u81EA\u52A8\u540C\u6B65\u3002",
+  deviceHint: "\u8BBE\u5907\u7801\u767B\u5F55\u4F1A\u8BA9 CLI \u6253\u5370\u4E00\u6B21\u6027\u9A8C\u8BC1\u7801\u548C\u94FE\u63A5\u3002\u82E5\u6D4F\u89C8\u5668\u6CA1\u6709\u81EA\u52A8\u6253\u5F00\uFF0C\u70B9\u63D0\u793A\u91CC\u7684\u201C\u6253\u5F00\u767B\u5F55\u9875\u9762\u201D\u5E76\u786E\u8BA4\u9A8C\u8BC1\u7801\u3002",
+  loginWaiting: "\u7B49\u5F85\u6D4F\u89C8\u5668\u6388\u6743\u2026",
+  loginOpenBrowser: "\u6253\u5F00\u767B\u5F55\u9875\u9762",
+  loginNoUrl: "\u6CA1\u62FF\u5230\u767B\u5F55\u94FE\u63A5\uFF1A\u8BF7\u786E\u8BA4 grok CLI \u80FD\u8BBF\u95EE x.ai\uFF08\u684C\u9762\u7248\u901A\u5E38\u9700\u8981\u4EE3\u7406\uFF09\uFF0C\u7136\u540E\u91CD\u8BD5\u3002",
+  loginTimeout: "\u7B49\u5F85\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u70B9\u51FB\u767B\u5F55\u3002",
   pullHint: "\u5B89\u5168\u8BFB\u53D6 ~/.grok/auth.json\uFF08\u62D2\u7EDD\u7B26\u53F7\u94FE\u63A5\u4E0E\u7EC4/\u5176\u4ED6\u4EBA\u53EF\u8BFB\uFF09\uFF0C\u53EA\u628A\u77ED\u671F access token \u5199\u5165 DSH\u3002",
   loginHelp: "\u767B\u5F55\u65B9\u5F0F\u8BF4\u660E",
   refreshCatalog: "\u5237\u65B0\u6A21\u578B\u76EE\u5F55",
@@ -115,7 +119,7 @@ var zh = {
 var en = {
   nav: "Grok Subscription",
   title: "Grok Subscription",
-  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.11",
+  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.18",
   signedIn: "Signed in",
   signedOut: "Signed out",
   account: "Account",
@@ -130,8 +134,12 @@ var en = {
   loginDevice: "Device-code login",
   pull: "Pull from Grok CLI",
   logout: "Log out",
-  loginHint: "Runs grok login in the terminal that started DSH. Finish the browser or CLI prompt there, then wait for sync.",
-  deviceHint: "The device-code prompt appears in the DSH terminal. You can also run grok login --device-auth yourself, then Pull from Grok CLI.",
+  loginHint: "Runs grok login on this machine and hands the link the CLI prints to your browser; the panel syncs itself once you authorize.",
+  deviceHint: "Device-code login makes the CLI print a one-time code and link. If no browser opened, use \u201COpen the sign-in page\u201D in the status line and confirm the code.",
+  loginWaiting: "Waiting for browser authorization\u2026",
+  loginOpenBrowser: "Open the sign-in page",
+  loginNoUrl: "No sign-in link was returned: make sure the grok CLI can reach x.ai (the desktop app usually needs a proxy), then retry.",
+  loginTimeout: "Timed out waiting for authorization; click sign-in again.",
   pullHint: "Reads ~/.grok/auth.json securely (refuses symlinks and group/other-readable files) and stores only the short-lived access token in DSH.",
   loginHelp: "How signing in works",
   refreshCatalog: "Refresh model catalog",
@@ -640,12 +648,14 @@ var inject = [
   "slots",
   "locale",
   "connection",
-  "settingsScope",
   "modelDirectories",
   "sessions",
   "remote"
 ];
 var RPC_CALL_TIMEOUT_MS = 12e3;
+var LOGIN_CALL_TIMEOUT_MS = 3e4;
+var LOGIN_POLL_INTERVAL_MS = 3e3;
+var LOGIN_POLL_TIMEOUT_MS = 10 * 6e4;
 function pickCopy(locale) {
   const language = typeof locale === "string" ? locale : locale?.language ?? locale?.lang;
   const resolved = language ?? (typeof navigator !== "undefined" ? navigator.language : "zh-CN");
@@ -672,7 +682,7 @@ async function callRpc(rpc, endpoint, payload = {}, timeoutMs = RPC_CALL_TIMEOUT
           controller?.abort();
         } catch {
         }
-        reject(new Error(`Request timed out after ${RPC_CALL_TIMEOUT_MS}ms`));
+        reject(new Error(`Request timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     return unwrap(await Promise.race([call, timeout]));
@@ -876,6 +886,7 @@ function GrokSubscriptionSection({ rpc, t }) {
   const [error, setError] = (0, import_react2.useState)("");
   const [notice, setNotice] = (0, import_react2.useState)("");
   const [status, setStatus] = (0, import_react2.useState)(void 0);
+  const [loginPending, setLoginPending] = (0, import_react2.useState)(void 0);
   const initialUsageKick = (0, import_react2.useRef)(false);
   const applyPartial = (value) => {
     if (value?.account || value?.catalog || value?.usage) {
@@ -914,8 +925,29 @@ function GrokSubscriptionSection({ rpc, t }) {
     }).catch(() => {
     });
   };
+  (0, import_react2.useEffect)(() => {
+    if (!loginPending) return void 0;
+    const startedAt = Date.now();
+    const timer = setInterval(() => {
+      if (Date.now() - startedAt > LOGIN_POLL_TIMEOUT_MS) {
+        setLoginPending(void 0);
+        setError(t("loginTimeout"));
+        return;
+      }
+      void callRpc(rpc, "status", {}).then((value) => {
+        if (value?.account || value?.catalog || value?.usage) applyPartial(value);
+        if (value?.account?.signedIn !== true) return;
+        setLoginPending(void 0);
+        setNotice(t("loginOk"));
+        kickFollowUpRefresh();
+      }).catch(() => {
+      });
+    }, LOGIN_POLL_INTERVAL_MS);
+    return () => clearInterval(timer);
+  }, [loginPending, rpc]);
   const run = async (endpoint) => {
     const isUsageRefresh = endpoint === "usage/refresh";
+    const isLogin = endpoint === "login/cli" || endpoint === "login/device";
     if (isUsageRefresh) {
       setUsageBusy(true);
     } else {
@@ -925,7 +957,7 @@ function GrokSubscriptionSection({ rpc, t }) {
     setNotice("");
     let value;
     try {
-      value = await callRpc(rpc, endpoint, {});
+      value = await callRpc(rpc, endpoint, {}, isLogin ? LOGIN_CALL_TIMEOUT_MS : RPC_CALL_TIMEOUT_MS);
       if (value?.account || value?.catalog || value?.usage) {
         applyPartial(value);
       } else {
@@ -934,6 +966,9 @@ function GrokSubscriptionSection({ rpc, t }) {
       if (value?.ok === false && value.error) {
         setNotice("");
         setError(value.error);
+      } else if (value?.pending === true) {
+        setLoginPending({ url: value.loginUrl, code: value.userCode, warning: value.warning });
+        setNotice("");
       } else if (value?.ok !== false) {
         const successKey = {
           pull: "pullOk",
@@ -955,7 +990,7 @@ function GrokSubscriptionSection({ rpc, t }) {
       if (isUsageRefresh) setUsageBusy(false);
       else setBusy("");
     }
-    const shouldFollowUp = (endpoint === "pull" || endpoint === "login/cli" || endpoint === "login/device") && value?.ok !== false && !value?.error;
+    const shouldFollowUp = (endpoint === "pull" || endpoint === "login/cli" || endpoint === "login/device") && value?.ok !== false && !value?.error && value?.pending !== true;
     if (shouldFollowUp) kickFollowUpRefresh();
   };
   const account = status?.account;
@@ -975,12 +1010,24 @@ function GrokSubscriptionSection({ rpc, t }) {
         signedIn && account?.maskedAccount ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "gsAccount", children: account.maskedAccount }) : null
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "gsActions", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn gsBtn--primary", type: "button", disabled: Boolean(busy), onClick: () => void run("login/cli"), children: t("loginCli") }),
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn", type: "button", disabled: Boolean(busy), onClick: () => void run("login/device"), children: t("loginDevice") }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn gsBtn--primary", type: "button", disabled: Boolean(busy) || Boolean(loginPending), onClick: () => void run("login/cli"), children: t("loginCli") }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn", type: "button", disabled: Boolean(busy) || Boolean(loginPending), onClick: () => void run("login/device"), children: t("loginDevice") }),
         /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn", type: "button", disabled: Boolean(busy), onClick: () => void run("pull"), children: t("pull") }),
         /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn gsBtn--danger", type: "button", disabled: Boolean(busy) || !signedIn, onClick: () => void run("logout"), children: t("logout") })
       ] }),
       busy ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--busy", children: t("busy") }) : null,
+      loginPending ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "gsStatus gsStatus--busy", children: [
+        t("loginWaiting"),
+        loginPending.code ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+          " \xB7 ",
+          /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("code", { children: loginPending.code })
+        ] }) : null,
+        loginPending.url ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+          " \xB7 ",
+          /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("a", { className: "gsLink", href: loginPending.url, target: "_blank", rel: "noreferrer", children: t("loginOpenBrowser") })
+        ] }) : null
+      ] }) : null,
+      loginPending?.warning ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--warn", children: t("loginNoUrl") }) : null,
       notice ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--ok", children: notice }) : null,
       error ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "gsStatus gsStatus--error", children: [
         t("error"),

package/lib/index.js

@@ -38,11 +38,13 @@ var IMAGE_INPUT_MODEL_IDS = Object.freeze([
 var IMPORT_TIMEOUT_MS = 2500;
 var CREDENTIALS_IO_TIMEOUT_MS = 1500;
 var RPC_HANDLER_TIMEOUT_MS = 8e3;
+var LOGIN_START_TIMEOUT_MS = 1e4;
+var LOGIN_HANDLER_TIMEOUT_MS = 2e4;
 
 // src/session.js
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { spawn } from "node:child_process";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 
 // src/auth-file.js
 import { lstatSync, openSync, readFileSync, closeSync, constants as fsConstants } from "node:fs";
@@ -278,6 +280,142 @@ function buildProxyHeaders(accessToken, options = {}) {
   });
 }
 
+// src/http-json.js
+import { brotliDecompressSync, gunzipSync, inflateSync, zstdDecompressSync } from "node:zlib";
+var MAGIC_GZIP = [31, 139];
+var MAGIC_ZSTD = [40, 181, 47, 253];
+var DEFAULT_MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+function startsWith(buffer, bytes) {
+  if (buffer.length < bytes.length) return false;
+  return bytes.every((byte, index) => buffer[index] === byte);
+}
+function maxOutputOf(options) {
+  return typeof options.maxOutputBytes === "number" && options.maxOutputBytes > 0 ? options.maxOutputBytes : DEFAULT_MAX_OUTPUT_BYTES;
+}
+function decodeCompressedBody(buffer, encoding = "", options = {}) {
+  const declared = String(encoding ?? "").toLowerCase();
+  const kind = declared.includes("gzip") || startsWith(buffer, MAGIC_GZIP) ? "gzip" : declared.includes("zstd") || startsWith(buffer, MAGIC_ZSTD) ? "zstd" : declared.includes("deflate") ? "deflate" : declared.includes("br") ? "br" : void 0;
+  if (!kind) return buffer;
+  const limits = { maxOutputLength: maxOutputOf(options) };
+  try {
+    if (kind === "gzip") return gunzipSync(buffer, limits);
+    if (kind === "zstd") return zstdDecompressSync(buffer, limits);
+    if (kind === "deflate") return inflateSync(buffer, limits);
+    return brotliDecompressSync(buffer, limits);
+  } catch {
+    return buffer;
+  }
+}
+async function readResponseText(response, options = {}) {
+  if (typeof response.arrayBuffer !== "function") {
+    if (typeof response.text === "function") return response.text();
+    throw new TypeError("response exposes neither arrayBuffer() nor text()");
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const encoding = typeof response.headers?.get === "function" ? response.headers.get("content-encoding") ?? "" : "";
+  return decodeCompressedBody(buffer, encoding, options).toString("utf8");
+}
+async function readResponseJson(response, options = {}) {
+  if (typeof response.arrayBuffer !== "function" && typeof response.json === "function") {
+    return response.json();
+  }
+  return JSON.parse(await readResponseText(response, options));
+}
+
+// src/proxy.js
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+import { pathToFileURL } from "node:url";
+var GROK_API_HOSTS = Object.freeze(["cli-chat-proxy.grok.com"]);
+var HTTP_PROXY_PATTERN = /^https?:\/\//iu;
+var HOST_PROXY_PACKAGE = "@deepseek-ai/dsh-http-proxy";
+var installed;
+var dependencies = { undici: void 0, hostProxies: void 0 };
+function apiProxyUrl(env = process.env) {
+  const named = [env?.GROK_API_PROXY, env?.GROK_PROXY];
+  for (const candidate of named) {
+    if (typeof candidate === "string" && candidate.trim()) return candidate.trim();
+  }
+  return void 0;
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).hostname;
+  } catch {
+    return "";
+  }
+}
+async function loadHostUndici() {
+  let dir = dirname(process.argv[1] ?? "");
+  for (let depth = 0; depth < 6 && dir && dir !== dirname(dir); depth++) {
+    const entry = join2(dir, "node_modules", "undici", "index.js");
+    if (existsSync2(entry)) {
+      try {
+        return await import(pathToFileURL(entry).href);
+      } catch {
+        break;
+      }
+    }
+    dir = dirname(dir);
+  }
+  try {
+    return await import("undici");
+  } catch {
+    return void 0;
+  }
+}
+async function hostProxiesGrok() {
+  if (typeof dependencies.hostProxies === "function") return dependencies.hostProxies();
+  try {
+    const mod = await import(HOST_PROXY_PACKAGE);
+    const route = mod?.proxyRouteFor?.(`https://${GROK_API_HOSTS[0]}/`);
+    return route?.proxied === true;
+  } catch {
+    return false;
+  }
+}
+async function ensureApiRouting(env = process.env) {
+  const url = apiProxyUrl(env);
+  if (!url || !HTTP_PROXY_PATTERN.test(url)) return "direct";
+  if (installed?.url === url) return "plugin";
+  if (await hostProxiesGrok()) return "host";
+  const undici = dependencies.undici ?? await loadHostUndici();
+  const { Agent, Pool, ProxyAgent, getGlobalDispatcher, setGlobalDispatcher } = undici ?? {};
+  if (typeof Agent !== "function" || typeof setGlobalDispatcher !== "function") return "direct";
+  try {
+    const tunnel = new ProxyAgent(url);
+    const routing = new Agent({
+      factory(origin, options) {
+        return GROK_API_HOSTS.includes(hostOf(origin)) ? tunnel : new Pool(origin, options);
+      }
+    });
+    const previous = typeof getGlobalDispatcher === "function" ? getGlobalDispatcher() : void 0;
+    setGlobalDispatcher(routing);
+    installed = {
+      url,
+      dispatcher: routing,
+      restore: () => {
+        if (previous !== void 0) setGlobalDispatcher(previous);
+        installed = void 0;
+      }
+    };
+    return "plugin";
+  } catch {
+    return "direct";
+  }
+}
+function resetApiRouting() {
+  const current = installed;
+  installed = void 0;
+  if (!current) return false;
+  try {
+    current.restore();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/catalog.js
 var REASONING_LEVELS = Object.freeze(["low", "medium", "high", "xhigh"]);
 function asId(value) {
@@ -400,6 +538,7 @@ function toLlmModels(models) {
   });
 }
 async function fetchLiveCatalog(accessToken, options = {}) {
+  await ensureApiRouting(options.env);
   const fetchImpl = options.fetch ?? globalThis.fetch;
   const signal = options.signal ?? AbortSignal.timeout(options.timeoutMs ?? CATALOG_TIMEOUT_MS);
   const response = await fetchImpl(MODELS_V2_URL, {
@@ -414,7 +553,7 @@ async function fetchLiveCatalog(accessToken, options = {}) {
   if (!response.ok) {
     throw new Error(`Grok models-v2 returned HTTP ${response.status}`);
   }
-  const body = await response.json();
+  const body = await readResponseJson(response);
   return extractLiveModels(body);
 }
 async function loadCatalog(accessToken, options = {}) {
@@ -645,6 +784,7 @@ async function fetchBillingUsageOnce(accessToken, options = {}) {
   }
   let response;
   try {
+    await ensureApiRouting(options.env);
     const signal = options.signal ?? AbortSignal.timeout(options.timeoutMs ?? USAGE_TIMEOUT_MS);
     response = await fetchImpl(BILLING_CREDITS_URL, {
       method: "GET",
@@ -672,7 +812,7 @@ async function fetchBillingUsageOnce(accessToken, options = {}) {
   const looksJson = !contentTypeLower || contentTypeLower.includes("json") || contentTypeLower === "text/plain";
   let text;
   try {
-    text = await response.text();
+    text = await readResponseText(response);
   } catch {
     return unavailable("Could not read billing body");
   }
@@ -722,11 +862,11 @@ async function fetchBillingUsage(accessToken, options = {}) {
 }
 
 // src/adapter.js
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { dirname, join as join2 } from "node:path";
-import { pathToFileURL } from "node:url";
+import { dirname as dirname2, join as join3 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 function withImportTimeout(promise, ms, message) {
   let timer;
   return Promise.race([
@@ -746,28 +886,28 @@ function hostModuleRoots(env = process.env, argv1 = process.argv[1]) {
   const override = env.DSH_GROK_PEER_ROOT;
   if (typeof override === "string" && override.trim()) push(override.trim());
   if (typeof argv1 === "string" && argv1) {
-    let dir = dirname(argv1);
-    for (let depth = 0; depth < 6 && dir && dir !== dirname(dir); depth++) {
-      push(join2(dir, "node_modules"));
-      dir = dirname(dir);
+    let dir = dirname2(argv1);
+    for (let depth = 0; depth < 6 && dir && dir !== dirname2(dir); depth++) {
+      push(join3(dir, "node_modules"));
+      dir = dirname2(dir);
     }
   }
   const prefix = env.NPM_CONFIG_PREFIX;
-  if (typeof prefix === "string" && prefix.trim()) push(join2(prefix.trim(), "lib", "node_modules"));
+  if (typeof prefix === "string" && prefix.trim()) push(join3(prefix.trim(), "lib", "node_modules"));
   if (typeof process.execPath === "string" && process.execPath) {
-    push(join2(dirname(process.execPath), "..", "lib", "node_modules"));
+    push(join3(dirname2(process.execPath), "..", "lib", "node_modules"));
   }
-  push(join2("/opt/homebrew", "lib", "node_modules"));
-  push(join2("/usr/local", "lib", "node_modules"));
+  push(join3("/opt/homebrew", "lib", "node_modules"));
+  push(join3("/usr/local", "lib", "node_modules"));
   for (const segment of ["Library/pnpm", ".local/share/pnpm", ".pnpm-global"]) {
-    push(join2(homedir2(), segment, "node_modules"));
+    push(join3(homedir2(), segment, "node_modules"));
   }
   if (typeof env.DSH_PORTABLE_HOME === "string" && env.DSH_PORTABLE_HOME.trim()) {
-    push(join2(env.DSH_PORTABLE_HOME.trim(), "node_modules"));
+    push(join3(env.DSH_PORTABLE_HOME.trim(), "node_modules"));
   }
-  push(join2(homedir2(), ".local", "lib", "node_modules"));
-  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME.trim() ? env.DSH_HOME.trim() : join2(homedir2(), ".dsh");
-  push(join2(dshHome, "profiles", "node_modules"));
+  push(join3(homedir2(), ".local", "lib", "node_modules"));
+  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME.trim() ? env.DSH_HOME.trim() : join3(homedir2(), ".dsh");
+  push(join3(dshHome, "profiles", "node_modules"));
   return roots;
 }
 function splitSpecifier(specifier) {
@@ -811,14 +951,14 @@ function resolveExportsTarget(exportsField, subpath) {
 function resolveHostSpecifierManually(root, specifier) {
   const { name: name2, subpath } = splitSpecifier(specifier);
   const candidates = [
-    join2(root, name2),
-    join2(root, "node_modules", name2),
-    join2(root, "@deepseek-ai", "dsh", "node_modules", name2),
-    join2(root, "node_modules", "@deepseek-ai", "dsh", "node_modules", name2)
+    join3(root, name2),
+    join3(root, "node_modules", name2),
+    join3(root, "@deepseek-ai", "dsh", "node_modules", name2),
+    join3(root, "node_modules", "@deepseek-ai", "dsh", "node_modules", name2)
   ];
   for (const pkgDir of candidates) {
-    const manifest = join2(pkgDir, "package.json");
-    if (!existsSync2(manifest)) continue;
+    const manifest = join3(pkgDir, "package.json");
+    if (!existsSync3(manifest)) continue;
     let pkg;
     try {
       pkg = JSON.parse(readFileSync3(manifest, "utf8"));
@@ -827,15 +967,15 @@ function resolveHostSpecifierManually(root, specifier) {
     }
     const target = pkg.exports !== void 0 ? resolveExportsTarget(pkg.exports, subpath) : subpath === "." ? pkg.module ?? pkg.main ?? "index.js" : void 0;
     if (typeof target !== "string" || !target) continue;
-    const file = join2(pkgDir, target);
-    if (existsSync2(file)) return file;
+    const file = join3(pkgDir, target);
+    if (existsSync3(file)) return file;
   }
   return void 0;
 }
 function resolveHostSpecifier(specifier, roots = hostModuleRoots()) {
   for (const root of roots) {
     try {
-      const resolved = createRequire(join2(root, "noop.js")).resolve(specifier);
+      const resolved = createRequire(join3(root, "noop.js")).resolve(specifier);
       if (typeof resolved === "string" && resolved) return resolved;
     } catch {
     }
@@ -851,7 +991,7 @@ async function optionalImport(specifier, options = {}) {
   const candidates = [specifier];
   if (!injected && !specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("file:")) {
     const resolved = resolveHostSpecifier(specifier, options.hostRoots ?? hostModuleRoots());
-    if (resolved) candidates.push(pathToFileURL(resolved).href);
+    if (resolved) candidates.push(pathToFileURL2(resolved).href);
   }
   for (const candidate of candidates) {
     try {
@@ -1066,6 +1206,7 @@ function jsonSafeChunk(value) {
   return out;
 }
 async function* streamResponsesUnsafe(options, token) {
+  await ensureApiRouting();
   const headers = {
     Accept: "text/event-stream",
     "Content-Type": "application/json",
@@ -1501,6 +1642,7 @@ async function createGrokBuildAdapter(session, options = {}) {
   if (!responsesApi) {
     return { adapter: asHostAdapter(duck), kind: "custom-mvp", note: "openai-responses API module is unavailable; using the custom adapter." };
   }
+  await ensureApiRouting();
   responsesApi = withEncryptedReasoningInclude(responsesApi);
   const store = createStore(session);
   const authModels = piAi.createModels({
@@ -1592,32 +1734,139 @@ async function createGrokBuildAdapter(session, options = {}) {
 }
 
 // src/session.js
-function resolveGrokBin(env = process.env, exists = existsSync3) {
+function resolveGrokBin(env = process.env, exists = existsSync4) {
   if (typeof env.DSH_GROK_BIN === "string" && env.DSH_GROK_BIN.trim()) return env.DSH_GROK_BIN.trim();
-  const local = join3(grokHome(env), "bin", "grok");
+  const local = join4(grokHome(env), "bin", "grok");
   if (exists(local)) return local;
   return "grok";
 }
-function grokCliAvailable(env = process.env, exists = existsSync3) {
+function grokCliAvailable(env = process.env, exists = existsSync4) {
   const bin = resolveGrokBin(env, exists);
   if (bin.includes("/") || bin.includes("\\")) return exists(bin);
   const delimiter = process.platform === "win32" ? ";" : ":";
-  return String(env.PATH ?? "").split(delimiter).some((dir) => dir && exists(join3(dir, bin)));
+  return String(env.PATH ?? "").split(delimiter).some((dir) => dir && exists(join4(dir, bin)));
+}
+var STANDARD_PROXY_NAMES = [
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY"
+];
+function cliProxyEnv(env = process.env) {
+  const base = env ?? process.env;
+  const declared = STANDARD_PROXY_NAMES.some((name2) => typeof base[name2] === "string" && base[name2].trim() !== "");
+  if (declared) return base;
+  const named = [base.GROK_CLI_PROXY, base.GROK_PROXY].find((value) => typeof value === "string" && value.trim() !== "");
+  const proxy = typeof named === "string" ? named.trim() : "";
+  if (!proxy) return base;
+  const bypass = typeof base.GROK_CLI_NO_PROXY === "string" && base.GROK_CLI_NO_PROXY.trim() ? base.GROK_CLI_NO_PROXY.trim() : "localhost,127.0.0.1,::1";
+  const httpish = /^https?:\/\//iu.test(proxy);
+  return {
+    ...base,
+    ...httpish ? { http_proxy: proxy, https_proxy: proxy } : {},
+    all_proxy: proxy,
+    no_proxy: bypass
+  };
 }
+function openExternal(url, options = {}) {
+  const spawnFn = options.spawn ?? spawn;
+  const platform = options.platform ?? process.platform;
+  const [command, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnFn(command, args, { stdio: "ignore", detached: false });
+    } catch {
+      resolve(false);
+      return;
+    }
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
+    child.on?.("error", () => finish(false));
+    child.on?.("exit", (code) => finish(code === 0));
+    child.unref?.();
+  });
+}
+var LOGIN_URL_PATTERN = /https?:\/\/[^\s<>"'`\\]+/u;
+var DEVICE_CODE_PATTERN = /\b([A-Z0-9]{4}-[A-Z0-9]{4})\b/u;
 function spawnGrokLogin(options = {}) {
   const spawnFn = options.spawn ?? spawn;
   const bin = resolveGrokBin(options.env, options.exists);
   const args = options.device ? ["login", "--device-auth"] : ["login"];
+  const startTimeoutMs = typeof options.startTimeoutMs === "number" && options.startTimeoutMs > 0 ? options.startTimeoutMs : LOGIN_START_TIMEOUT_MS;
+  const openUrl = options.openUrl ?? ((url) => openExternal(url, { spawn: options.openSpawn }));
   return new Promise((resolve, reject) => {
-    const child = spawnFn(bin, args, {
-      stdio: options.stdio ?? "inherit",
-      env: options.env ?? process.env
-    });
+    let child;
+    try {
+      child = spawnFn(bin, args, {
+        stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
+        env: cliProxyEnv(options.env)
+      });
+    } catch (error) {
+      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
+      return;
+    }
+    let settled = false;
+    let loginUrl;
+    let userCode;
+    let buffer = "";
+    let timer;
+    const succeed = (value) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve(value);
+    };
+    const scan = (text) => {
+      if (text) buffer = `${buffer}${text}`.slice(-8192);
+      if (!userCode) {
+        const code = DEVICE_CODE_PATTERN.exec(buffer);
+        if (code) userCode = code[1];
+      }
+      if (loginUrl) return;
+      const match = LOGIN_URL_PATTERN.exec(buffer);
+      if (!match) return;
+      loginUrl = match[0];
+      try {
+        void openUrl(loginUrl);
+      } catch {
+      }
+      succeed({ ok: true, pending: true, loginUrl, userCode, child });
+    };
+    const piped = Boolean(child.stdout && child.stderr);
+    if (piped) {
+      child.stdout.on("data", (chunk) => scan(String(chunk)));
+      child.stderr.on("data", (chunk) => scan(String(chunk)));
+      timer = setTimeout(() => {
+        succeed({
+          ok: true,
+          pending: true,
+          loginUrl,
+          userCode,
+          child,
+          warning: `grok login printed no sign-in URL within ${startTimeoutMs}ms`
+        });
+      }, startTimeoutMs);
+    }
     child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
       reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
     });
     child.on("exit", (code, signal) => {
-      if (code === 0) resolve({ ok: true, code });
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (code === 0) resolve({ ok: true, pending: false, loginUrl, userCode, child });
       else reject(new Error(signal ? `grok login terminated by ${signal}` : `grok login exited with code ${code ?? "unknown"}`));
     });
   });
@@ -1631,7 +1880,7 @@ function spawnGrokRefresh(options = {}) {
     try {
       child = spawnFn(bin, ["models"], {
         stdio: options.stdio ?? "ignore",
-        env: options.env ?? process.env
+        env: cliProxyEnv(options.env)
       });
     } catch (error) {
       reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
@@ -1940,8 +2189,27 @@ function createSessionService({
     return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
   };
   const login = async (options) => {
-    await spawnGrokLogin(options);
-    return pull();
+    const started = await spawnGrokLogin(options);
+    const extra = {
+      ...started.loginUrl === void 0 ? {} : { loginUrl: started.loginUrl },
+      ...started.userCode === void 0 ? {} : { userCode: started.userCode },
+      ...started.warning === void 0 ? {} : { warning: started.warning }
+    };
+    if (started.pending) {
+      started.child?.once?.("exit", (code) => {
+        if (code !== 0) return;
+        scheduleDeferred(() => {
+          void pull().catch((error) => {
+            logger?.warn?.(
+              "Grok subscription login sync failed: %s",
+              error instanceof Error ? error.message : "unknown"
+            );
+          });
+        });
+      });
+      return { ok: true, pending: true, ...extra, ...await status() };
+    }
+    return { ...await pull(), pending: false, ...extra };
   };
   const logout = async () => {
     memoryAccessToken = void 0;
@@ -1979,7 +2247,7 @@ function createSessionService({
 import { spawn as spawn2 } from "node:child_process";
 import { readdir, readFile, realpath } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_NAME = PLUGIN_ID;
 var NPM_REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
@@ -2028,21 +2296,21 @@ async function findInstall({ dshHome, ownPackageJsonUrl }) {
   }
   let entries = [];
   try {
-    entries = await readdir(join4(dshHome, "profiles"), { withFileTypes: true });
+    entries = await readdir(join5(dshHome, "profiles"), { withFileTypes: true });
   } catch {
     entries = [];
   }
   const declared = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const profileDir = join4(dshHome, "profiles", entry.name);
-    const spec = (await readManifest(join4(profileDir, "package.json")))?.dependencies?.[PACKAGE_NAME];
+    const profileDir = join5(dshHome, "profiles", entry.name);
+    const spec = (await readManifest(join5(profileDir, "package.json")))?.dependencies?.[PACKAGE_NAME];
     if (typeof spec !== "string") continue;
     declared.push({ profile: entry.name, spec });
     if (ownReal === void 0) continue;
     try {
-      const installed = await realpath(join4(profileDir, "node_modules", PACKAGE_NAME, "package.json"));
-      if (installed === ownReal) return { kind: classifySpec(spec), profile: entry.name };
+      const installed2 = await realpath(join5(profileDir, "node_modules", PACKAGE_NAME, "package.json"));
+      if (installed2 === ownReal) return { kind: classifySpec(spec), profile: entry.name };
     } catch {
     }
   }
@@ -2108,7 +2376,7 @@ function createGrokPluginManager({
 } = {}) {
   if (typeof fetchImpl !== "function") throw new Error("Grok plugin manager requires fetch");
   if (typeof runCommand !== "function") throw new Error("Grok plugin manager requires runCommand");
-  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME !== "" ? env.DSH_HOME : join4(homedir3(), ".dsh");
+  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME !== "" ? env.DSH_HOME : join5(homedir3(), ".dsh");
   let cached;
   let inFlight;
   let generation = 0;
@@ -2130,7 +2398,7 @@ function createGrokPluginManager({
     if (!response.ok) throw new Error("Grok plugin version check failed");
     let version;
     try {
-      version = (await response.json())?.version;
+      version = (await readResponseJson(response))?.version;
     } catch {
       version = void 0;
     }
@@ -2357,14 +2625,16 @@ async function dispatch(session, endpoint, diagnostics, payload, signal, pluginM
 }
 function createRpcHandler(session, options = {}) {
   const timeoutMs = typeof options.timeoutMs === "number" && options.timeoutMs > 0 ? options.timeoutMs : RPC_HANDLER_TIMEOUT_MS;
+  const loginTimeoutMs = typeof options.loginTimeoutMs === "number" && options.loginTimeoutMs > 0 ? options.loginTimeoutMs : LOGIN_HANDLER_TIMEOUT_MS;
   return async function handle(endpoint, payload, signal) {
     try {
       const operation = dispatch(session, endpoint, options.diagnostics, payload, signal, options.pluginManager);
       if (endpoint === "plugin/update") return await operation;
+      const ceiling = endpoint === "login/cli" || endpoint === "login/device" ? loginTimeoutMs : timeoutMs;
       return await withTimeout(
         operation,
-        timeoutMs,
-        `Grok subscription RPC "${endpoint}" timed out after ${timeoutMs}ms`,
+        ceiling,
+        `Grok subscription RPC "${endpoint}" timed out after ${ceiling}ms`,
         { unref: false }
       );
     } catch (error) {
@@ -2490,6 +2760,18 @@ function apply(ctx, options = {}) {
       "grok-subscription: startup lifetime"
     );
   }
+  void ensureApiRouting().then((mode) => {
+    if (mode === "direct") return;
+    ctx.logger?.debug?.("Grok subscription API route: %s", mode);
+  }).catch((error) => {
+    ctx.logger?.debug?.(
+      "Grok subscription API route skipped: %s",
+      error instanceof Error ? error.message : "unknown"
+    );
+  });
+  if (typeof ctx.effect === "function") {
+    ctx.effect(() => () => resetApiRouting(), "grok-subscription: API proxy route");
+  }
   const notifyCatalogChange = () => {
     scheduleDeferred2(() => {
       if (!active) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-grok-subscription",
-  "version": "1.0.11",
+  "version": "1.0.18",
   "description": "Use a SuperGrok or X Premium Grok Build subscription in DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",