dsh-grok-subscription 1.0.3 → 1.0.5

package/README.en.md

@@ -25,7 +25,7 @@ Models, reasoning effort, and weekly quota all stay inside DSH.
 
 ## Three-step start
 
-1. **Install the plugin.** Run the command below; to select a candidate version, enter the full `package@version`, for example `dsh-grok-subscription@1.0.3`.
+1. **Install the plugin.** Run the command below; to select a candidate version, enter the full `package@version`, for example `dsh-grok-subscription@1.0.5`.
 
    ```sh
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
@@ -47,6 +47,7 @@ Restart `dsh web` after installing or upgrading, otherwise the old `lib/` keeps
 | **Usage panel (experimental)** | Settings shows the used and remaining percentages the backend reports, and never invents numbers when the read fails |
 | **Credentials stay local** | Only the short-lived access token from `~/.grok/auth.json` is read on the host; no token is handed to browser RPC |
 | **Sign-in state refreshes the UI** | Login, pull, and logout emit `llm/adapters-updated`, so the chat model list updates with them |
+| **Automatic token renewal** | The access token only lives 6 hours; near expiry, or on a 401, the plugin runs the official `grok` CLI to refresh `auth.json` and retries once, so you never re-login by hand |
 | **Failures stay visible** | When subscription routing is unavailable it reports an error instead of silently using another paid route |
 
 These capabilities reuse the same local Grok Build sign-in.
@@ -89,7 +90,7 @@ dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
 You can also install the version published on npm:
 
 ```sh
-dsh plugin --profile web add dsh-grok-subscription@1.0.3
+dsh plugin --profile web add dsh-grok-subscription@1.0.5
 ```
 
 DSH handles target selection, the profile lock, dependency resolution, and bundle activation.
@@ -142,7 +143,8 @@ Restart DSH manually afterwards, then:
 - The model menu offers `low` / `medium` / `high` / `xhigh` reasoning effort, defaulting to `high`;
 - A weekly remaining quota badge sits beside the model picker in the composer, with remaining percentage and reset time on hover or click;
 - Settings can show the used and remaining percentages the backend reports, and says so plainly instead of guessing when the read fails;
-- Supports CLI login, device-code login, pull from the Grok CLI, and logout; the chat model list refreshes whenever sign-in state changes;
+- Supports CLI login, device-code login, pull from the Grok CLI, and logout;
+- Renews the access token automatically: near the end of its 6-hour life, or on a 401, it runs the official `grok` CLI and retries once, so a session never lapses mid-use; the chat model list refreshes whenever sign-in state changes;
 - When subscription routing is unavailable it reports an error instead of silently switching to another paid route.
 
 ### Composer quota
@@ -198,6 +200,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 - **Nothing changed after upgrading**: the plugin keeps running the old `lib/` — reinstall the plugin, restart `dsh web`, and hard-refresh (Ctrl+Shift+R);
 - **It reports `auth.json` permissions**: apply the `chmod 600` above; the plugin refuses symlinks and group- or other-readable files;
 - **"No reply" after sending a message**: upgrade to `1.0.1` or later. `1.0.0` had a defect where tool-calling turns aborted with a non-serializable stream chunk, leaving no reply in the UI at all.
+- **Chat or usage reports 401 "Invalid or expired credentials"**: a Grok access token only lives about 6 hours, and once it lapses chat and usage fail together. From `1.0.5` the plugin renews it through the official CLI automatically; on older versions run any `grok` command (for example `grok models`) to refresh `~/.grok/auth.json`, then click **Pull from Grok CLI**.
 
 ## Scope and support
 

package/README.md

@@ -25,7 +25,7 @@
 
 ## 三步开始
 
-1. **安装插件**：在终端运行下面的命令；指定候选版本时填写完整的 `包名@版本`，例如 `dsh-grok-subscription@1.0.3`。
+1. **安装插件**：在终端运行下面的命令；指定候选版本时填写完整的 `包名@版本`，例如 `dsh-grok-subscription@1.0.5`。
 
    ```sh
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
@@ -47,6 +47,7 @@
 | **用量面板（实验性）** | 设置页显示服务端返回的已用与剩余百分比，读取失败时不猜数字、不虚构额度 |
 | **凭据留在本机** | 只在主机侧读取 `~/.grok/auth.json` 的短期 access token；不会把 token 交给浏览器 RPC |
 | **登录状态会刷新界面** | 登录、拉取或登出后自动派发 `llm/adapters-updated`，Chat 模型列表随之更新 |
+| **token 自动续期** | access token 只有 6 小时有效期；临近过期或遇到 401 时，插件会调用官方 `grok` CLI 刷新 `auth.json` 并自动重试一次，不需要手动重新登录 |
 | **失败可见** | 订阅路由不可用时明确报错，不会静默改用其他付费路由 |
 
 这些能力共用同一份本机 Grok Build 登录。
@@ -89,7 +90,7 @@ dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
 也可以按 npm 上的已发布版本安装：
 
 ```sh
-dsh plugin --profile web add dsh-grok-subscription@1.0.3
+dsh plugin --profile web add dsh-grok-subscription@1.0.5
 ```
 
 目标选择、profile 锁、依赖解析和 bundle 激活均由 DSH 负责。
@@ -143,6 +144,7 @@ dsh --profile web --dump-config
 - 输入框模型选择器旁显示每周剩余额度徽章，悬停或点击查看剩余比例与重置时间；
 - 设置页可查看服务端返回的用量与剩余百分比，失败时明确提示而不是显示猜测值；
 - 支持 CLI 登录、设备码登录、从 Grok CLI 拉取和登出；登录状态变化后 Chat 模型列表自动刷新；
+- access token 到期自动续期：临近 6 小时有效期或收到 401 时，调用官方 `grok` CLI 刷新会话并重试一次，不会中途要求手动重新登录；
 - 订阅路由不可用时明确报错，不会静默切换到其他付费路由。
 
 ### 输入框额度
@@ -198,6 +200,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 - **升级后界面没变化**：插件会继续运行旧的 `lib/`，请重新安装插件并重启 `dsh web`，然后硬刷新（Ctrl+Shift+R）；
 - **提示 `auth.json` 权限不正确**：按上面的 `chmod 600` 处理；插件拒绝读取符号链接或组/其他用户可读的文件；
 - **出现「没有回复」**：请升级到 `1.0.1` 或更高版本。`1.0.0` 存在一个缺陷：工具调用轮次会因流片段无法无损序列化而整轮中止，界面上完全没有回复。
+- **聊天或用量提示 401「Invalid or expired credentials」**：Grok 的 access token 只有约 6 小时有效期，过期后聊天和用量会一起失败。`1.0.5` 起插件会自动调用官方 CLI 续期；更早版本请先运行任意 `grok` 命令（如 `grok models`）刷新 `~/.grok/auth.json`，再点面板里的「从 Grok CLI 拉取」。
 
 ## 边界与支持
 

package/lib/client.js

@@ -20,8 +20,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/client.jsx
 var client_exports = {};
 __export(client_exports, {
+  GrokSubscriptionPanel: () => GrokSubscriptionPanel,
   GrokSubscriptionSection: () => GrokSubscriptionSection,
   RPC_CALL_TIMEOUT_MS: () => RPC_CALL_TIMEOUT_MS,
+  SectionBoundary: () => SectionBoundary,
+  UsagePanel: () => UsagePanel,
   apply: () => apply,
   callRpc: () => callRpc,
   inject: () => inject,
@@ -34,7 +37,7 @@ var import_react2 = require("react");
 var zh = {
   nav: "Grok \u8BA2\u9605",
   title: "Grok \u8BA2\u9605",
-  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.3",
+  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.5",
   signedIn: "\u5DF2\u767B\u5F55",
   signedOut: "\u672A\u767B\u5F55",
   account: "\u8D26\u6237",
@@ -54,6 +57,7 @@ var zh = {
   pullHint: "\u5B89\u5168\u8BFB\u53D6 ~/.grok/auth.json\uFF08\u62D2\u7EDD\u7B26\u53F7\u94FE\u63A5\u4E0E\u7EC4/\u5176\u4ED6\u4EBA\u53EF\u8BFB\uFF09\uFF0C\u53EA\u628A\u77ED\u671F access token \u5199\u5165 DSH\u3002",
   loginHelp: "\u767B\u5F55\u65B9\u5F0F\u8BF4\u660E",
   refreshCatalog: "\u5237\u65B0\u6A21\u578B\u76EE\u5F55",
+  renderError: "\u754C\u9762\u6E32\u67D3\u5931\u8D25",
   busy: "\u5904\u7406\u4E2D\u2026",
   busyCatalog: "\u6B63\u5728\u5237\u65B0\u6A21\u578B\u76EE\u5F55\u2026",
   busyUsage: "\u6B63\u5728\u5237\u65B0\u7528\u91CF\u2026",
@@ -83,7 +87,7 @@ var zh = {
 var en = {
   nav: "Grok Subscription",
   title: "Grok Subscription",
-  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.3",
+  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.5",
   signedIn: "Signed in",
   signedOut: "Signed out",
   account: "Account",
@@ -103,6 +107,7 @@ var en = {
   pullHint: "Reads ~/.grok/auth.json securely (refuses symlinks and group/other-readable files) and stores only the short-lived access token in DSH.",
   loginHelp: "How signing in works",
   refreshCatalog: "Refresh model catalog",
+  renderError: "Failed to render this panel",
   busy: "Working\u2026",
   busyCatalog: "Refreshing model catalog\u2026",
   busyUsage: "Refreshing usage\u2026",
@@ -614,6 +619,32 @@ async function callRpc(rpc, endpoint, payload = {}) {
     if (timer) clearTimeout(timer);
   }
 }
+var SectionBoundary = class extends import_react2.Component {
+  constructor(props) {
+    super(props);
+    this.state = { error: void 0 };
+  }
+  static getDerivedStateFromError(error) {
+    return { error };
+  }
+  render() {
+    const { error } = this.state;
+    if (!error) return this.props.children;
+    const t = this.props.t;
+    return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("section", { className: "grokSubscription", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("style", { children: SETTINGS_STYLE }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "gsHead", children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h2", { children: t("title") }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "gsCard", children: /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "gsStatus gsStatus--error", children: [
+        t("renderError"),
+        ": ",
+        error instanceof Error ? error.message : String(error)
+      ] }) })
+    ] });
+  }
+};
+function GrokSubscriptionPanel(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(SectionBoundary, { t: props.t, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(GrokSubscriptionSection, { ...props }) });
+}
 function Chevron() {
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("svg", { className: "gsChevron", width: "12", height: "12", viewBox: "0 0 16 16", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M4 6l4 4 4-4", fill: "none", stroke: "currentColor", strokeWidth: "1.6", strokeLinecap: "round", strokeLinejoin: "round" }) });
 }
@@ -625,12 +656,16 @@ function Chip({ tone = "off", children }) {
 }
 function UsagePanel({ usage, t, usageBusy, onRefresh, signedIn }) {
   const ok = usage?.status === "ok";
-  const used = ok ? formatPercent(usage.usedPercent) : void 0;
-  const remaining = ok ? formatPercent(usage.remainingPercent) : void 0;
+  const usedNumber = ok && Number.isFinite(usage.usedPercent) ? usage.usedPercent : void 0;
+  const remainingNumber = ok && Number.isFinite(usage.remainingPercent) ? usage.remainingPercent : void 0;
+  const used = usedNumber !== void 0 ? formatPercent(usedNumber) : void 0;
+  const remaining = remainingNumber !== void 0 ? formatPercent(remainingNumber) : void 0;
   const resetLabel = usage?.periodEndLocal || usage?.periodEnd;
-  const gaugeValue = remaining ?? (used !== void 0 ? formatPercent(100 - Number(used)) : void 0);
-  const gaugeLabel = remaining !== void 0 ? t("usageRemaining") : t("usageUsed");
-  const fill = typeof gaugeValue === "number" && Number.isFinite(gaugeValue) ? Math.min(100, Math.max(0, gaugeValue)) : 0;
+  const gaugeNumber = remainingNumber ?? (usedNumber !== void 0 ? 100 - usedNumber : void 0);
+  const gaugeValue = gaugeNumber !== void 0 ? formatPercent(gaugeNumber) : void 0;
+  const gaugeLabel = remainingNumber !== void 0 ? t("usageRemaining") : t("usageUsed");
+  const fill = gaugeNumber === void 0 ? 0 : Math.min(100, Math.max(0, gaugeNumber));
+  const products = Array.isArray(usage?.productUsage) ? usage.productUsage : [];
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "gsCard", children: [
     /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "gsCardHead", children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h3", { children: t("usageTitle") }) }),
     ok && (used !== void 0 || remaining !== void 0) ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "gsGauge", children: [
@@ -660,11 +695,11 @@ function UsagePanel({ usage, t, usageBusy, onRefresh, signedIn }) {
       t("usageUnavailable"),
       usage?.reason ? `: ${usage.reason}` : ""
     ] }),
-    Array.isArray(usage.productUsage) && usage.productUsage.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "gsRows", children: usage.productUsage.map((row, index) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "gsRow", children: [
+    products.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "gsRows", children: products.map((row, index) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "gsRow", children: [
       /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { children: row.name ?? "\u2014" }),
       /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "gsRowValue", children: typeof row.usedPercent === "number" ? `${formatPercent(row.usedPercent)}%` : "\u2014" })
     ] }, `${row.name ?? "row"}-${index}`)) }) : null,
-    usage.fetchedAt ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "gsHint", children: [
+    usage?.fetchedAt ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "gsHint", children: [
       t("usageFetchedAt"),
       ": ",
       usage.fetchedAt
@@ -879,7 +914,7 @@ function apply(ctx) {
     label: () => t("nav"),
     locale: LOCALE_NS,
     inject: () => ({ rpc, t })
-  }, GrokSubscriptionSection));
+  }, GrokSubscriptionPanel));
   const installDirectorySlots = (scope) => {
     let modelDirectories;
     try {

package/lib/index.js

@@ -22,6 +22,8 @@ var AUTH_FILE_MAX_BYTES = 1048576;
 var CATALOG_TIMEOUT_MS = 15e3;
 var USAGE_TIMEOUT_MS = 8e3;
 var STORE_TOKEN_TIMEOUT_MS = 5e3;
+var TOKEN_EXPIRY_SKEW_MS = 12e4;
+var CLI_REFRESH_TIMEOUT_MS = 2e4;
 var STREAM_IDLE_TIMEOUT_MS = 10 * 60 * 1e3;
 var MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
 var REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048;
@@ -1068,22 +1070,38 @@ function createDuckAdapter(session) {
         yield { type: "finish", reason: { kind: "error", failure: { message: "Unknown provider", code: "NO_ADAPTER" } } };
         return;
       }
-      const token = await session.currentToken();
+      let token = await session.currentToken();
       if (!token) {
         yield { type: "finish", reason: { kind: "error", failure: { message: "Grok subscription is not signed in", code: "MISSING_CREDENTIAL" } } };
         return;
       }
-      try {
-        yield* streamResponses(options, token);
-      } catch (error) {
-        const aborted = options.signal?.aborted === true;
-        const failure = {
-          message: error instanceof Error ? error.message : "Grok Build request failed",
-          code: aborted ? "ABORTED" : "PROVIDER"
-        };
-        const status = finiteOr(error?.status, void 0);
-        if (status !== void 0) failure.status = status;
-        yield { type: "finish", reason: { kind: aborted ? "aborted" : "error", failure } };
+      for (let attempt = 0; ; attempt++) {
+        let emitted = false;
+        try {
+          for await (const chunk of streamResponses(options, token)) {
+            emitted = true;
+            yield chunk;
+          }
+          return;
+        } catch (error) {
+          const aborted = options.signal?.aborted === true;
+          const status = finiteOr(error?.status, void 0);
+          const canRetry = !aborted && !emitted && attempt === 0 && status === 401 && typeof session.refreshToken === "function";
+          if (canRetry) {
+            const renewed = await session.refreshToken();
+            if (renewed && renewed !== token) {
+              token = renewed;
+              continue;
+            }
+          }
+          const failure = {
+            message: status === 401 ? "Grok Build session is expired or unauthorized (HTTP 401). Run grok login, then Pull from Grok CLI." : error instanceof Error ? error.message : "Grok Build request failed",
+            code: aborted ? "ABORTED" : status === 401 ? "UNAUTHORIZED" : "PROVIDER"
+          };
+          if (status !== void 0) failure.status = status;
+          yield { type: "finish", reason: { kind: aborted ? "aborted" : "error", failure } };
+          return;
+        }
       }
     }
   };
@@ -1310,6 +1328,52 @@ function spawnGrokLogin(options = {}) {
     });
   });
 }
+function spawnGrokRefresh(options = {}) {
+  const spawnFn = options.spawn ?? spawn;
+  const bin = resolveGrokBin(options.env, options.exists);
+  const timeoutMs = typeof options.timeoutMs === "number" && options.timeoutMs > 0 ? options.timeoutMs : CLI_REFRESH_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawnFn(bin, ["models"], {
+        stdio: options.stdio ?? "ignore",
+        env: options.env ?? process.env
+      });
+    } catch (error) {
+      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
+      return;
+    }
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve({ ok: false, reason: "timeout" });
+    }, timeoutMs);
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error(`Could not run grok CLI (${bin})`, { cause: error }));
+    });
+    child.on("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok: true, code });
+    });
+  });
+}
+async function defaultRenewSession(options = {}) {
+  const env = options.env ?? process.env;
+  if (!grokCliAvailable(env)) return void 0;
+  await spawnGrokRefresh({ env });
+  const parsed = (options.readAuth ?? readGrokAuthSession)();
+  return parsed?.session;
+}
 async function defaultCredentialRefOf() {
   try {
     const mod = await optionalImport("@deepseek-ai/dsh-credentials");
@@ -1344,12 +1408,15 @@ function createSessionService({
   readAuth = readGrokAuthSession,
   storeTokenTimeoutMs = STORE_TOKEN_TIMEOUT_MS,
   credentialsIoTimeoutMs = CREDENTIALS_IO_TIMEOUT_MS,
-  credentialRefOf = defaultCredentialRefOf
+  credentialRefOf = defaultCredentialRefOf,
+  renewSession = defaultRenewSession,
+  now = () => Date.now()
 } = {}) {
   let catalog = { models: [], source: "signed-out", error: void 0 };
   let lastPublic = publicSessionView(void 0);
   let lastUsage = unavailable("Not fetched yet");
   let memoryAccessToken;
+  let memoryTokenExpiresAt;
   let memorySessionTouched = false;
   const resolveTimeoutMs = () => {
     return typeof storeTokenTimeoutMs === "number" && storeTokenTimeoutMs > 0 ? storeTokenTimeoutMs : STORE_TOKEN_TIMEOUT_MS;
@@ -1357,6 +1424,48 @@ function createSessionService({
   const resolveIoTimeoutMs = () => {
     return typeof credentialsIoTimeoutMs === "number" && credentialsIoTimeoutMs > 0 ? credentialsIoTimeoutMs : CREDENTIALS_IO_TIMEOUT_MS;
   };
+  const epochMs = (value) => {
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+    if (typeof value === "string" && value.trim()) {
+      const parsed = Date.parse(value.trim());
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    return void 0;
+  };
+  const adoptSession = (session) => {
+    if (!session?.accessToken) return void 0;
+    memoryAccessToken = session.accessToken;
+    memoryTokenExpiresAt = epochMs(session.expiresAt);
+    memorySessionTouched = true;
+    lastPublic = publicSessionView(session);
+    return memoryAccessToken;
+  };
+  const memoryTokenNeedsRenewal = () => {
+    if (typeof memoryAccessToken !== "string" || memoryAccessToken.length === 0) return false;
+    if (typeof memoryTokenExpiresAt !== "number") return false;
+    return memoryTokenExpiresAt - TOKEN_EXPIRY_SKEW_MS <= now();
+  };
+  let renewalInFlight;
+  const renewAccessToken = async () => {
+    if (renewalInFlight) return renewalInFlight;
+    renewalInFlight = (async () => {
+      try {
+        const session = await renewSession();
+        const token = adoptSession(session);
+        if (token) notifyCatalogChange();
+        return token;
+      } catch (error) {
+        logger?.warn?.(
+          "Grok subscription session renewal failed: %s",
+          error instanceof Error ? error.message : "unknown"
+        );
+        return void 0;
+      } finally {
+        renewalInFlight = void 0;
+      }
+    })();
+    return renewalInFlight;
+  };
   const notifyCatalogChange = () => {
     scheduleDeferred(() => {
       try {
@@ -1371,7 +1480,9 @@ function createSessionService({
   };
   const readStoredToken = async () => {
     if (typeof memoryAccessToken === "string" && memoryAccessToken.length > 0) {
-      return memoryAccessToken;
+      if (!memoryTokenNeedsRenewal()) return memoryAccessToken;
+      const renewed = await renewAccessToken();
+      return renewed ?? memoryAccessToken;
     }
     if (memorySessionTouched) return void 0;
     if (!credentials?.resolve) return void 0;
@@ -1485,6 +1596,7 @@ function createSessionService({
     }
     const accessToken = parsed.session.accessToken;
     memoryAccessToken = accessToken;
+    memoryTokenExpiresAt = epochMs(parsed.session.expiresAt);
     memorySessionTouched = true;
     lastPublic = publicSessionView(parsed.session);
     scheduleDeferred(() => {
@@ -1507,9 +1619,7 @@ function createSessionService({
     try {
       const parsed = readAuth();
       if (parsed.session) {
-        memoryAccessToken = parsed.session.accessToken;
-        memorySessionTouched = true;
-        lastPublic = publicSessionView(parsed.session);
+        adoptSession(parsed.session);
         return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
       }
     } catch (error) {
@@ -1562,6 +1672,8 @@ function createSessionService({
     login,
     logout,
     currentToken: readStoredToken,
+    /** Force a CLI-backed renewal; used when the provider answers 401. */
+    refreshToken: () => renewAccessToken(),
     models: () => catalog.models,
     catalog: () => catalog,
     usage: () => lastUsage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-grok-subscription",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Use a SuperGrok or X Premium Grok Build subscription in DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -39,6 +39,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
+    "pretest": "npm run build",
     "test": "node --test tests/*.test.mjs",
     "check": "npm test && npm run build"
   },
@@ -55,8 +56,12 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "peerDependencies": {
+    "@deepseek-ai/dsh-api-remotes": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-client-locale": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-model-selection": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-credentials": "^0.1.5-rc.2",
@@ -66,11 +71,7 @@
     "@deepseek-ai/dsh-web": "^0.1.5-rc.2",
     "@earendil-works/pi-ai": "^0.82.1",
     "react": "^18.2.0",
-    "react-dom": "^18.2.0",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-model-selection": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.5-rc.2"
+    "react-dom": "^18.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-client-connection": {
@@ -123,7 +124,9 @@
     }
   },
   "devDependencies": {
-    "esbuild": "^0.25.0"
+    "esbuild": "^0.25.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1"
   },
   "author": "BaronCyrus",
   "repository": {