dsh-grok-subscription 1.0.4 → 1.0.5

package/README.en.md

@@ -25,7 +25,7 @@ Models, reasoning effort, and weekly quota all stay inside DSH.
 
 ## Three-step start
 
-1. **Install the plugin.** Run the command below; to select a candidate version, enter the full `package@version`, for example `dsh-grok-subscription@1.0.4`.
+1. **Install the plugin.** Run the command below; to select a candidate version, enter the full `package@version`, for example `dsh-grok-subscription@1.0.5`.
 
    ```sh
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
@@ -47,6 +47,7 @@ Restart `dsh web` after installing or upgrading, otherwise the old `lib/` keeps
 | **Usage panel (experimental)** | Settings shows the used and remaining percentages the backend reports, and never invents numbers when the read fails |
 | **Credentials stay local** | Only the short-lived access token from `~/.grok/auth.json` is read on the host; no token is handed to browser RPC |
 | **Sign-in state refreshes the UI** | Login, pull, and logout emit `llm/adapters-updated`, so the chat model list updates with them |
+| **Automatic token renewal** | The access token only lives 6 hours; near expiry, or on a 401, the plugin runs the official `grok` CLI to refresh `auth.json` and retries once, so you never re-login by hand |
 | **Failures stay visible** | When subscription routing is unavailable it reports an error instead of silently using another paid route |
 
 These capabilities reuse the same local Grok Build sign-in.
@@ -89,7 +90,7 @@ dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
 You can also install the version published on npm:
 
 ```sh
-dsh plugin --profile web add dsh-grok-subscription@1.0.4
+dsh plugin --profile web add dsh-grok-subscription@1.0.5
 ```
 
 DSH handles target selection, the profile lock, dependency resolution, and bundle activation.
@@ -142,7 +143,8 @@ Restart DSH manually afterwards, then:
 - The model menu offers `low` / `medium` / `high` / `xhigh` reasoning effort, defaulting to `high`;
 - A weekly remaining quota badge sits beside the model picker in the composer, with remaining percentage and reset time on hover or click;
 - Settings can show the used and remaining percentages the backend reports, and says so plainly instead of guessing when the read fails;
-- Supports CLI login, device-code login, pull from the Grok CLI, and logout; the chat model list refreshes whenever sign-in state changes;
+- Supports CLI login, device-code login, pull from the Grok CLI, and logout;
+- Renews the access token automatically: near the end of its 6-hour life, or on a 401, it runs the official `grok` CLI and retries once, so a session never lapses mid-use; the chat model list refreshes whenever sign-in state changes;
 - When subscription routing is unavailable it reports an error instead of silently switching to another paid route.
 
 ### Composer quota
@@ -198,6 +200,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 - **Nothing changed after upgrading**: the plugin keeps running the old `lib/` — reinstall the plugin, restart `dsh web`, and hard-refresh (Ctrl+Shift+R);
 - **It reports `auth.json` permissions**: apply the `chmod 600` above; the plugin refuses symlinks and group- or other-readable files;
 - **"No reply" after sending a message**: upgrade to `1.0.1` or later. `1.0.0` had a defect where tool-calling turns aborted with a non-serializable stream chunk, leaving no reply in the UI at all.
+- **Chat or usage reports 401 "Invalid or expired credentials"**: a Grok access token only lives about 6 hours, and once it lapses chat and usage fail together. From `1.0.5` the plugin renews it through the official CLI automatically; on older versions run any `grok` command (for example `grok models`) to refresh `~/.grok/auth.json`, then click **Pull from Grok CLI**.
 
 ## Scope and support
 

package/README.md

@@ -25,7 +25,7 @@
 
 ## 三步开始
 
-1. **安装插件**：在终端运行下面的命令；指定候选版本时填写完整的 `包名@版本`，例如 `dsh-grok-subscription@1.0.4`。
+1. **安装插件**：在终端运行下面的命令；指定候选版本时填写完整的 `包名@版本`，例如 `dsh-grok-subscription@1.0.5`。
 
    ```sh
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
@@ -47,6 +47,7 @@
 | **用量面板（实验性）** | 设置页显示服务端返回的已用与剩余百分比，读取失败时不猜数字、不虚构额度 |
 | **凭据留在本机** | 只在主机侧读取 `~/.grok/auth.json` 的短期 access token；不会把 token 交给浏览器 RPC |
 | **登录状态会刷新界面** | 登录、拉取或登出后自动派发 `llm/adapters-updated`，Chat 模型列表随之更新 |
+| **token 自动续期** | access token 只有 6 小时有效期；临近过期或遇到 401 时，插件会调用官方 `grok` CLI 刷新 `auth.json` 并自动重试一次，不需要手动重新登录 |
 | **失败可见** | 订阅路由不可用时明确报错，不会静默改用其他付费路由 |
 
 这些能力共用同一份本机 Grok Build 登录。
@@ -89,7 +90,7 @@ dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
 也可以按 npm 上的已发布版本安装：
 
 ```sh
-dsh plugin --profile web add dsh-grok-subscription@1.0.4
+dsh plugin --profile web add dsh-grok-subscription@1.0.5
 ```
 
 目标选择、profile 锁、依赖解析和 bundle 激活均由 DSH 负责。
@@ -143,6 +144,7 @@ dsh --profile web --dump-config
 - 输入框模型选择器旁显示每周剩余额度徽章，悬停或点击查看剩余比例与重置时间；
 - 设置页可查看服务端返回的用量与剩余百分比，失败时明确提示而不是显示猜测值；
 - 支持 CLI 登录、设备码登录、从 Grok CLI 拉取和登出；登录状态变化后 Chat 模型列表自动刷新；
+- access token 到期自动续期：临近 6 小时有效期或收到 401 时，调用官方 `grok` CLI 刷新会话并重试一次，不会中途要求手动重新登录；
 - 订阅路由不可用时明确报错，不会静默切换到其他付费路由。
 
 ### 输入框额度
@@ -198,6 +200,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 - **升级后界面没变化**：插件会继续运行旧的 `lib/`，请重新安装插件并重启 `dsh web`，然后硬刷新（Ctrl+Shift+R）；
 - **提示 `auth.json` 权限不正确**：按上面的 `chmod 600` 处理；插件拒绝读取符号链接或组/其他用户可读的文件；
 - **出现「没有回复」**：请升级到 `1.0.1` 或更高版本。`1.0.0` 存在一个缺陷：工具调用轮次会因流片段无法无损序列化而整轮中止，界面上完全没有回复。
+- **聊天或用量提示 401「Invalid or expired credentials」**：Grok 的 access token 只有约 6 小时有效期，过期后聊天和用量会一起失败。`1.0.5` 起插件会自动调用官方 CLI 续期；更早版本请先运行任意 `grok` 命令（如 `grok models`）刷新 `~/.grok/auth.json`，再点面板里的「从 Grok CLI 拉取」。
 
 ## 边界与支持
 

package/lib/client.js

@@ -37,7 +37,7 @@ var import_react2 = require("react");
 var zh = {
   nav: "Grok \u8BA2\u9605",
   title: "Grok \u8BA2\u9605",
-  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.4",
+  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.5",
   signedIn: "\u5DF2\u767B\u5F55",
   signedOut: "\u672A\u767B\u5F55",
   account: "\u8D26\u6237",
@@ -87,7 +87,7 @@ var zh = {
 var en = {
   nav: "Grok Subscription",
   title: "Grok Subscription",
-  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.4",
+  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.5",
   signedIn: "Signed in",
   signedOut: "Signed out",
   account: "Account",

package/lib/index.js

@@ -22,6 +22,8 @@ var AUTH_FILE_MAX_BYTES = 1048576;
 var CATALOG_TIMEOUT_MS = 15e3;
 var USAGE_TIMEOUT_MS = 8e3;
 var STORE_TOKEN_TIMEOUT_MS = 5e3;
+var TOKEN_EXPIRY_SKEW_MS = 12e4;
+var CLI_REFRESH_TIMEOUT_MS = 2e4;
 var STREAM_IDLE_TIMEOUT_MS = 10 * 60 * 1e3;
 var MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
 var REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048;
@@ -1068,22 +1070,38 @@ function createDuckAdapter(session) {
         yield { type: "finish", reason: { kind: "error", failure: { message: "Unknown provider", code: "NO_ADAPTER" } } };
         return;
       }
-      const token = await session.currentToken();
+      let token = await session.currentToken();
       if (!token) {
         yield { type: "finish", reason: { kind: "error", failure: { message: "Grok subscription is not signed in", code: "MISSING_CREDENTIAL" } } };
         return;
       }
-      try {
-        yield* streamResponses(options, token);
-      } catch (error) {
-        const aborted = options.signal?.aborted === true;
-        const failure = {
-          message: error instanceof Error ? error.message : "Grok Build request failed",
-          code: aborted ? "ABORTED" : "PROVIDER"
-        };
-        const status = finiteOr(error?.status, void 0);
-        if (status !== void 0) failure.status = status;
-        yield { type: "finish", reason: { kind: aborted ? "aborted" : "error", failure } };
+      for (let attempt = 0; ; attempt++) {
+        let emitted = false;
+        try {
+          for await (const chunk of streamResponses(options, token)) {
+            emitted = true;
+            yield chunk;
+          }
+          return;
+        } catch (error) {
+          const aborted = options.signal?.aborted === true;
+          const status = finiteOr(error?.status, void 0);
+          const canRetry = !aborted && !emitted && attempt === 0 && status === 401 && typeof session.refreshToken === "function";
+          if (canRetry) {
+            const renewed = await session.refreshToken();
+            if (renewed && renewed !== token) {
+              token = renewed;
+              continue;
+            }
+          }
+          const failure = {
+            message: status === 401 ? "Grok Build session is expired or unauthorized (HTTP 401). Run grok login, then Pull from Grok CLI." : error instanceof Error ? error.message : "Grok Build request failed",
+            code: aborted ? "ABORTED" : status === 401 ? "UNAUTHORIZED" : "PROVIDER"
+          };
+          if (status !== void 0) failure.status = status;
+          yield { type: "finish", reason: { kind: aborted ? "aborted" : "error", failure } };
+          return;
+        }
       }
     }
   };
@@ -1310,6 +1328,52 @@ function spawnGrokLogin(options = {}) {
     });
   });
 }
+function spawnGrokRefresh(options = {}) {
+  const spawnFn = options.spawn ?? spawn;
+  const bin = resolveGrokBin(options.env, options.exists);
+  const timeoutMs = typeof options.timeoutMs === "number" && options.timeoutMs > 0 ? options.timeoutMs : CLI_REFRESH_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawnFn(bin, ["models"], {
+        stdio: options.stdio ?? "ignore",
+        env: options.env ?? process.env
+      });
+    } catch (error) {
+      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
+      return;
+    }
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve({ ok: false, reason: "timeout" });
+    }, timeoutMs);
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error(`Could not run grok CLI (${bin})`, { cause: error }));
+    });
+    child.on("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok: true, code });
+    });
+  });
+}
+async function defaultRenewSession(options = {}) {
+  const env = options.env ?? process.env;
+  if (!grokCliAvailable(env)) return void 0;
+  await spawnGrokRefresh({ env });
+  const parsed = (options.readAuth ?? readGrokAuthSession)();
+  return parsed?.session;
+}
 async function defaultCredentialRefOf() {
   try {
     const mod = await optionalImport("@deepseek-ai/dsh-credentials");
@@ -1344,12 +1408,15 @@ function createSessionService({
   readAuth = readGrokAuthSession,
   storeTokenTimeoutMs = STORE_TOKEN_TIMEOUT_MS,
   credentialsIoTimeoutMs = CREDENTIALS_IO_TIMEOUT_MS,
-  credentialRefOf = defaultCredentialRefOf
+  credentialRefOf = defaultCredentialRefOf,
+  renewSession = defaultRenewSession,
+  now = () => Date.now()
 } = {}) {
   let catalog = { models: [], source: "signed-out", error: void 0 };
   let lastPublic = publicSessionView(void 0);
   let lastUsage = unavailable("Not fetched yet");
   let memoryAccessToken;
+  let memoryTokenExpiresAt;
   let memorySessionTouched = false;
   const resolveTimeoutMs = () => {
     return typeof storeTokenTimeoutMs === "number" && storeTokenTimeoutMs > 0 ? storeTokenTimeoutMs : STORE_TOKEN_TIMEOUT_MS;
@@ -1357,6 +1424,48 @@ function createSessionService({
   const resolveIoTimeoutMs = () => {
     return typeof credentialsIoTimeoutMs === "number" && credentialsIoTimeoutMs > 0 ? credentialsIoTimeoutMs : CREDENTIALS_IO_TIMEOUT_MS;
   };
+  const epochMs = (value) => {
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+    if (typeof value === "string" && value.trim()) {
+      const parsed = Date.parse(value.trim());
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    return void 0;
+  };
+  const adoptSession = (session) => {
+    if (!session?.accessToken) return void 0;
+    memoryAccessToken = session.accessToken;
+    memoryTokenExpiresAt = epochMs(session.expiresAt);
+    memorySessionTouched = true;
+    lastPublic = publicSessionView(session);
+    return memoryAccessToken;
+  };
+  const memoryTokenNeedsRenewal = () => {
+    if (typeof memoryAccessToken !== "string" || memoryAccessToken.length === 0) return false;
+    if (typeof memoryTokenExpiresAt !== "number") return false;
+    return memoryTokenExpiresAt - TOKEN_EXPIRY_SKEW_MS <= now();
+  };
+  let renewalInFlight;
+  const renewAccessToken = async () => {
+    if (renewalInFlight) return renewalInFlight;
+    renewalInFlight = (async () => {
+      try {
+        const session = await renewSession();
+        const token = adoptSession(session);
+        if (token) notifyCatalogChange();
+        return token;
+      } catch (error) {
+        logger?.warn?.(
+          "Grok subscription session renewal failed: %s",
+          error instanceof Error ? error.message : "unknown"
+        );
+        return void 0;
+      } finally {
+        renewalInFlight = void 0;
+      }
+    })();
+    return renewalInFlight;
+  };
   const notifyCatalogChange = () => {
     scheduleDeferred(() => {
       try {
@@ -1371,7 +1480,9 @@ function createSessionService({
   };
   const readStoredToken = async () => {
     if (typeof memoryAccessToken === "string" && memoryAccessToken.length > 0) {
-      return memoryAccessToken;
+      if (!memoryTokenNeedsRenewal()) return memoryAccessToken;
+      const renewed = await renewAccessToken();
+      return renewed ?? memoryAccessToken;
     }
     if (memorySessionTouched) return void 0;
     if (!credentials?.resolve) return void 0;
@@ -1485,6 +1596,7 @@ function createSessionService({
     }
     const accessToken = parsed.session.accessToken;
     memoryAccessToken = accessToken;
+    memoryTokenExpiresAt = epochMs(parsed.session.expiresAt);
     memorySessionTouched = true;
     lastPublic = publicSessionView(parsed.session);
     scheduleDeferred(() => {
@@ -1507,9 +1619,7 @@ function createSessionService({
     try {
       const parsed = readAuth();
       if (parsed.session) {
-        memoryAccessToken = parsed.session.accessToken;
-        memorySessionTouched = true;
-        lastPublic = publicSessionView(parsed.session);
+        adoptSession(parsed.session);
         return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
       }
     } catch (error) {
@@ -1562,6 +1672,8 @@ function createSessionService({
     login,
     logout,
     currentToken: readStoredToken,
+    /** Force a CLI-backed renewal; used when the provider answers 401. */
+    refreshToken: () => renewAccessToken(),
     models: () => catalog.models,
     catalog: () => catalog,
     usage: () => lastUsage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-grok-subscription",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Use a SuperGrok or X Premium Grok Build subscription in DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",