dsh-grok-subscription 1.0.4 → 1.0.6

package/README.en.md

@@ -25,7 +25,7 @@ Models, reasoning effort, and weekly quota all stay inside DSH.
 
 ## Three-step start
 
-1. **Install the plugin.** Run the command below; to select a candidate version, enter the full `package@version`, for example `dsh-grok-subscription@1.0.4`.
+1. **Install the plugin.** Run the command below; to select a candidate version, enter the full `package@version`, for example `dsh-grok-subscription@1.0.6`.
 
    ```sh
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
@@ -43,10 +43,12 @@ Restart `dsh web` after installing or upgrading, otherwise the old `lib/` keeps
 | **Direct subscription routing** | Reuse the official Grok Build CLI session — no `XAI_API_KEY` needed |
 | **Real model catalog** | Read the models the account can actually use (such as `grok-4.7`, `grok-4.6`, `grok-4.5`) from `/v1/models-v2`; nothing is exposed while signed out |
 | **Reasoning effort** | The model picker offers `low` / `medium` / `high` / `xhigh`, defaulting to `high`, matching the Codex interaction |
+| **Image input** | `grok-4.7` / `grok-4.7-fast` / `grok-4.6` accept pasted images, normalized to the host's pixel and byte budget by its attachment service |
 | **Composer quota** | A badge beside the model picker shows weekly remaining percentage; hover or click for "Weekly quota · N% left · resets M/D HH:mm" |
 | **Usage panel (experimental)** | Settings shows the used and remaining percentages the backend reports, and never invents numbers when the read fails |
 | **Credentials stay local** | Only the short-lived access token from `~/.grok/auth.json` is read on the host; no token is handed to browser RPC |
 | **Sign-in state refreshes the UI** | Login, pull, and logout emit `llm/adapters-updated`, so the chat model list updates with them |
+| **Automatic token renewal** | The access token only lives 6 hours; near expiry, or on a 401, the plugin runs the official `grok` CLI to refresh `auth.json` and retries once, so you never re-login by hand |
 | **Failures stay visible** | When subscription routing is unavailable it reports an error instead of silently using another paid route |
 
 These capabilities reuse the same local Grok Build sign-in.
@@ -89,7 +91,7 @@ dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
 You can also install the version published on npm:
 
 ```sh
-dsh plugin --profile web add dsh-grok-subscription@1.0.4
+dsh plugin --profile web add dsh-grok-subscription@1.0.6
 ```
 
 DSH handles target selection, the profile lock, dependency resolution, and bundle activation.
@@ -142,7 +144,8 @@ Restart DSH manually afterwards, then:
 - The model menu offers `low` / `medium` / `high` / `xhigh` reasoning effort, defaulting to `high`;
 - A weekly remaining quota badge sits beside the model picker in the composer, with remaining percentage and reset time on hover or click;
 - Settings can show the used and remaining percentages the backend reports, and says so plainly instead of guessing when the read fails;
-- Supports CLI login, device-code login, pull from the Grok CLI, and logout; the chat model list refreshes whenever sign-in state changes;
+- Supports CLI login, device-code login, pull from the Grok CLI, and logout;
+- Renews the access token automatically: near the end of its 6-hour life, or on a 401, it runs the official `grok` CLI and retries once, so a session never lapses mid-use; the chat model list refreshes whenever sign-in state changes;
 - When subscription routing is unavailable it reports an error instead of silently switching to another paid route.
 
 ### Composer quota
@@ -153,6 +156,12 @@ Restart DSH manually afterwards, then:
 
 The badge appears only when the current session's provider is `grok-build` and the usage read succeeds; hover or click for "Weekly quota · N% left · resets M/D HH:mm". It reflects only the weekly quota the backend returns, and when the read fails the badge is simply hidden — chat is unaffected.
 
+### Image input
+
+`grok-4.7`, `grok-4.7-fast` and `grok-4.6` accept image input: paste or attach an image in the composer and ask about it. Images are normalized to the host's pixel and byte budget by its attachment service before they are sent, and an over-budget image degrades to a text description rather than being dropped silently.
+
+`grok-4.5` is **deliberately excluded**. Given a solid red image and asked its colour it answered "green", and it described a yellow square as a "circle with a black outline" — it confabulates instead of looking. The plugin therefore does not advertise image input for it, so it cannot return confident nonsense.
+
 ### Reasoning effort
 
 After selecting a Grok model, the model menu exposes a reasoning effort submenu: `low` / `medium` / `high` / `xhigh`, defaulting to `high`. The levels come from `model.reasoning` metadata (`efforts` + `defaultEffort`), so the interaction matches Codex in DSH; the levels actually available depend on the account's model catalog.
@@ -198,6 +207,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 - **Nothing changed after upgrading**: the plugin keeps running the old `lib/` — reinstall the plugin, restart `dsh web`, and hard-refresh (Ctrl+Shift+R);
 - **It reports `auth.json` permissions**: apply the `chmod 600` above; the plugin refuses symlinks and group- or other-readable files;
 - **"No reply" after sending a message**: upgrade to `1.0.1` or later. `1.0.0` had a defect where tool-calling turns aborted with a non-serializable stream chunk, leaving no reply in the UI at all.
+- **Chat or usage reports 401 "Invalid or expired credentials"**: a Grok access token only lives about 6 hours, and once it lapses chat and usage fail together. From `1.0.5` the plugin renews it through the official CLI automatically; on older versions run any `grok` command (for example `grok models`) to refresh `~/.grok/auth.json`, then click **Pull from Grok CLI**.
 
 ## Scope and support
 

package/README.md

@@ -25,7 +25,7 @@
 
 ## 三步开始
 
-1. **安装插件**：在终端运行下面的命令；指定候选版本时填写完整的 `包名@版本`，例如 `dsh-grok-subscription@1.0.4`。
+1. **安装插件**：在终端运行下面的命令；指定候选版本时填写完整的 `包名@版本`，例如 `dsh-grok-subscription@1.0.6`。
 
    ```sh
    dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
@@ -43,10 +43,12 @@
 | **订阅直连** | 复用官方 Grok Build CLI 会话，不需要 `XAI_API_KEY` |
 | **真实模型目录** | 登录后从 `/v1/models-v2` 读取账号实际可用的模型（如 `grok-4.7`、`grok-4.6`、`grok-4.5`）；未登录时不暴露任何模型 |
 | **推理档位** | 模型选择器内置 `low` / `medium` / `high` / `xhigh` 子菜单，默认 `high`，与 Codex 的交互一致 |
+| **图片输入** | `grok-4.7` / `grok-4.7-fast` / `grok-4.6` 可直接粘贴图片提问，图片由宿主的附件服务按像素与体积预算归一化 |
 | **输入框额度** | 模型选择器旁的徽章直接显示每周剩余比例，悬停或点击查看「每周额度 剩余 N% · 重置于 M/D HH:mm」 |
 | **用量面板（实验性）** | 设置页显示服务端返回的已用与剩余百分比，读取失败时不猜数字、不虚构额度 |
 | **凭据留在本机** | 只在主机侧读取 `~/.grok/auth.json` 的短期 access token；不会把 token 交给浏览器 RPC |
 | **登录状态会刷新界面** | 登录、拉取或登出后自动派发 `llm/adapters-updated`，Chat 模型列表随之更新 |
+| **token 自动续期** | access token 只有 6 小时有效期；临近过期或遇到 401 时，插件会调用官方 `grok` CLI 刷新 `auth.json` 并自动重试一次，不需要手动重新登录 |
 | **失败可见** | 订阅路由不可用时明确报错，不会静默改用其他付费路由 |
 
 这些能力共用同一份本机 Grok Build 登录。
@@ -89,7 +91,7 @@ dsh plugin --profile web add BaronCyrus/dsh-grok-subscription
 也可以按 npm 上的已发布版本安装：
 
 ```sh
-dsh plugin --profile web add dsh-grok-subscription@1.0.4
+dsh plugin --profile web add dsh-grok-subscription@1.0.6
 ```
 
 目标选择、profile 锁、依赖解析和 bundle 激活均由 DSH 负责。
@@ -143,6 +145,7 @@ dsh --profile web --dump-config
 - 输入框模型选择器旁显示每周剩余额度徽章，悬停或点击查看剩余比例与重置时间；
 - 设置页可查看服务端返回的用量与剩余百分比，失败时明确提示而不是显示猜测值；
 - 支持 CLI 登录、设备码登录、从 Grok CLI 拉取和登出；登录状态变化后 Chat 模型列表自动刷新；
+- access token 到期自动续期：临近 6 小时有效期或收到 401 时，调用官方 `grok` CLI 刷新会话并重试一次，不会中途要求手动重新登录；
 - 订阅路由不可用时明确报错，不会静默切换到其他付费路由。
 
 ### 输入框额度
@@ -153,6 +156,12 @@ dsh --profile web --dump-config
 
 仅当当前会话的 provider 为 `grok-build` 且用量读取成功时显示徽章；悬停或点击可查看「每周额度 剩余 N% · 重置于 M/D HH:mm」。徽章只反映服务端返回的每周额度；读取失败时徽章不显示，聊天不受影响。
 
+### 图片输入
+
+`grok-4.7`、`grok-4.7-fast` 与 `grok-4.6` 支持图片输入：在输入框粘贴或附加图片即可提问。图片由宿主的附件服务按像素与体积预算归一化后发送，超预算时降级为文本说明，而不是静默丢弃。
+
+`grok-4.5` **不在支持列表内**。实测给它一张纯红图片并询问颜色，它回答 "green"，还把黄色方块描述成「带黑边的圆」——它在编造而不是看图。插件因此不为它声明图片能力，避免输出看起来自信却完全错误的答案。
+
 ### 推理档位
 
 选择 Grok 模型后，模型菜单里会出现推理档位子菜单：`low` / `medium` / `high` / `xhigh`，默认 `high`。档位通过 `model.reasoning`（`efforts` + `defaultEffort`）元数据提供，因此与 Codex 在 DSH 中的交互一致；具体可用档位以账号模型目录为准。
@@ -198,6 +207,7 @@ npx -y @deepseek-ai/dsh@0.1.5-rc.2 plugin --profile web remove dsh-grok-subscrip
 - **升级后界面没变化**：插件会继续运行旧的 `lib/`，请重新安装插件并重启 `dsh web`，然后硬刷新（Ctrl+Shift+R）；
 - **提示 `auth.json` 权限不正确**：按上面的 `chmod 600` 处理；插件拒绝读取符号链接或组/其他用户可读的文件；
 - **出现「没有回复」**：请升级到 `1.0.1` 或更高版本。`1.0.0` 存在一个缺陷：工具调用轮次会因流片段无法无损序列化而整轮中止，界面上完全没有回复。
+- **聊天或用量提示 401「Invalid or expired credentials」**：Grok 的 access token 只有约 6 小时有效期，过期后聊天和用量会一起失败。`1.0.5` 起插件会自动调用官方 CLI 续期；更早版本请先运行任意 `grok` 命令（如 `grok models`）刷新 `~/.grok/auth.json`，再点面板里的「从 Grok CLI 拉取」。
 
 ## 边界与支持
 

package/lib/client.js

@@ -37,7 +37,7 @@ var import_react2 = require("react");
 var zh = {
   nav: "Grok \u8BA2\u9605",
   title: "Grok \u8BA2\u9605",
-  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.4",
+  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 1.0.6",
   signedIn: "\u5DF2\u767B\u5F55",
   signedOut: "\u672A\u767B\u5F55",
   account: "\u8D26\u6237",
@@ -87,7 +87,7 @@ var zh = {
 var en = {
   nav: "Grok Subscription",
   title: "Grok Subscription",
-  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.4",
+  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 1.0.6",
   signedIn: "Signed in",
   signedOut: "Signed out",
   account: "Account",
@@ -173,6 +173,11 @@ var MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
 var REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048;
 var REQUEST_IMAGE_MAX_BYTES = 1024 * 1024;
 var FALLBACK_MODEL_IDS = Object.freeze(["grok-4.7", "grok-4.6", "grok-4.5"]);
+var IMAGE_INPUT_MODEL_IDS = Object.freeze([
+  "grok-4.7",
+  "grok-4.7-build-fast",
+  "grok-4.6"
+]);
 
 // src/client-settings-style.js
 var SETTINGS_STYLE = `

package/lib/index.js

@@ -22,19 +22,26 @@ var AUTH_FILE_MAX_BYTES = 1048576;
 var CATALOG_TIMEOUT_MS = 15e3;
 var USAGE_TIMEOUT_MS = 8e3;
 var STORE_TOKEN_TIMEOUT_MS = 5e3;
+var TOKEN_EXPIRY_SKEW_MS = 12e4;
+var CLI_REFRESH_TIMEOUT_MS = 2e4;
 var STREAM_IDLE_TIMEOUT_MS = 10 * 60 * 1e3;
 var MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
 var REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048;
 var REQUEST_IMAGE_MAX_BYTES = 1024 * 1024;
 var FALLBACK_MODEL_IDS = Object.freeze(["grok-4.7", "grok-4.6", "grok-4.5"]);
+var IMAGE_INPUT_MODEL_IDS = Object.freeze([
+  "grok-4.7",
+  "grok-4.7-build-fast",
+  "grok-4.6"
+]);
 var IMPORT_TIMEOUT_MS = 2500;
 var CREDENTIALS_IO_TIMEOUT_MS = 1500;
 var RPC_HANDLER_TIMEOUT_MS = 8e3;
 
 // src/session.js
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 import { spawn } from "node:child_process";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 
 // src/auth-file.js
 import { lstatSync, openSync, readFileSync, closeSync, constants as fsConstants } from "node:fs";
@@ -335,6 +342,9 @@ function mergeCatalog(live) {
   }
   return live.map((model) => ({ ...model, source: "live" }));
 }
+function supportsImageInput(id) {
+  return typeof id === "string" && IMAGE_INPUT_MODEL_IDS.includes(id);
+}
 function toPiModels(models) {
   return models.map((model) => {
     const efforts = model.reasoningEfforts ?? ["low", "medium", "high", "xhigh"];
@@ -355,7 +365,7 @@ function toPiModels(models) {
       baseUrl: PROXY_BASE_URL,
       reasoning: model.reasoning !== false,
       thinkingLevelMap,
-      input: ["text"],
+      input: supportsImageInput(model.id) ? ["text", "image"] : ["text"],
       cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
       contextWindow: model.contextWindow ?? 5e5,
       maxTokens: model.maxTokens ?? 5e5,
@@ -709,6 +719,11 @@ async function fetchBillingUsage(accessToken, options = {}) {
 }
 
 // src/adapter.js
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir as homedir2 } from "node:os";
+import { dirname, join as join2 } from "node:path";
+import { pathToFileURL } from "node:url";
 function withImportTimeout(promise, ms, message) {
   let timer;
   return Promise.race([
@@ -720,18 +735,115 @@ function withImportTimeout(promise, ms, message) {
     if (timer) clearTimeout(timer);
   });
 }
+function hostModuleRoots(env = process.env, argv1 = process.argv[1]) {
+  const roots = [];
+  const push = (dir) => {
+    if (typeof dir === "string" && dir && !roots.includes(dir)) roots.push(dir);
+  };
+  const override = env.DSH_GROK_PEER_ROOT;
+  if (typeof override === "string" && override.trim()) push(override.trim());
+  if (typeof argv1 === "string" && argv1) {
+    let dir = dirname(argv1);
+    for (let depth = 0; depth < 6 && dir && dir !== dirname(dir); depth++) {
+      push(join2(dir, "node_modules"));
+      dir = dirname(dir);
+    }
+  }
+  const prefix = env.NPM_CONFIG_PREFIX;
+  if (typeof prefix === "string" && prefix.trim()) push(join2(prefix.trim(), "lib", "node_modules"));
+  push(join2(homedir2(), ".local", "lib", "node_modules"));
+  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME.trim() ? env.DSH_HOME.trim() : join2(homedir2(), ".dsh");
+  push(join2(dshHome, "profiles", "node_modules"));
+  return roots;
+}
+function splitSpecifier(specifier) {
+  const parts = specifier.split("/");
+  const take = specifier.startsWith("@") ? 2 : 1;
+  return {
+    name: parts.slice(0, take).join("/"),
+    subpath: parts.length > take ? `./${parts.slice(take).join("/")}` : "."
+  };
+}
+function pickExportTarget(value) {
+  if (typeof value === "string") return value;
+  if (!value || typeof value !== "object") return void 0;
+  for (const condition of ["import", "module", "default", "node"]) {
+    if (condition in value) {
+      const picked = pickExportTarget(value[condition]);
+      if (picked) return picked;
+    }
+  }
+  return void 0;
+}
+function resolveExportsTarget(exportsField, subpath) {
+  if (typeof exportsField === "string") return subpath === "." ? exportsField : void 0;
+  if (!exportsField || typeof exportsField !== "object") return void 0;
+  const keys = Object.keys(exportsField);
+  const isSubpathMap = keys.some((key) => key === "." || key.startsWith("./"));
+  if (!isSubpathMap) return subpath === "." ? pickExportTarget(exportsField) : void 0;
+  if (subpath in exportsField) return pickExportTarget(exportsField[subpath]);
+  for (const key of keys) {
+    const star = key.indexOf("*");
+    if (star === -1) continue;
+    const prefix = key.slice(0, star);
+    const suffix = key.slice(star + 1);
+    if (!subpath.startsWith(prefix) || !subpath.endsWith(suffix)) continue;
+    const matched = subpath.slice(prefix.length, subpath.length - suffix.length);
+    const target = pickExportTarget(exportsField[key]);
+    if (target) return target.replace("*", matched);
+  }
+  return void 0;
+}
+function resolveHostSpecifierManually(root, specifier) {
+  const { name: name2, subpath } = splitSpecifier(specifier);
+  for (const pkgDir of [join2(root, name2), join2(root, "node_modules", name2)]) {
+    const manifest = join2(pkgDir, "package.json");
+    if (!existsSync2(manifest)) continue;
+    let pkg;
+    try {
+      pkg = JSON.parse(readFileSync3(manifest, "utf8"));
+    } catch {
+      continue;
+    }
+    const target = pkg.exports !== void 0 ? resolveExportsTarget(pkg.exports, subpath) : subpath === "." ? pkg.module ?? pkg.main ?? "index.js" : void 0;
+    if (typeof target !== "string" || !target) continue;
+    const file = join2(pkgDir, target);
+    if (existsSync2(file)) return file;
+  }
+  return void 0;
+}
+function resolveHostSpecifier(specifier, roots = hostModuleRoots()) {
+  for (const root of roots) {
+    try {
+      const resolved = createRequire(join2(root, "noop.js")).resolve(specifier);
+      if (typeof resolved === "string" && resolved) return resolved;
+    } catch {
+    }
+    const manual = resolveHostSpecifierManually(root, specifier);
+    if (manual) return manual;
+  }
+  return void 0;
+}
 async function optionalImport(specifier, options = {}) {
   const timeoutMs = typeof options.timeoutMs === "number" && options.timeoutMs > 0 ? options.timeoutMs : IMPORT_TIMEOUT_MS;
-  const importFn = typeof options.importFn === "function" ? options.importFn : (id) => import(id);
-  try {
-    return await withImportTimeout(
-      Promise.resolve(importFn(specifier)),
-      timeoutMs,
-      `Import timed out after ${timeoutMs}ms: ${specifier}`
-    );
-  } catch {
-    return void 0;
+  const injected = typeof options.importFn === "function" ? options.importFn : void 0;
+  const importFn = injected ?? ((id) => import(id));
+  const candidates = [specifier];
+  if (!injected && !specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("file:")) {
+    const resolved = resolveHostSpecifier(specifier, options.hostRoots ?? hostModuleRoots());
+    if (resolved) candidates.push(pathToFileURL(resolved).href);
+  }
+  for (const candidate of candidates) {
+    try {
+      return await withImportTimeout(
+        Promise.resolve(importFn(candidate)),
+        timeoutMs,
+        `Import timed out after ${timeoutMs}ms: ${specifier}`
+      );
+    } catch {
+    }
   }
+  return void 0;
 }
 function textOf(content) {
   if (typeof content === "string") return content;
@@ -1068,22 +1180,38 @@ function createDuckAdapter(session) {
         yield { type: "finish", reason: { kind: "error", failure: { message: "Unknown provider", code: "NO_ADAPTER" } } };
         return;
       }
-      const token = await session.currentToken();
+      let token = await session.currentToken();
       if (!token) {
         yield { type: "finish", reason: { kind: "error", failure: { message: "Grok subscription is not signed in", code: "MISSING_CREDENTIAL" } } };
         return;
       }
-      try {
-        yield* streamResponses(options, token);
-      } catch (error) {
-        const aborted = options.signal?.aborted === true;
-        const failure = {
-          message: error instanceof Error ? error.message : "Grok Build request failed",
-          code: aborted ? "ABORTED" : "PROVIDER"
-        };
-        const status = finiteOr(error?.status, void 0);
-        if (status !== void 0) failure.status = status;
-        yield { type: "finish", reason: { kind: aborted ? "aborted" : "error", failure } };
+      for (let attempt = 0; ; attempt++) {
+        let emitted = false;
+        try {
+          for await (const chunk of streamResponses(options, token)) {
+            emitted = true;
+            yield chunk;
+          }
+          return;
+        } catch (error) {
+          const aborted = options.signal?.aborted === true;
+          const status = finiteOr(error?.status, void 0);
+          const canRetry = !aborted && !emitted && attempt === 0 && status === 401 && typeof session.refreshToken === "function";
+          if (canRetry) {
+            const renewed = await session.refreshToken();
+            if (renewed && renewed !== token) {
+              token = renewed;
+              continue;
+            }
+          }
+          const failure = {
+            message: status === 401 ? "Grok Build session is expired or unauthorized (HTTP 401). Run grok login, then Pull from Grok CLI." : error instanceof Error ? error.message : "Grok Build request failed",
+            code: aborted ? "ABORTED" : status === 401 ? "UNAUTHORIZED" : "PROVIDER"
+          };
+          if (status !== void 0) failure.status = status;
+          yield { type: "finish", reason: { kind: aborted ? "aborted" : "error", failure } };
+          return;
+        }
       }
     }
   };
@@ -1268,7 +1396,11 @@ async function createGrokBuildAdapter(session, options = {}) {
         env: async () => void 0,
         fileExists: async () => false
       })
-    })
+    }),
+    // The host's durable attachment store. Without it PiAiAdapter rejects any
+    // request carrying an image ("requires the durable attachment service"),
+    // and with it images are normalized to the configured budget for us.
+    resolveAttachments: typeof options.resolveAttachments === "function" ? () => options.resolveAttachments() : void 0
   });
   return {
     adapter,
@@ -1280,17 +1412,17 @@ async function createGrokBuildAdapter(session, options = {}) {
 }
 
 // src/session.js
-function resolveGrokBin(env = process.env, exists = existsSync2) {
+function resolveGrokBin(env = process.env, exists = existsSync3) {
   if (typeof env.DSH_GROK_BIN === "string" && env.DSH_GROK_BIN.trim()) return env.DSH_GROK_BIN.trim();
-  const local = join2(grokHome(env), "bin", "grok");
+  const local = join3(grokHome(env), "bin", "grok");
   if (exists(local)) return local;
   return "grok";
 }
-function grokCliAvailable(env = process.env, exists = existsSync2) {
+function grokCliAvailable(env = process.env, exists = existsSync3) {
   const bin = resolveGrokBin(env, exists);
   if (bin.includes("/") || bin.includes("\\")) return exists(bin);
   const delimiter = process.platform === "win32" ? ";" : ":";
-  return String(env.PATH ?? "").split(delimiter).some((dir) => dir && exists(join2(dir, bin)));
+  return String(env.PATH ?? "").split(delimiter).some((dir) => dir && exists(join3(dir, bin)));
 }
 function spawnGrokLogin(options = {}) {
   const spawnFn = options.spawn ?? spawn;
@@ -1310,6 +1442,52 @@ function spawnGrokLogin(options = {}) {
     });
   });
 }
+function spawnGrokRefresh(options = {}) {
+  const spawnFn = options.spawn ?? spawn;
+  const bin = resolveGrokBin(options.env, options.exists);
+  const timeoutMs = typeof options.timeoutMs === "number" && options.timeoutMs > 0 ? options.timeoutMs : CLI_REFRESH_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawnFn(bin, ["models"], {
+        stdio: options.stdio ?? "ignore",
+        env: options.env ?? process.env
+      });
+    } catch (error) {
+      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
+      return;
+    }
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve({ ok: false, reason: "timeout" });
+    }, timeoutMs);
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error(`Could not run grok CLI (${bin})`, { cause: error }));
+    });
+    child.on("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok: true, code });
+    });
+  });
+}
+async function defaultRenewSession(options = {}) {
+  const env = options.env ?? process.env;
+  if (!grokCliAvailable(env)) return void 0;
+  await spawnGrokRefresh({ env });
+  const parsed = (options.readAuth ?? readGrokAuthSession)();
+  return parsed?.session;
+}
 async function defaultCredentialRefOf() {
   try {
     const mod = await optionalImport("@deepseek-ai/dsh-credentials");
@@ -1344,12 +1522,15 @@ function createSessionService({
   readAuth = readGrokAuthSession,
   storeTokenTimeoutMs = STORE_TOKEN_TIMEOUT_MS,
   credentialsIoTimeoutMs = CREDENTIALS_IO_TIMEOUT_MS,
-  credentialRefOf = defaultCredentialRefOf
+  credentialRefOf = defaultCredentialRefOf,
+  renewSession = defaultRenewSession,
+  now = () => Date.now()
 } = {}) {
   let catalog = { models: [], source: "signed-out", error: void 0 };
   let lastPublic = publicSessionView(void 0);
   let lastUsage = unavailable("Not fetched yet");
   let memoryAccessToken;
+  let memoryTokenExpiresAt;
   let memorySessionTouched = false;
   const resolveTimeoutMs = () => {
     return typeof storeTokenTimeoutMs === "number" && storeTokenTimeoutMs > 0 ? storeTokenTimeoutMs : STORE_TOKEN_TIMEOUT_MS;
@@ -1357,6 +1538,48 @@ function createSessionService({
   const resolveIoTimeoutMs = () => {
     return typeof credentialsIoTimeoutMs === "number" && credentialsIoTimeoutMs > 0 ? credentialsIoTimeoutMs : CREDENTIALS_IO_TIMEOUT_MS;
   };
+  const epochMs = (value) => {
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+    if (typeof value === "string" && value.trim()) {
+      const parsed = Date.parse(value.trim());
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    return void 0;
+  };
+  const adoptSession = (session) => {
+    if (!session?.accessToken) return void 0;
+    memoryAccessToken = session.accessToken;
+    memoryTokenExpiresAt = epochMs(session.expiresAt);
+    memorySessionTouched = true;
+    lastPublic = publicSessionView(session);
+    return memoryAccessToken;
+  };
+  const memoryTokenNeedsRenewal = () => {
+    if (typeof memoryAccessToken !== "string" || memoryAccessToken.length === 0) return false;
+    if (typeof memoryTokenExpiresAt !== "number") return false;
+    return memoryTokenExpiresAt - TOKEN_EXPIRY_SKEW_MS <= now();
+  };
+  let renewalInFlight;
+  const renewAccessToken = async () => {
+    if (renewalInFlight) return renewalInFlight;
+    renewalInFlight = (async () => {
+      try {
+        const session = await renewSession();
+        const token = adoptSession(session);
+        if (token) notifyCatalogChange();
+        return token;
+      } catch (error) {
+        logger?.warn?.(
+          "Grok subscription session renewal failed: %s",
+          error instanceof Error ? error.message : "unknown"
+        );
+        return void 0;
+      } finally {
+        renewalInFlight = void 0;
+      }
+    })();
+    return renewalInFlight;
+  };
   const notifyCatalogChange = () => {
     scheduleDeferred(() => {
       try {
@@ -1371,7 +1594,9 @@ function createSessionService({
   };
   const readStoredToken = async () => {
     if (typeof memoryAccessToken === "string" && memoryAccessToken.length > 0) {
-      return memoryAccessToken;
+      if (!memoryTokenNeedsRenewal()) return memoryAccessToken;
+      const renewed = await renewAccessToken();
+      return renewed ?? memoryAccessToken;
     }
     if (memorySessionTouched) return void 0;
     if (!credentials?.resolve) return void 0;
@@ -1485,6 +1710,7 @@ function createSessionService({
     }
     const accessToken = parsed.session.accessToken;
     memoryAccessToken = accessToken;
+    memoryTokenExpiresAt = epochMs(parsed.session.expiresAt);
     memorySessionTouched = true;
     lastPublic = publicSessionView(parsed.session);
     scheduleDeferred(() => {
@@ -1507,9 +1733,7 @@ function createSessionService({
     try {
       const parsed = readAuth();
       if (parsed.session) {
-        memoryAccessToken = parsed.session.accessToken;
-        memorySessionTouched = true;
-        lastPublic = publicSessionView(parsed.session);
+        adoptSession(parsed.session);
         return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
       }
     } catch (error) {
@@ -1562,6 +1786,8 @@ function createSessionService({
     login,
     logout,
     currentToken: readStoredToken,
+    /** Force a CLI-backed renewal; used when the provider answers 401. */
+    refreshToken: () => renewAccessToken(),
     models: () => catalog.models,
     catalog: () => catalog,
     usage: () => lastUsage,
@@ -1861,8 +2087,15 @@ async function deferredBoot(ctx, session, notifyCatalogChange, options = {}) {
   }
   if (options.skipUpgrade) return;
   const createAsync = options.createAsync ?? createGrokBuildAdapter;
+  const resolveAttachments = () => {
+    try {
+      return typeof ctx.get === "function" ? ctx.get("attachments") : void 0;
+    } catch {
+      return void 0;
+    }
+  };
   try {
-    const created = await createAsync(session);
+    const created = await createAsync(session, { ...options.adapterOptions, resolveAttachments });
     if (created.kind === "pi-ai") {
       if (created.note) ctx.logger?.warn?.(created.note);
       ctx.llm.registerAdapter([PROVIDER_ID], created.adapter);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-grok-subscription",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Use a SuperGrok or X Premium Grok Build subscription in DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",