dsh-grok-subscription 2.0.3 → 2.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/README.en.md +16 -14
  3. package/README.md +15 -13
  4. package/SECURITY.md +5 -4
  5. package/docs/guide.en.md +15 -21
  6. package/docs/guide.zh-CN.md +15 -21
  7. package/lib/client.js +16 -22
  8. package/lib/index.js +493 -204
  9. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,18 @@
1
1
  # Changelog
2
2
 
3
+ ## 2.0.5 — 2026-10-01
4
+
5
+ - Fix **every conversation failing with HTTP 426** once the subscription proxy started requiring `x-grok-client-version` `1.0.13` or later. On a machine with no grok CLI — the normal case since 2.0.4 — the plugin advertised the hardcoded `1.0.5`, and `POST /v1/responses` answered `Your Grok CLI version (1.0.5) is outdated`. Settings, the model list and the quota card kept working, because `GET /v1/models-v2` and `GET /v1/billing` are not gated. Fixes #1.
6
+ - The value sent when no current CLI release is known is now `99.0.0`. Measured against the live proxy on 2026-10-01, the check is a **minimum with no upper bound**: `1.0.5` and the prerelease `1.0.13-rc1` are 426, and `1.0.13`, `1.0.14`, `1.1.0`, `2.0.0` and `99.0.0` are 200. A fallback can only be too old, which is the failure this release hit, so it stays far ahead of the published minimum instead of tracking each CLI release. `User-Agent` remains `grok-shell/` plus the same version.
7
+ - A `version.json` that is missing, unreadable, not a `MAJOR.MINOR.PATCH` release, or older than the fallback no longer lowers the header. A release at or above the fallback is still advertised. `DSH_GROK_CLIENT_VERSION` still wins exactly as set, including a value the proxy would reject.
8
+ - That override cannot live in `~/.dsh/.env`. `dsh-app-boot` refuses every `DSH_`-prefixed name, so it has to be exported in the environment that launches DSH, followed by a full restart. Both guides now have a troubleshooting row for the 426.
9
+
10
+ ## 2.0.4 — 2026-09-30
11
+
12
+ - **Sign-in and renewal no longer run the grok command.** Settings requests a device code from `https://auth.x.ai`, shows the link and one-time code, and writes the session into `${GROK_HOME:-~/.grok}/auth.json` after the browser confirms it. A token near expiry is renewed with the refresh token at the same token endpoint. The official CLI binary is not required, and an `auth.json` already written by `grok login` can still be loaded with **Read saved session**.
13
+ - Only the OAuth entry is rewritten. API-key entries stay. The file is replaced atomically and kept at mode `0600`; a symlink is still refused. The refresh token is not copied into DSH credentials and is not returned to the browser. The device code stays in the host process.
14
+ - No model-routing, image, or quota behavior changes.
15
+
3
16
  ## 2.0.3 — 2026-09-29
4
17
 
5
18
  - Use the **documented context window**, not the 256k value `models-v2` currently returns. The public model table lists `grok-4.7`, `grok-4.6` and `grok-4.5` at 500k, and `grok-4.7` Fast as the same model; only `grok-build-0.1` is 256k. The subscription catalog reports `context_window: 256000` for all four Build models anyway. A model id in that table now keeps the documented window (`grok-4.7-build-fast` included) even when the catalog says otherwise. An id that is not in the table still uses the catalog value, and the static fallback when a window is missing is 500k again.
package/README.en.md CHANGED
@@ -8,7 +8,7 @@
8
8
 
9
9
  **Code, ask about images, and adjust reasoning in DSH with your Grok Build subscription.**
10
10
 
11
- Reuse the official Grok Build CLI session to select models, attach images, and check weekly quota inside DeepSeek Harness.
11
+ Use a SuperGrok / X Premium Grok Build session to select models, attach images, and check weekly quota inside DeepSeek Harness.
12
12
  No separate pay-as-you-go xAI API key is required.
13
13
 
14
14
  [![CI](https://github.com/BaronCyrus/dsh-grok-subscription/actions/workflows/ci.yml/badge.svg)](https://github.com/BaronCyrus/dsh-grok-subscription/actions/workflows/ci.yml)
@@ -27,12 +27,12 @@ No separate pay-as-you-go xAI API key is required.
27
27
 
28
28
  | Capability | What it does |
29
29
  | --- | --- |
30
- | **Reuse subscription sign-in** | Start CLI / device-code login in Settings, or pull an existing Grok CLI session without manually pasting tokens |
30
+ | **Subscription sign-in** | Start a device-code login in Settings, or read an existing `auth.json`, without installing the grok command or pasting tokens |
31
31
  | **Model catalog sync** | Prefers the account's live catalog after sign-in, with a built-in fallback when that read fails; no models appear while signed out |
32
32
  | **Reasoning effort** | Select the levels offered by each model, typically `low` / `medium` / `high` / `xhigh`, with `high` preferred by default |
33
33
  | **Image input** | Paste or attach images for supported models; Settings shows the active adapter path and attachment capability |
34
34
  | **Weekly quota** | The composer badge and Settings show reported usage; the experimental quota reader never invents missing numbers |
35
- | **Session renewal and updates** | Attempts renewal through the official CLI near token expiry or after an authentication rejection; Settings also checks plugin versions |
35
+ | **Session renewal and updates** | Renews with the refresh token near expiry or after an authentication rejection; Settings also checks plugin versions |
36
36
  | **No tokens in browser responses** | Access tokens are used Host-side; a subscription failure never silently selects another paid model route |
37
37
 
38
38
  <a id="three-step-start"></a>
@@ -40,9 +40,9 @@ No separate pay-as-you-go xAI API key is required.
40
40
 
41
41
  ## Install
42
42
 
43
- You need **DeepSeek Harness**, the **official Grok Build CLI on the same machine**, and a SuperGrok / X Premium account that **currently has Grok Build access**. The subscription name alone does not guarantee that access; the account's actual authorization determines it.
43
+ You need **DeepSeek Harness** and a SuperGrok / X Premium account that **currently has Grok Build access**. The grok command is not required. The subscription name alone does not guarantee that access; the account's actual authorization determines it.
44
44
 
45
- For DSH setup, see the [official instructions](https://github.com/deepseek-ai/deepseek-harness#run). Version requirements and CLI paths are covered in [Installation and compatibility](docs/guide.en.md#installation-and-compatibility).
45
+ For DSH setup, see the [official instructions](https://github.com/deepseek-ai/deepseek-harness#run). Version requirements are covered in [Installation and compatibility](docs/guide.en.md#installation-and-compatibility).
46
46
 
47
47
  ### 1. Install the plugin
48
48
 
@@ -50,9 +50,9 @@ In the desktop app open **Settings → Plugins**, type the package name `dsh-gro
50
50
 
51
51
  ### 2. Sign in
52
52
 
53
- Open **Settings → Grok Subscription** and select **CLI login** or **Device-code login**. Follow the browser and panel instructions. If you already ran `grok login`, select **Pull from Grok CLI**.
53
+ Open **Settings → Grok Subscription** and select **Sign in**. The panel shows a link and a one-time code; after you authorize, the session is written to `~/.grok/auth.json`. If this machine already has a session file, select **Read saved session**.
54
54
 
55
- > This plugin relies on the official Grok Build CLI for sign-in and renewal; it is not CLI-independent. Do not paste `XAI_API_KEY`, and never share `auth.json` or tokens in chats, screenshots, or public issues.
55
+ > Sign-in and renewal run inside the plugin. It does not invoke the grok command. Do not paste `XAI_API_KEY`, and never share `auth.json` or tokens in chats, screenshots, or public issues.
56
56
 
57
57
  ### 3. Select a model
58
58
 
@@ -61,16 +61,16 @@ Pick a Grok model your account can use, adjust reasoning effort as needed, and s
61
61
  <details>
62
62
  <summary>Check the version / pin one / fall back when the UI install fails</summary>
63
63
 
64
- **Settings → Plugins** lists the installed plugins and their versions, and the plugin's own **Settings → Grok Subscription** page shows a version card. To pin a version, put the full `package@version` in the install field, for example `dsh-grok-subscription@2.0.3`.
64
+ **Settings → Plugins** lists the installed plugins and their versions, and the plugin's own **Settings → Grok Subscription** page shows a version card. To pin a version, put the full `package@version` in the install field, for example `dsh-grok-subscription@2.0.5`.
65
65
 
66
66
  If the UI install fails (an unusual profile directory, say), the equivalent runs against the desktop profile itself (pnpm ≥ 11):
67
67
 
68
68
  ```sh
69
69
  cd "$HOME/.dsh/profiles/desktop" # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
70
- pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
70
+ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.5
71
71
  ```
72
72
 
73
- `dsh plugin --profile desktop …` is refused: the Electron application owns that profile exclusively. CLI paths, sign-in, and troubleshooting are in the [full user guide](docs/guide.en.md).
73
+ `dsh plugin --profile desktop …` is refused: the Electron application owns that profile exclusively. Sign-in and troubleshooting are in the [full user guide](docs/guide.en.md).
74
74
 
75
75
  </details>
76
76
 
@@ -111,7 +111,7 @@ Identity and time values in the account screenshot are demo data. Usage screensh
111
111
 
112
112
  ## User guide
113
113
 
114
- The [full user guide](docs/guide.en.md) covers installation and compatibility, CLI sign-in, the model catalog, images, quota limitations, network troubleshooting, and development.
114
+ The [full user guide](docs/guide.en.md) covers installation and compatibility, device-code sign-in, the model catalog, images, quota limitations, network troubleshooting, and development.
115
115
 
116
116
  Quick links: [Sign-in and credentials](docs/guide.en.md#sign-in-and-credentials) · [Image input](docs/guide.en.md#image-input) · [Troubleshooting](docs/guide.en.md#troubleshooting) · [Contributing](CONTRIBUTING.md).
117
117
 
@@ -121,18 +121,20 @@ Quick links: [Sign-in and credentials](docs/guide.en.md#sign-in-and-credentials)
121
121
 
122
122
  The desktop app owns its `desktop` profile exclusively, so `dsh plugin --profile desktop …` is refused there. The desktop **Update plugin** button therefore installs the exact version inside that profile directory with DSH's own bundled pnpm; before `1.1.1` that button always failed in the desktop app. Manual steps: [Updates and sign-out](docs/guide.en.md#updates-and-sign-out).
123
123
 
124
- **Uninstall:** remove `dsh-grok-subscription` in **Settings → Plugins**, or run `pnpm remove dsh-grok-subscription` in that profile directory, then restart the desktop app. Uninstalling leaves other plugins, the profile, and the CLI's `auth.json` intact, and is not the same as signing out of the official CLI; see [Updates and sign-out](docs/guide.en.md#updates-and-sign-out).
124
+ **Uninstall:** remove `dsh-grok-subscription` in **Settings → Plugins**, or run `pnpm remove dsh-grok-subscription` in that profile directory, then restart the desktop app. Uninstalling leaves other plugins, the profile, and `~/.grok/auth.json` intact, and does not revoke the xAI authorization; see [Updates and sign-out](docs/guide.en.md#updates-and-sign-out).
125
125
 
126
- Restart DSH afterwards. Removal does not delete other plugins, the whole profile, or the CLI's `auth.json`; it is not the same as signing out of the official CLI. See [Updates and sign-out](docs/guide.en.md#updates-and-sign-out).
126
+ Restart DSH afterwards. Removal does not delete other plugins, the whole profile, or `~/.grok/auth.json`, and it does not revoke the xAI authorization. See [Updates and sign-out](docs/guide.en.md#updates-and-sign-out).
127
127
 
128
128
  <a id="troubleshooting"></a>
129
129
 
130
130
  ## FAQ
131
131
 
132
- **Empty model list?** Confirm that the official CLI has a subscription session, then select **Pull from Grok CLI** in Settings. An API-key-only CLI configuration is not a subscription login.
132
+ **Empty model list?** Sign in from Settings, or select **Read saved session**. An API-key-only entry is not a subscription login.
133
133
 
134
134
  **Sign-in or requests time out?** Check connectivity from the DSH host to account and subscription services, including its launch-time proxy settings. Network issues, authentication, or service errors can cause failures; do not assume the quota is exhausted. See [Troubleshooting](docs/guide.en.md#troubleshooting).
135
135
 
136
+ **A message fails with HTTP 426 and says the CLI is outdated?** Update to the current release and restart completely. Settings and the model list can still look healthy, because only generation checks the client version. See [Troubleshooting](docs/guide.en.md#troubleshooting).
137
+
136
138
  **Images still unavailable after updating?** Fully restart the desktop app, check the model's image support, and check that **Active path** in Settings reads **official pi-ai** with attachment capability available. An **unavailable** row means the host has no pi-ai adapter.
137
139
 
138
140
  ## Scope and support
package/README.md CHANGED
@@ -8,7 +8,7 @@
8
8
 
9
9
  **用 Grok Build 订阅，在 DSH 里编程、看图、切换推理档位。**
10
10
 
11
- 复用官方 Grok Build CLI 登录会话，在 DeepSeek Harness 中选模型、带图提问、查看每周额度。
11
+ 用 SuperGrok / X Premium 的 Grok Build 会话，在 DeepSeek Harness 中选模型、带图提问、查看每周额度。
12
12
  无需另配 xAI 按量计费 API Key。
13
13
 
14
14
  [![CI](https://github.com/BaronCyrus/dsh-grok-subscription/actions/workflows/ci.yml/badge.svg)](https://github.com/BaronCyrus/dsh-grok-subscription/actions/workflows/ci.yml)
@@ -27,12 +27,12 @@
27
27
 
28
28
  | 能力 | 使用体验 |
29
29
  | --- | --- |
30
- | **复用订阅登录** | 在设置页发起 CLI / 设备码登录，或拉取已有 Grok CLI 会话，无需手动粘贴 token |
30
+ | **订阅登录** | 在设置页用设备码登录，或读取已有的 `auth.json`，无需安装 grok 命令，也不用手动粘贴 token |
31
31
  | **模型目录同步** | 登录后优先读取账号模型目录；读取失败时可使用内置目录，未登录时不显示模型 |
32
32
  | **推理档位** | 在模型菜单中选择可用档位，通常包含 `low` / `medium` / `high` / `xhigh`，默认优先使用 `high` |
33
33
  | **图片输入** | 支持的模型可接收粘贴或附加的图片；设置页可检查当前运行通路与附件能力 |
34
34
  | **每周额度** | 输入框徽章和设置页展示服务端返回的用量；额度接口为实验性，读取失败不编造数字 |
35
- | **会话续期与更新** | 临近过期或认证拒绝时尝试通过官方 CLI 续期；设置页也可检查插件版本 |
35
+ | **会话续期与更新** | 临近过期或认证拒绝时用 refresh token 续期；设置页也可检查插件版本 |
36
36
  | **凭据不返回浏览器** | access token 仅在 Host 侧使用；订阅失败不会静默改用其他付费模型路由 |
37
37
 
38
38
  <a id="三步开始"></a>
@@ -40,9 +40,9 @@
40
40
 
41
41
  ## 安装
42
42
 
43
- 需要 **DeepSeek Harness**、运行在同一台机器上的**官方 Grok Build CLI**，以及**当前具有 Grok Build 使用资格**的 SuperGrok / X Premium 账号。订阅名称本身不保证访问资格，以账号实际授权为准。
43
+ 需要 **DeepSeek Harness**，以及**当前具有 Grok Build 使用资格**的 SuperGrok / X Premium 账号。不需要安装 grok 命令。订阅名称本身不保证访问资格，以账号实际授权为准。
44
44
 
45
- 尚未安装 DSH，可查看 [DSH 官方说明](https://github.com/deepseek-ai/deepseek-harness#run)。版本要求与 CLI 路径说明见 [安装与兼容性](docs/guide.zh-CN.md#安装与兼容性)。
45
+ 尚未安装 DSH，可查看 [DSH 官方说明](https://github.com/deepseek-ai/deepseek-harness#run)。版本要求见 [安装与兼容性](docs/guide.zh-CN.md#安装与兼容性)。
46
46
 
47
47
  ### 1. 安装插件
48
48
 
@@ -50,9 +50,9 @@
50
50
 
51
51
  ### 2. 登录订阅
52
52
 
53
- 打开 **设置 → Grok 订阅**，点击 **CLI 登录** 或 **设备码登录**，按浏览器和面板提示授权。已经运行过 `grok login`，可直接点击 **从 Grok CLI 拉取**。
53
+ 打开 **设置 → Grok 订阅**，点击 **登录**。面板会给出链接和一次性验证码；授权完成后会话自动写入 `~/.grok/auth.json`。如果这台机器上已经有一份会话文件，点击 **读取已保存的会话**。
54
54
 
55
- > 本插件依赖官方 Grok Build CLI 管理登录与续期，不是免 CLI 的方案。请勿粘贴 `XAI_API_KEY`，也不要把 `auth.json` 或 token 发到聊天、截图和公开 Issue 中。
55
+ > 登录和续期由插件自己完成，不调用 grok 命令。请勿粘贴 `XAI_API_KEY`，也不要把 `auth.json` 或 token 发到聊天、截图和公开 Issue 中。
56
56
 
57
57
  ### 3. 选择模型
58
58
 
@@ -61,16 +61,16 @@
61
61
  <details>
62
62
  <summary>确认版本 / 固定版本 / 界面安装失败时的兜底</summary>
63
63
 
64
- **设置 → 插件** 会列出已安装插件与版本，插件自己的 **设置 → Grok 订阅** 页也有版本卡片。要固定版本，在安装框里填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.3`。
64
+ **设置 → 插件** 会列出已安装插件与版本，插件自己的 **设置 → Grok 订阅** 页也有版本卡片。要固定版本，在安装框里填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.5`。
65
65
 
66
66
  界面安装失败时（例如 profile 目录权限异常），可以对桌面版 profile 手动执行等价操作（pnpm ≥ 11）：
67
67
 
68
68
  ```sh
69
69
  cd "$HOME/.dsh/profiles/desktop" # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
70
- pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
70
+ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.5
71
71
  ```
72
72
 
73
- `dsh plugin --profile desktop …` 会被拒绝：桌面版 profile 由 Electron 应用独占。CLI 路径、登录方式与故障排查见 [完整使用指南](docs/guide.zh-CN.md)。
73
+ `dsh plugin --profile desktop …` 会被拒绝：桌面版 profile 由 Electron 应用独占。登录方式与故障排查见 [完整使用指南](docs/guide.zh-CN.md)。
74
74
 
75
75
  </details>
76
76
 
@@ -111,7 +111,7 @@ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
111
111
 
112
112
  ## 使用指南
113
113
 
114
- [完整使用指南](docs/guide.zh-CN.md) 包含安装与兼容性、CLI 登录、模型目录、图片输入、额度限制、网络排查和本地开发。
114
+ [完整使用指南](docs/guide.zh-CN.md) 包含安装与兼容性、设备码登录、模型目录、图片输入、额度限制、网络排查和本地开发。
115
115
 
116
116
  常用入口：[登录与凭据](docs/guide.zh-CN.md#登录与凭据) · [图片输入](docs/guide.zh-CN.md#图片输入) · [故障排查](docs/guide.zh-CN.md#故障排查) · [参与贡献](CONTRIBUTING.md)。
117
117
 
@@ -121,14 +121,16 @@ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
121
121
 
122
122
  桌面版由 Electron 应用独占 `desktop` profile，`dsh plugin --profile desktop …` 会被直接拒绝，因此桌面版的「更新插件」由插件在该 profile 目录中用 DSH 自带的 pnpm 安装精确版本；`1.1.1` 之前该按钮在桌面版必然失败，手动步骤见[更新与登出](docs/guide.zh-CN.md#更新与登出)。
123
123
 
124
- **卸载：** 在 **设置 → 插件** 里移除 `dsh-grok-subscription`，或在该 profile 目录执行 `pnpm remove dsh-grok-subscription`，然后重启桌面应用。卸载不会删除其他插件、整个 profile 或 Grok CLI 的 `auth.json`，也不等于从官方 CLI 登出；清理范围见 [更新与登出](docs/guide.zh-CN.md#更新与登出)。
124
+ **卸载：** 在 **设置 → 插件** 里移除 `dsh-grok-subscription`，或在该 profile 目录执行 `pnpm remove dsh-grok-subscription`，然后重启桌面应用。卸载不会删除其他插件、整个 profile 或 `~/.grok/auth.json`，也不等于在 xAI 撤销授权；清理范围见 [更新与登出](docs/guide.zh-CN.md#更新与登出)。
125
125
 
126
126
  ## 常见问题
127
127
 
128
- **模型列表为空？** 先确认官方 Grok CLI 已完成订阅登录，再在设置页点击「从 Grok CLI 拉取」。只有 API Key 的 CLI 配置不等于订阅登录。
128
+ **模型列表为空？** 先在设置页完成订阅登录，或点击「读取已保存的会话」。只有 API Key 的条目不等于订阅登录。
129
129
 
130
130
  **登录或请求超时？** 检查 DSH 所在机器能否连接账号与订阅服务，以及启动环境的代理设置。网络、登录状态和服务端异常都可能导致失败，不要直接认定为额度耗尽。见 [故障排查](docs/guide.zh-CN.md#故障排查)。
131
131
 
132
+ **发一条消息就返回 426，说 CLI 版本过旧？** 更新到当前版本并完全重启。设置页和模型列表仍可能正常，因为只有生成接口检查客户端版本。见 [故障排查](docs/guide.zh-CN.md#故障排查)。
133
+
132
134
  **更新后不能带图？** 完整重启桌面应用，检查模型是否在图片支持列表，以及设置页的「运行通路」是否显示**官方 pi-ai** 且附件能力可用。若显示「不可用」，说明宿主缺少 pi-ai 适配器。
133
135
 
134
136
  ## 边界与支持
package/SECURITY.md CHANGED
@@ -1,9 +1,10 @@
1
1
  # 安全说明 / Security
2
2
 
3
- - 插件只读取 `${GROK_HOME:-~/.grok}/auth.json`，从不写回；拒绝符号链接、非普通文件、非当前用户所有的文件，以及组/其他用户可读写执行的文件。Unix 下应为 `0600`。
4
- - 只有短期 access token 会通过 DSH credentials 服务保存；refresh token 始终留在 Grok CLI 文件中。
5
- - token 不会写入日志，也不会通过浏览器 RPC 返回。RPC 只返回脱敏账户、状态、模型与无敏感信息的错误摘要。
6
- - 订阅 token 只发送到固定 HTTPS 主机 `cli-chat-proxy.grok.com`。
3
+ - 插件读写 `${GROK_HOME:-~/.grok}/auth.json`。读取和写入都拒绝符号链接、非普通文件、非当前用户所有的文件。读取还拒绝组/其他用户可读写执行的文件；写入使用临时文件替换，并把结果设为 `0600`。Unix 下应为 `0600`。
4
+ - 写入只更新 OAuth 会话那一条，保留文件里的其他条目。
5
+ - 只有短期 access token 会通过 DSH credentials 服务保存；refresh token 始终留在 auth.json 中。
6
+ - token 不会写入日志，也不会通过浏览器 RPC 返回。RPC 只返回脱敏账户、状态、模型与无敏感信息的错误摘要。设备码（device code）只留在 Host 进程里。
7
+ - 订阅 token 只发送到固定 HTTPS 主机 `cli-chat-proxy.grok.com`。登录和续期只访问 `https://auth.x.ai`（以及它返回的 `https://*.x.ai` 授权链接）。
7
8
  - 请勿在公开 issue、截图或诊断中粘贴 `auth.json`、token 或登录回调 URL。
8
9
 
9
10
  This community plugin runs with DSH host privileges. Review the source before installation and use only your own account.
package/docs/guide.en.md CHANGED
@@ -6,9 +6,9 @@ For quick setup, see the [README](../README.en.md#install). This guide covers de
6
6
 
7
7
  ## Installation and compatibility
8
8
 
9
- You need the DeepSeek Harness desktop app, the official Grok Build CLI, and an account with Grok Build access. The plugin declares Node.js `^22.19.0 || >=24.0.0`; DSH peers use `>=0.1.5-rc.2 <0.3.0-0`, which spans the whole 0.1 and 0.2 lines. See [package.json](../package.json) for the full requirements. Declared compatibility is not a claim that every version has passed live verification.
9
+ You need the DeepSeek Harness desktop app and an account with Grok Build access. The grok command is not required. The plugin declares Node.js `^22.19.0 || >=24.0.0`; DSH peers use `>=0.1.5-rc.2 <0.3.0-0`, which spans the whole 0.1 and 0.2 lines. See [package.json](../package.json) for the full requirements. Declared compatibility is not a claim that every version has passed live verification.
10
10
 
11
- **Install:** in the desktop app open **Settings → Plugins**, type the package name `dsh-grok-subscription` into the install field, and install it. Then **quit and restart the desktop app completely**; refreshing the page alone does not reload the Host adapter. To pin a version, put the full `package@version` in that field, for example `dsh-grok-subscription@2.0.3`.
11
+ **Install:** in the desktop app open **Settings → Plugins**, type the package name `dsh-grok-subscription` into the install field, and install it. Then **quit and restart the desktop app completely**; refreshing the page alone does not reload the Host adapter. To pin a version, put the full `package@version` in that field, for example `dsh-grok-subscription@2.0.5`.
12
12
 
13
13
  **The plugin depends on the host's own pi-ai adapter.** From 2.0.0 the `grok-build` route is served entirely by the host's `@deepseek-ai/dsh-llm-pi-ai` / `@earendil-works/pi-ai`, which every DSH installation carries (`@deepseek-ai/dsh` → `dsh-base` → `dsh-llm-pi-ai`, with the `llm-pi-ai` row mounted unconditionally). If those packages cannot be resolved from the DSH installation, the plugin registers no route at all and **Active path** in Settings reads **unavailable**.
14
14
 
@@ -16,30 +16,22 @@ If the UI install fails (an unusual profile directory, say), the equivalent runs
16
16
 
17
17
  ```sh
18
18
  cd "$HOME/.dsh/profiles/desktop" # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
19
- pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
19
+ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.5
20
20
  ```
21
21
 
22
22
  `dsh plugin --profile desktop …` is refused: the Electron application owns that profile exclusively.
23
23
 
24
24
  ## Sign-in and credentials
25
25
 
26
- **The official Grok Build CLI must be available on the DSH Host**, not just on the phone or another computer viewing the Web UI. The plugin checks `DSH_GROK_BIN`, then `${GROK_HOME:-$HOME/.grok}/bin/grok`, then `grok` on `PATH`. On Windows the `PATHEXT` suffixes (`.exe`, `.cmd`, …) are completed too, so a `grok.exe` install is recognised. See [session.js](../src/session.js).
26
+ Sign-in happens on the DSH Host, not on another device that is only viewing the page. **Sign in** in Settings requests a device code from `https://auth.x.ai`, shows the link and one-time code, and tries to open a browser. After authorization the plugin writes the session to `${GROK_HOME:-$HOME/.grok}/auth.json`. If that file is already present, select **Read saved session**. An `XAI_API_KEY`-only entry is not a Grok Build subscription session. Never copy `auth.json`, access tokens, or refresh tokens into chats or public reports.
27
27
 
28
- Use **CLI login** or **Device-code login** in Settings. The plugin invokes the official CLI and shows the available authorization link and one-time code in the panel. Alternatively, run this locally:
29
-
30
- ```sh
31
- grok login
32
- ```
33
-
34
- After authorizing, select **Pull from Grok CLI**. An `XAI_API_KEY`-only configuration is not a Grok Build subscription session. Never copy `auth.json`, access tokens, or refresh tokens into chats or public reports.
35
-
36
- The plugin reads `${GROK_HOME:-$HOME/.grok}/auth.json` and rejects symlinks, non-regular files, and unsafe ownership or permissions. On macOS / Linux, after confirming the path and owner are correct, fix permission bits with:
28
+ Reads and writes reject symlinks, non-regular files, and unsafe ownership or permissions. On macOS / Linux, after confirming the path and owner are correct, fix permission bits with:
37
29
 
38
30
  ```sh
39
31
  chmod 600 "${GROK_HOME:-$HOME/.grok}/auth.json"
40
32
  ```
41
33
 
42
- This does not fix an incorrect owner or make a symlink safe. The plugin itself does not write the file; the official CLI manages the session file and renewal. DSH stores only the short-lived access token it needs, without returning tokens through browser RPC. See [SECURITY.md](../SECURITY.md).
34
+ This does not fix an incorrect owner or make a symlink safe. The plugin updates only the OAuth entry and keeps the file mode `0600`; other entries, including an API key, are left in place. DSH stores only the short-lived access token it needs. The refresh token stays in this file and is not returned through browser RPC. See [SECURITY.md](../SECURITY.md).
43
35
 
44
36
  ## Model catalog and reasoning
45
37
 
@@ -47,7 +39,7 @@ After sign-in, the plugin prefers the catalog from `/v1/models-v2`; while signed
47
39
 
48
40
  Reasoning options follow model metadata. The implementation recognizes `low` / `medium` / `high` / `xhigh`, usually defaulting to `high`; the built-in `grok-4.5` entry has only the first three. Follow the actual menu and backend-supported choices. See [catalog.js](../src/catalog.js).
49
41
 
50
- Login, pull, logout, and catalog refresh notify the model picker. Near a known token expiry the plugin renews through the official CLI. If renewal fails, or the server has already revoked the session, authorization may still be required again; uninterrupted sessions are not guaranteed.
42
+ Login, reading a saved session, logout, and catalog refresh notify the model picker. Near a known token expiry the plugin renews with the refresh token in auth.json against `https://auth.x.ai`. If renewal fails, or the server has already revoked the session, authorization may still be required again; uninterrupted sessions are not guaranteed.
51
43
 
52
44
  ## Image input
53
45
 
@@ -75,13 +67,15 @@ For prefix caching, the plugin pins one stable `prompt_cache_key` per DSH sessio
75
67
 
76
68
  ## Troubleshooting
77
69
 
78
- **`grok` not found or no login window.** Check that the CLI is installed on the DSH Host and its process sees `DSH_GROK_BIN` / `PATH`. Look for a clickable login link in the panel. A browser failing to open does not by itself prove the authorization service is unreachable. On Windows, if the CLI is not on `PATH`, put the absolute `grok.exe` path in the user-level `DSH_GROK_BIN` (for example `setx DSH_GROK_BIN "C:\Users\<user>\.grok\bin\grok.exe"`) and restart DSH completely; note that `DSH_*` is a DSH bootstrap prefix, so declaring it in `~/.dsh/.env` makes that environment layer fail.
70
+ **No sign-in window.** Look for a clickable authorization link and code in the panel. A browser failing to open does not by itself prove `auth.x.ai` is unreachable; use “Open the sign-in page”. When a proxy is needed, set `https_proxy` in DSH's launch environment or `~/.dsh/.env`, then restart completely. `DSH_*` is a DSH bootstrap prefix, so declaring it in `~/.dsh/.env` makes that environment layer fail.
79
71
 
80
72
  **`fetch failed` or `Billing request timed out`.** Check access to the account service and `cli-chat-proxy.grok.com` separately. When a proxy is needed, set standard `https_proxy` / `http_proxy` variables in DSH's launch environment or `~/.dsh/.env`, not the project directory's `.env`, then manually restart DSH. The plugin uses the host network setup rather than providing its own proxy service. Network conditions are one possibility; also check authentication and backend errors.
81
73
 
82
- **Empty model list.** Complete subscription sign-in and select **Pull from Grok CLI**. Check for an API-key-only login entry and inspect catalog status without sharing raw responses.
74
+ **Empty model list.** Finish subscription sign-in, or select **Read saved session**. Check for an API-key-only entry and inspect catalog status without sharing raw responses.
75
+
76
+ **Chat or usage returns `401`.** If automatic renewal fails, sign in again from Settings. Do not repeatedly paste an old token.
83
77
 
84
- **Chat or usage returns `401`.** Check the CLI session. If automatic renewal fails, run `grok login` again, authorize, and pull the session. Do not repeatedly paste an old token.
78
+ **Chat returns HTTP 426 saying the Grok CLI is outdated.** Generation (`POST /v1/responses`) requires `x-grok-client-version` of at least `1.0.13`. The model catalog and billing endpoints are not checked, so Settings, the model list and the quota card can look fine while every message fails. `2.0.4` and earlier advertised `1.0.5` when the grok command was absent and `~/.grok/version.json` could not be read. Current releases advertise the built-in fallback — a release above that published minimum; a prerelease such as `1.0.13-rc1` does not count — unless an installed CLI `version.json` is itself a release at least that high. A stale `version.json` no longer pulls the header back down. To pin it yourself, set `DSH_GROK_CLIENT_VERSION` in the **environment that launches DSH** (a `MAJOR.MINOR.PATCH` release, at least `1.0.13`) and restart completely. Do not put it in `~/.dsh/.env`: names with the `DSH_` prefix are refused by the bootstrap layer.
85
79
 
86
80
  **Images rejected.** Check the supported IDs, confirm **Active path** reads **official pi-ai** with attachment capability available, and fully restart the desktop app after updating.
87
81
 
@@ -101,14 +95,14 @@ In the desktop app the `desktop` profile is owned exclusively by the Electron ap
101
95
 
102
96
  ```sh
103
97
  cd "$HOME/.dsh/profiles/desktop" # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
104
- pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
98
+ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.5
105
99
  ```
106
100
 
107
101
  Then quit and restart the desktop app completely. After a successful update the profile's `package.json` dependency should show the target version while its `dsh.profile.bundles` entry is unchanged. Refreshing the browser is not enough: without a Host restart the old version keeps loading.
108
102
 
109
- **Uninstall:** remove `dsh-grok-subscription` in **Settings → Plugins**, or run `pnpm remove dsh-grok-subscription` in that profile directory. This leaves the profile, other plugins, and the CLI's `auth.json` intact.
103
+ **Uninstall:** remove `dsh-grok-subscription` in **Settings → Plugins**, or run `pnpm remove dsh-grok-subscription` in that profile directory. This leaves the profile, other plugins, and `~/.grok/auth.json` intact.
110
104
 
111
- The Settings logout action clears plugin-side session state; it does not revoke the official CLI session. If the CLI file remains, a later pull or startup may sync it again. To end the official session, use the official CLI / account's sign-out and authorization-management flow. Do not delete an entire DSH profile to handle one account.
105
+ The Settings logout action clears plugin-side session state. It does not delete `auth.json` and does not revoke the xAI authorization. If the file remains, a later read or Settings open may sync the session again. Do not delete an entire DSH profile to handle one account.
112
106
 
113
107
  ## Local development
114
108
 
package/docs/guide.zh-CN.md CHANGED
@@ -6,9 +6,9 @@
6
6
 
7
7
  ## 安装与兼容性
8
8
 
9
- 需要 DeepSeek Harness 桌面版、官方 Grok Build CLI，以及当前具有 Grok Build 使用资格的订阅账号。插件的 Node.js 要求为 `^22.19.0 || >=24.0.0`，DSH peer 声明以 [package.json](../package.json) 为准；其中 DSH 依赖使用 `>=0.1.5-rc.2 <0.3.0-0`，覆盖 0.1 与 0.2 全线。声明范围不等于所有版本都已经过实机验证。
9
+ 需要 DeepSeek Harness 桌面版，以及当前具有 Grok Build 使用资格的订阅账号。不需要安装 grok 命令。插件的 Node.js 要求为 `^22.19.0 || >=24.0.0`，DSH peer 声明以 [package.json](../package.json) 为准；其中 DSH 依赖使用 `>=0.1.5-rc.2 <0.3.0-0`，覆盖 0.1 与 0.2 全线。声明范围不等于所有版本都已经过实机验证。
10
10
 
11
- **安装：** 在桌面版打开 **设置 → 插件**，在安装输入框里填入包名 `dsh-grok-subscription` 并安装，然后**完全退出并重启桌面应用**。仅刷新页面不会重新加载 Host 中的适配器。需要可重复安装时，填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.3`。
11
+ **安装：** 在桌面版打开 **设置 → 插件**，在安装输入框里填入包名 `dsh-grok-subscription` 并安装，然后**完全退出并重启桌面应用**。仅刷新页面不会重新加载 Host 中的适配器。需要可重复安装时，填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.5`。
12
12
 
13
13
  **插件依赖宿主自带的 pi-ai 适配器。** 从 2.0.0 起，`grok-build` 路由完全由宿主的 `@deepseek-ai/dsh-llm-pi-ai` / `@earendil-works/pi-ai` 服务；DSH 的任何安装方式都带有它们（`@deepseek-ai/dsh` → `dsh-base` → `dsh-llm-pi-ai`，且 `llm-pi-ai` 行无条件挂载）。这两个包无法从 DSH 安装目录解析时，插件不会注册任何路由，设置页的「运行通路」显示**不可用**。
14
14
 
@@ -16,30 +16,22 @@
16
16
 
17
17
  ```sh
18
18
  cd "$HOME/.dsh/profiles/desktop" # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
19
- pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
19
+ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.5
20
20
  ```
21
21
 
22
22
  `dsh plugin --profile desktop …` 会被直接拒绝：桌面版 profile 由 Electron 应用独占。
23
23
 
24
24
  ## 登录与凭据
25
25
 
26
- **官方 Grok Build CLI 必须在 DSH Host 上可用**，不是只安装在访问网页的手机或另一台电脑上。插件按以下顺序寻找命令：`DSH_GROK_BIN` 指定的路径、`${GROK_HOME:-$HOME/.grok}/bin/grok`、系统 `PATH` 中的 `grok`。Windows 上按 `PATHEXT` 补全后缀（`.exe`、`.cmd` 等），所以安装成 `grok.exe` 也能识别。实现见 [session.js](../src/session.js)。
26
+ 登录在 DSH Host 本机完成，不是在看网页的另一台设备上。设置页的 **登录** 向 `https://auth.x.ai` 申请设备码，把链接和一次性验证码显示在面板里，并尝试打开浏览器。授权完成后，插件把会话写入 `${GROK_HOME:-$HOME/.grok}/auth.json`。已经有这份文件时，点 **读取已保存的会话**。只有 `XAI_API_KEY` 的条目不属于 Grok Build 订阅登录。不要复制 `auth.json`、access token 或 refresh token 到聊天和公开问题中。
27
27
 
28
- 可在设置页发起 **CLI 登录** 或 **设备码登录**；插件会调用官方 CLI，并将可用的授权链接和一次性验证码显示在面板中。也可以自行在本机运行：
29
-
30
- ```sh
31
- grok login
32
- ```
33
-
34
- 授权完成后点击 **从 Grok CLI 拉取**。只有 `XAI_API_KEY` 的配置不属于 Grok Build 订阅登录。不要复制 `auth.json`、access token 或 refresh token 到聊天和公开问题中。
35
-
36
- 插件读取 `${GROK_HOME:-$HOME/.grok}/auth.json`，拒绝符号链接、非普通文件及不安全的所有权或权限。在 macOS / Linux 上，确认路径和所有者正确后，可修正权限：
28
+ 插件读写这个文件时拒绝符号链接、非普通文件及不安全的所有权或权限。在 macOS / Linux 上，确认路径和所有者正确后，可修正权限：
37
29
 
38
30
  ```sh
39
31
  chmod 600 "${GROK_HOME:-$HOME/.grok}/auth.json"
40
32
  ```
41
33
 
42
- 此命令不能修正错误所有者，也不能把符号链接变成安全文件。插件自身不写回这个文件；官方 CLI 会管理会话文件和续期。DSH 只保存使用所需的短期 access token，不把 token 通过浏览器 RPC 返回。详见 [SECURITY.md](../SECURITY.md)。
34
+ 此命令不能修正错误所有者，也不能把符号链接变成安全文件。插件只更新其中的 OAuth 条目，并保持文件为 `0600`；其他条目（包括 API key）会保留。DSH 只保存使用所需的短期 access token，refresh token 留在这个文件里，不通过浏览器 RPC 返回。详见 [SECURITY.md](../SECURITY.md)。
43
35
 
44
36
  ## 模型目录与推理档位
45
37
 
@@ -47,7 +39,7 @@ chmod 600 "${GROK_HOME:-$HOME/.grok}/auth.json"
47
39
 
48
40
  推理档位按模型元数据提供。当前实现识别 `low` / `medium` / `high` / `xhigh`，通常默认 `high`；内置 `grok-4.5` 目录只包含前三档。以实际菜单与服务端接受的选项为准。实现见 [catalog.js](../src/catalog.js)。
49
41
 
50
- 登录、拉取、登出和目录刷新会通知模型选择器更新。临近已知的 token 到期时间时，插件会通过官方 CLI 续期；若续期失败或服务端已撤销会话，仍需要重新授权，不承诺会话永不失效。
42
+ 登录、读取会话、登出和目录刷新会通知模型选择器更新。临近已知的 token 到期时间时，插件用 auth.json 里的 refresh token 向 `https://auth.x.ai` 续期；若续期失败或服务端已撤销会话，仍需要重新授权，不承诺会话永不失效。
51
43
 
52
44
  ## 图片输入
53
45
 
@@ -75,13 +67,15 @@ grok-4.6
75
67
 
76
68
  ## 故障排查
77
69
 
78
- **找不到 `grok` / 不弹出登录窗口。** 检查 CLI 是否安装在 DSH Host、`DSH_GROK_BIN` / `PATH` 是否对该进程可见，以及面板是否已显示可点击授权链接。浏览器没有弹出，不一定等于授权服务不可达。Windows 上若 CLI 不在 `PATH` 中，可把 `grok.exe` 的绝对路径写入用户级 `DSH_GROK_BIN`（例如 `setx DSH_GROK_BIN "C:\Users\<用户>\.grok\bin\grok.exe"`），再完全重启 DSH；注意 `DSH_*` 是 DSH 的 bootstrap 前缀，写进 `~/.dsh/.env` 会让该环境层直接报错。
70
+ **没有弹出登录窗口。** 看面板是否已经显示可点击的授权链接和验证码。浏览器没有弹出，不一定等于 `auth.x.ai` 不可达；点「打开登录页面」。需要代理时，在 DSH 启动环境或 `~/.dsh/.env` 设置 `https_proxy` 后完全重启。注意 `DSH_*` 是 DSH 的 bootstrap 前缀，写进 `~/.dsh/.env` 会让该环境层直接报错。
79
71
 
80
72
  **`fetch failed` / `Billing request timed out`。** 分别检查账号服务和 `cli-chat-proxy.grok.com` 的网络连接。需要代理时，在 DSH 启动环境或 `~/.dsh/.env` 中设置标准 `https_proxy` / `http_proxy`，而不是放进项目目录的 `.env`；再手动重启 DSH。插件沿用宿主网络配置，不提供单独代理服务。网络只是可能原因，还应检查认证和服务端错误。
81
73
 
82
- **模型列表为空。** 先完成订阅登录并点击「从 Grok CLI 拉取」。检查是否只有 API-key 登录条目；查看目录状态，不要公开原始响应。
74
+ **模型列表为空。** 先完成订阅登录，或点击「读取已保存的会话」。检查是否只有 API-key 条目；查看目录状态，不要公开原始响应。
75
+
76
+ **聊天或用量返回 `401`。** 自动续期失败时，在设置页重新登录。不要反复粘贴旧 token。
83
77
 
84
- **聊天或用量返回 `401`。** 检查 CLI 会话是否有效。自动续期失败时，重新运行 `grok login`，完成授权后再次拉取。不要反复粘贴旧 token。
78
+ **对话返回 HTTP 426，提示 Grok CLI 版本过旧。** 生成接口（`POST /v1/responses`）要求 `x-grok-client-version` 不低于 `1.0.13`。模型目录和额度接口不检查这项，所以设置页、模型列表和用量卡片可以一切正常，只有发消息失败。`2.0.4` 及更早在没有 grok 命令、也读不到 `~/.grok/version.json` 时会声明 `1.0.5`。当前版本在没有不低于内置回退值的 CLI 正式版本时，改发该回退值（高于已公布的下限；`1.0.13-rc1` 这类预发布号不算）。过旧的 `version.json` 不会再把请求头拉低。仍要自己指定时，在**启动 DSH 的进程环境**里设置 `DSH_GROK_CLIENT_VERSION`（`MAJOR.MINOR.PATCH` 正式版本，且不低于 `1.0.13`），然后完全重启。不要写进 `~/.dsh/.env`：`DSH_*` 会被启动层拒绝。
85
79
 
86
80
  **图片被拒绝。** 对照图片支持列表，确认设置页「运行通路」显示**官方 pi-ai** 且附件能力可用，并在更新后完整重启桌面应用。
87
81
 
@@ -101,14 +95,14 @@ grok-4.6
101
95
 
102
96
  ```sh
103
97
  cd "$HOME/.dsh/profiles/desktop" # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
104
- pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.3
98
+ pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.5
105
99
  ```
106
100
 
107
101
  然后完全退出并重启桌面版。更新成功后该 profile 的 `package.json` 里依赖应变为目标版本，`dsh.profile.bundles` 条目保持不变。仅刷新网页不够：Host 未重启时仍会加载旧版本。
108
102
 
109
- **卸载：** 在 **设置 → 插件** 里移除 `dsh-grok-subscription`，或在该 profile 目录执行 `pnpm remove dsh-grok-subscription`。这不删除整个 profile、其他插件或 Grok CLI 的 `auth.json`。
103
+ **卸载：** 在 **设置 → 插件** 里移除 `dsh-grok-subscription`，或在该 profile 目录执行 `pnpm remove dsh-grok-subscription`。这不删除整个 profile、其他插件或 `~/.grok/auth.json`。
110
104
 
111
- 设置页「登出」清理的是插件侧会话状态，不等于撤销官方 CLI 会话。CLI 文件仍然存在时，之后重新拉取或启动可能再次同步登录；彻底结束官方会话应使用官方 CLI / 账号提供的登出与授权管理流程。不要靠删除整个 DSH profile 来处理一个账号。
105
+ 设置页「登出」清理的是插件侧会话状态，不会删除 `auth.json`，也不等于在 xAI 撤销授权。文件还在时，之后读取会话或重新打开设置可能再次同步登录。不要靠删除整个 DSH profile 来处理一个账号。
112
106
 
113
107
  ## 本地开发
114
108
 
package/lib/client.js CHANGED
@@ -39,7 +39,7 @@ var import_react2 = require("react");
39
39
  var zh = {
40
40
  nav: "Grok \u8BA2\u9605",
41
41
  title: "Grok \u8BA2\u9605",
42
- subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 2.0.3",
42
+ subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 2.0.5",
43
43
  signedIn: "\u5DF2\u767B\u5F55",
44
44
  signedOut: "\u672A\u767B\u5F55",
45
45
  account: "\u8D26\u6237",
@@ -50,17 +50,16 @@ var zh = {
50
50
  catalogSourceFallback: "\u6765\u6E90\uFF1A\u9759\u6001\u56DE\u9000\u76EE\u5F55\uFF08\u542B grok-4.7\uFF09",
51
51
  catalogSourceSignedOut: "\u767B\u5F55\u540E\u624D\u4F1A\u5217\u51FA\u6A21\u578B\u3002",
52
52
  catalogError: "\u76EE\u5F55\u9519\u8BEF",
53
- loginCli: "CLI \u767B\u5F55",
54
- loginDevice: "\u8BBE\u5907\u7801\u767B\u5F55",
55
- pull: "\u4ECE Grok CLI \u62C9\u53D6",
53
+ loginCli: "\u767B\u5F55",
54
+ pull: "\u8BFB\u53D6\u5DF2\u4FDD\u5B58\u7684\u4F1A\u8BDD",
56
55
  logout: "\u9000\u51FA\u767B\u5F55",
57
- loginHint: "\u70B9\u51FB\u540E\u5728\u672C\u673A\u8FD0\u884C grok login\uFF0C\u5E76\u628A CLI \u6253\u5370\u7684\u767B\u5F55\u94FE\u63A5\u4EA4\u7ED9\u6D4F\u89C8\u5668\uFF1B\u6388\u6743\u5B8C\u6210\u540E\u8FD9\u91CC\u4F1A\u81EA\u52A8\u540C\u6B65\u3002",
58
- deviceHint: "\u8BBE\u5907\u7801\u767B\u5F55\u4F1A\u8BA9 CLI \u6253\u5370\u4E00\u6B21\u6027\u9A8C\u8BC1\u7801\u548C\u94FE\u63A5\u3002\u82E5\u6D4F\u89C8\u5668\u6CA1\u6709\u81EA\u52A8\u6253\u5F00\uFF0C\u70B9\u63D0\u793A\u91CC\u7684\u201C\u6253\u5F00\u767B\u5F55\u9875\u9762\u201D\u5E76\u786E\u8BA4\u9A8C\u8BC1\u7801\u3002",
56
+ loginHint: "\u5728\u672C\u673A\u5411 auth.x.ai \u7533\u8BF7\u8BBE\u5907\u7801\uFF0C\u628A\u767B\u5F55\u94FE\u63A5\u4EA4\u7ED9\u6D4F\u89C8\u5668\u3002\u6388\u6743\u5B8C\u6210\u540E\u8FD9\u91CC\u4F1A\u81EA\u52A8\u540C\u6B65\uFF0C\u4E0D\u9700\u8981\u5B89\u88C5 grok \u547D\u4EE4\u3002",
57
+ deviceHint: "\u9762\u677F\u4F1A\u663E\u793A\u4E00\u6B21\u6027\u9A8C\u8BC1\u7801\u3002\u82E5\u6D4F\u89C8\u5668\u6CA1\u6709\u81EA\u52A8\u6253\u5F00\uFF0C\u70B9\u63D0\u793A\u91CC\u7684\u201C\u6253\u5F00\u767B\u5F55\u9875\u9762\u201D\uFF0C\u5E76\u5728\u9875\u9762\u4E0A\u786E\u8BA4\u540C\u4E00\u4E2A\u9A8C\u8BC1\u7801\u3002",
59
58
  loginWaiting: "\u7B49\u5F85\u6D4F\u89C8\u5668\u6388\u6743\u2026",
60
59
  loginOpenBrowser: "\u6253\u5F00\u767B\u5F55\u9875\u9762",
61
- loginNoUrl: "\u6CA1\u62FF\u5230\u767B\u5F55\u94FE\u63A5\uFF1A\u8BF7\u786E\u8BA4 grok CLI \u80FD\u8BBF\u95EE x.ai\u3002\u684C\u9762\u7248\u9700\u8981\u4EE3\u7406\u65F6\uFF0C\u5728 ~/.dsh/.env \u8BBE\u7F6E https_proxy \u540E\u91CD\u542F\u3002",
60
+ loginNoUrl: "\u6CA1\u62FF\u5230\u767B\u5F55\u94FE\u63A5\uFF1A\u8BF7\u786E\u8BA4\u672C\u673A\u80FD\u8BBF\u95EE auth.x.ai\u3002\u684C\u9762\u7248\u9700\u8981\u4EE3\u7406\u65F6\uFF0C\u5728 ~/.dsh/.env \u8BBE\u7F6E https_proxy \u540E\u91CD\u542F\u3002",
62
61
  loginTimeout: "\u7B49\u5F85\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u70B9\u51FB\u767B\u5F55\u3002",
63
- pullHint: "\u5B89\u5168\u8BFB\u53D6 ~/.grok/auth.json\uFF08\u62D2\u7EDD\u7B26\u53F7\u94FE\u63A5\u4E0E\u7EC4/\u5176\u4ED6\u4EBA\u53EF\u8BFB\uFF09\uFF0C\u53EA\u628A\u77ED\u671F access token \u5199\u5165 DSH\u3002",
62
+ pullHint: "\u5B89\u5168\u8BFB\u53D6 ~/.grok/auth.json\uFF08\u62D2\u7EDD\u7B26\u53F7\u94FE\u63A5\u4E0E\u7EC4/\u5176\u4ED6\u4EBA\u53EF\u8BFB\uFF09\u3002\u63D2\u4EF6\u767B\u5F55\u548C\u7EED\u671F\u4E5F\u4F1A\u5199\u56DE\u8FD9\u4E2A\u6587\u4EF6\uFF1B\u53EA\u628A\u77ED\u671F access token \u5199\u5165 DSH\u3002",
64
63
  loginHelp: "\u767B\u5F55\u65B9\u5F0F\u8BF4\u660E",
65
64
  refreshCatalog: "\u5237\u65B0\u6A21\u578B\u76EE\u5F55",
66
65
  renderError: "\u754C\u9762\u6E32\u67D3\u5931\u8D25",
@@ -76,10 +75,9 @@ var zh = {
76
75
  busyCatalog: "\u6B63\u5728\u5237\u65B0\u6A21\u578B\u76EE\u5F55\u2026",
77
76
  busyUsage: "\u6B63\u5728\u5237\u65B0\u7528\u91CF\u2026",
78
77
  error: "\u64CD\u4F5C\u5931\u8D25",
79
- pullOk: "\u5DF2\u4ECE Grok CLI \u62C9\u53D6\u6210\u529F",
78
+ pullOk: "\u5DF2\u8BFB\u53D6\u4FDD\u5B58\u7684\u4F1A\u8BDD",
80
79
  loginOk: "\u767B\u5F55\u5B8C\u6210\uFF0C\u4F1A\u8BDD\u5DF2\u540C\u6B65",
81
80
  logoutOk: "\u5DF2\u9000\u51FA\u767B\u5F55",
82
- cliMissing: "\u672A\u53D1\u73B0 grok CLI\u3002\u8BF7\u5148\u5B89\u88C5\u5B98\u65B9 CLI \u5E76\u8FD0\u884C grok login\uFF0C\u7136\u540E\u62C9\u53D6\u3002",
83
81
  caveats: "\u793E\u533A\u63D2\u4EF6\uFF0C\u4E0D\u662F\u5B98\u65B9\u4EA7\u54C1\u3002\u8BA2\u9605\u7528\u4E8E\u975E\u5B98\u65B9\u5BA2\u6237\u7AEF\u53EF\u80FD\u5904\u4E8E\u4F9B\u5E94\u5546\u6761\u6B3E\u7070\u8272\u5730\u5E26\uFF1B\u53EA\u4F7F\u7528\u4F60\u81EA\u5DF1\u7684\u8D26\u53F7\u3002\u534F\u8BAE\u53EF\u80FD\u53D8\u5316\uFF0C\u56E0\u4E3A\u5B98\u65B9\u6587\u6863\u672A\u516C\u5F00\u5B8C\u6574 HTTP wire protocol\u3002",
84
82
  usageTitle: "\u7528\u91CF\uFF08\u5B9E\u9A8C\u6027\uFF09",
85
83
  usageSubtitle: "\u6765\u81EA\u672A\u6587\u6863\u5316\u7684\u8BA2\u9605 billing API\uFF08/v1/billing?format=credits\uFF09\uFF0C\u4EC5\u4F9B\u53C2\u8003\uFF0C\u53EF\u80FD\u968F\u65F6\u5931\u6548\u3002",
@@ -124,7 +122,7 @@ var zh = {
124
122
  var en = {
125
123
  nav: "Grok Subscription",
126
124
  title: "Grok Subscription",
127
- subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 2.0.3",
125
+ subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 2.0.5",
128
126
  signedIn: "Signed in",
129
127
  signedOut: "Signed out",
130
128
  account: "Account",
@@ -135,17 +133,16 @@ var en = {
135
133
  catalogSourceFallback: "Source: static fallback catalog (includes grok-4.7)",
136
134
  catalogSourceSignedOut: "Models appear after sign-in.",
137
135
  catalogError: "Catalog error",
138
- loginCli: "CLI login",
139
- loginDevice: "Device-code login",
140
- pull: "Pull from Grok CLI",
136
+ loginCli: "Sign in",
137
+ pull: "Read saved session",
141
138
  logout: "Log out",
142
- loginHint: "Runs grok login on this machine and hands the link the CLI prints to your browser; the panel syncs itself once you authorize.",
143
- deviceHint: "Device-code login makes the CLI print a one-time code and link. If no browser opened, use \u201COpen the sign-in page\u201D in the status line and confirm the code.",
139
+ loginHint: "Requests a device code from auth.x.ai on this machine and hands the link to your browser. The panel syncs itself once you authorize. The grok command is not required.",
140
+ deviceHint: "The panel shows a one-time code. If no browser opened, use \u201COpen the sign-in page\u201D in the status line and confirm that same code.",
144
141
  loginWaiting: "Waiting for browser authorization\u2026",
145
142
  loginOpenBrowser: "Open the sign-in page",
146
- loginNoUrl: "No sign-in link was returned: make sure the grok CLI can reach x.ai. If the desktop app needs a proxy, set https_proxy in ~/.dsh/.env and restart.",
143
+ loginNoUrl: "No sign-in link was returned: make sure this machine can reach auth.x.ai. If the desktop app needs a proxy, set https_proxy in ~/.dsh/.env and restart.",
147
144
  loginTimeout: "Timed out waiting for authorization; click sign-in again.",
148
- pullHint: "Reads ~/.grok/auth.json securely (refuses symlinks and group/other-readable files) and stores only the short-lived access token in DSH.",
145
+ pullHint: "Reads ~/.grok/auth.json securely (refuses symlinks and group/other-readable files). Sign-in and renewal write this file too, and only the short-lived access token is stored in DSH.",
149
146
  loginHelp: "How signing in works",
150
147
  refreshCatalog: "Refresh model catalog",
151
148
  renderError: "Failed to render this panel",
@@ -161,10 +158,9 @@ var en = {
161
158
  busyCatalog: "Refreshing model catalog\u2026",
162
159
  busyUsage: "Refreshing usage\u2026",
163
160
  error: "Request failed",
164
- pullOk: "Pulled from Grok CLI successfully",
161
+ pullOk: "Saved session loaded",
165
162
  loginOk: "Signed in and session synced",
166
163
  logoutOk: "Signed out",
167
- cliMissing: "The grok CLI was not found. Install it, run grok login, then pull.",
168
164
  caveats: "Community plugin, not an official product. Using a subscription from an unofficial client may be a vendor-ToS gray area; use your own account only. The protocol can change because official docs do not publish the full HTTP wire protocol.",
169
165
  usageTitle: "Usage (experimental)",
170
166
  usageSubtitle: "From the undocumented subscription billing API (/v1/billing?format=credits). Informational only; the endpoint may change or disappear.",
@@ -1036,7 +1032,6 @@ function GrokSubscriptionSection({ rpc, t }) {
1036
1032
  ] }),
1037
1033
  /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "gsActions", children: [
1038
1034
  /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn gsBtn--primary", type: "button", disabled: Boolean(busy) || Boolean(loginPending), onClick: () => void run("login/cli"), children: t("loginCli") }),
1039
- /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn", type: "button", disabled: Boolean(busy) || Boolean(loginPending), onClick: () => void run("login/device"), children: t("loginDevice") }),
1040
1035
  /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn", type: "button", disabled: Boolean(busy), onClick: () => void run("pull"), children: t("pull") }),
1041
1036
  /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { className: "gsBtn gsBtn--danger", type: "button", disabled: Boolean(busy) || !signedIn, onClick: () => void run("logout"), children: t("logout") })
1042
1037
  ] }),
@@ -1059,7 +1054,6 @@ function GrokSubscriptionSection({ rpc, t }) {
1059
1054
  ": ",
1060
1055
  error
1061
1056
  ] }) : null,
1062
- status?.cliAvailable === false ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--warn", children: t("cliMissing") }) : null,
1063
1057
  /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(DiagnosticsRows, { diagnostics: status?.diagnostics, t }),
1064
1058
  status?.diagnostics && !status.diagnostics.imageInput ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsHint", children: t("adapterHint") }) : null,
1065
1059
  /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("details", { className: "gsDisclosure", children: [