dsh-grok-subscription 2.0.7 → 2.0.8

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.0.8 — 2026-10-12
+
+- Fix **sign-in reporting only `Grok subscription RPC "login/cli" timed out after 20000ms`** when DSH cannot reach `auth.x.ai`. Starting sign-in makes two requests in a row, OIDC discovery and then the device-code request, and each had its own 20s timeout under a 20s RPC ceiling. On a network that silently drops the connection, undici gave up on each TCP connect after about 10s; discovery then fell back to the same host, and the RPC ceiling won the race at 20s, so the real cause never reached the panel. Fixes #2.
+- Both requests now share one 15s deadline, which ends before the RPC ceiling even with the status read that follows. A request that gets no HTTP answer is reported as `Cannot reach auth.x.ai (…)`, naming the kind of failure (connection timed out, connection refused, DNS lookup failed, TLS certificate rejected, timed out) without echoing an address or proxy URL. Discovery no longer falls back to the same unreachable host; a bad or mismatched discovery document still falls back to the documented endpoints.
+- When sign-in cannot reach `auth.x.ai`, Settings explains the usual cause under the error: DSH does not read the macOS or Windows system proxy setting, so a browser that opens x.ai does not mean DSH can. Set `https_proxy=http://127.0.0.1:<port>` (an HTTP or mixed port; `socks5://` is not supported) in `~/.dsh/.env` — `%USERPROFILE%\.dsh\.env` on Windows — and restart DSH completely, or use the proxy app's TUN mode. Both guides have a matching troubleshooting row. The unused "no sign-in link" warning path left over from the CLI-based sign-in is removed.
+- No model-routing, image-input, quota, or dependency changes. Update the plugin and fully restart DSH.
+
 ## 2.0.7 — 2026-10-09
 
 - Give the installed plugin card a localized display name: **Grok Subscription** in English and **Grok 订阅** in Simplified Chinese. Export and ship package-level `locale/en.json` and `locale/zh-CN.json` with `meta.title` and `meta.description`, the same metadata contract used by DSH. The npm package name remains `dsh-grok-subscription`.

package/README.en.md

@@ -61,13 +61,13 @@ Pick a Grok model your account can use, adjust reasoning effort as needed, and s
 <details>
 <summary>Check the version / pin one / fall back when the UI install fails</summary>
 
-**Settings → Plugins** lists the installed plugins and their versions, and the plugin's own **Settings → Grok Subscription** page shows a version card. To pin a version, put the full `package@version` in the install field, for example `dsh-grok-subscription@2.0.7`.
+**Settings → Plugins** lists the installed plugins and their versions, and the plugin's own **Settings → Grok Subscription** page shows a version card. To pin a version, put the full `package@version` in the install field, for example `dsh-grok-subscription@2.0.8`.
 
 If the UI install fails (an unusual profile directory, say), the equivalent runs against the desktop profile itself (pnpm ≥ 11):
 
 ```sh
 cd "$HOME/.dsh/profiles/desktop"    # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
-pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.7
+pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.8
 ```
 
 `dsh plugin --profile desktop …` is refused: the Electron application owns that profile exclusively. Sign-in and troubleshooting are in the [full user guide](docs/guide.en.md).

package/README.md

@@ -61,13 +61,13 @@
 <details>
 <summary>确认版本 / 固定版本 / 界面安装失败时的兜底</summary>
 
-**设置 → 插件** 会列出已安装插件与版本，插件自己的 **设置 → Grok 订阅** 页也有版本卡片。要固定版本，在安装框里填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.7`。
+**设置 → 插件** 会列出已安装插件与版本，插件自己的 **设置 → Grok 订阅** 页也有版本卡片。要固定版本，在安装框里填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.8`。
 
 界面安装失败时（例如 profile 目录权限异常），可以对桌面版 profile 手动执行等价操作（pnpm ≥ 11）：
 
 ```sh
 cd "$HOME/.dsh/profiles/desktop"    # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
-pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.7
+pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.8
 ```
 
 `dsh plugin --profile desktop …` 会被拒绝：桌面版 profile 由 Electron 应用独占。登录方式与故障排查见 [完整使用指南](docs/guide.zh-CN.md)。

package/docs/guide.en.md

@@ -8,7 +8,7 @@ For quick setup, see the [README](../README.en.md#install). This guide covers de
 
 You need the DeepSeek Harness desktop app and an account with Grok Build access. The grok command is not required. The plugin declares Node.js `^22.19.0 || >=24.0.0`; DSH peers use `>=0.1.5-rc.2 <0.3.0-0`, which spans the whole 0.1 and 0.2 lines. See [package.json](../package.json) for the full requirements. Declared compatibility is not a claim that every version has passed live verification.
 
-**Install:** in the desktop app open **Settings → Plugins**, type the package name `dsh-grok-subscription` into the install field, and install it. Then **quit and restart the desktop app completely**; refreshing the page alone does not reload the Host adapter. To pin a version, put the full `package@version` in that field, for example `dsh-grok-subscription@2.0.7`.
+**Install:** in the desktop app open **Settings → Plugins**, type the package name `dsh-grok-subscription` into the install field, and install it. Then **quit and restart the desktop app completely**; refreshing the page alone does not reload the Host adapter. To pin a version, put the full `package@version` in that field, for example `dsh-grok-subscription@2.0.8`.
 
 **The plugin depends on the host's own pi-ai adapter.** From 2.0.0 the `grok-build` route is served entirely by the host's `@deepseek-ai/dsh-llm-pi-ai` / `@earendil-works/pi-ai`, which every DSH installation carries (`@deepseek-ai/dsh` → `dsh-base` → `dsh-llm-pi-ai`, with the `llm-pi-ai` row mounted unconditionally). If those packages cannot be resolved from the DSH installation, the plugin registers no route at all and **Active path** in Settings reads **unavailable**.
 
@@ -16,7 +16,7 @@ If the UI install fails (an unusual profile directory, say), the equivalent runs
 
 ```sh
 cd "$HOME/.dsh/profiles/desktop"    # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
-pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.7
+pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.8
 ```
 
 `dsh plugin --profile desktop …` is refused: the Electron application owns that profile exclusively.
@@ -69,6 +69,8 @@ For prefix caching, the plugin pins one stable `prompt_cache_key` per DSH sessio
 
 **No sign-in window.** Look for a clickable authorization link and code in the panel. A browser failing to open does not by itself prove `auth.x.ai` is unreachable; use “Open the sign-in page”. When a proxy is needed, set `https_proxy` in DSH's launch environment or `~/.dsh/.env`, then restart completely. `DSH_*` is a DSH bootstrap prefix, so declaring it in `~/.dsh/.env` makes that environment layer fail.
 
+**Sign-in fails with `Cannot reach auth.x.ai` (2.0.4–2.0.7 showed `Grok subscription RPC "login/cli" timed out after 20000ms`).** The DSH process cannot connect to `auth.x.ai`. This is typical when the browser gets online through a proxy app's “system proxy” switch: DSH does not read the macOS or Windows system proxy setting, so a browser that opens x.ai does not mean DSH can. Add `https_proxy=http://127.0.0.1:<port>` to `~/.dsh/.env` (on Windows, `%USERPROFILE%\.dsh\.env`), using the proxy app's HTTP (or mixed) port; a `socks5://` URL is not supported and is skipped in favor of a direct connection. Save, then quit and restart DSH completely, or switch the proxy app to TUN mode. Conversations and usage (`cli-chat-proxy.grok.com`) depend on the same setting after sign-in.
+
 **`fetch failed` or `Billing request timed out`.** Check access to the account service and `cli-chat-proxy.grok.com` separately. When a proxy is needed, set standard `https_proxy` / `http_proxy` variables in DSH's launch environment or `~/.dsh/.env`, not the project directory's `.env`, then manually restart DSH. The plugin uses the host network setup rather than providing its own proxy service. Network conditions are one possibility; also check authentication and backend errors.
 
 **Empty model list.** Finish subscription sign-in, or select **Read saved session**. Check for an API-key-only entry and inspect catalog status without sharing raw responses.
@@ -95,7 +97,7 @@ In the desktop app the `desktop` profile is owned exclusively by the Electron ap
 
 ```sh
 cd "$HOME/.dsh/profiles/desktop"    # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
-pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.7
+pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.8
 ```
 
 Then quit and restart the desktop app completely. After a successful update the profile's `package.json` dependency should show the target version while its `dsh.profile.bundles` entry is unchanged. Refreshing the browser is not enough: without a Host restart the old version keeps loading.

package/docs/guide.zh-CN.md

@@ -8,7 +8,7 @@
 
 需要 DeepSeek Harness 桌面版，以及当前具有 Grok Build 使用资格的订阅账号。不需要安装 grok 命令。插件的 Node.js 要求为 `^22.19.0 || >=24.0.0`，DSH peer 声明以 [package.json](../package.json) 为准；其中 DSH 依赖使用 `>=0.1.5-rc.2 <0.3.0-0`，覆盖 0.1 与 0.2 全线。声明范围不等于所有版本都已经过实机验证。
 
-**安装：** 在桌面版打开 **设置 → 插件**，在安装输入框里填入包名 `dsh-grok-subscription` 并安装，然后**完全退出并重启桌面应用**。仅刷新页面不会重新加载 Host 中的适配器。需要可重复安装时，填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.7`。
+**安装：** 在桌面版打开 **设置 → 插件**，在安装输入框里填入包名 `dsh-grok-subscription` 并安装，然后**完全退出并重启桌面应用**。仅刷新页面不会重新加载 Host 中的适配器。需要可重复安装时，填入完整的 `包名@版本`，例如 `dsh-grok-subscription@2.0.8`。
 
 **插件依赖宿主自带的 pi-ai 适配器。** 从 2.0.0 起，`grok-build` 路由完全由宿主的 `@deepseek-ai/dsh-llm-pi-ai` / `@earendil-works/pi-ai` 服务；DSH 的任何安装方式都带有它们（`@deepseek-ai/dsh` → `dsh-base` → `dsh-llm-pi-ai`，且 `llm-pi-ai` 行无条件挂载）。这两个包无法从 DSH 安装目录解析时，插件不会注册任何路由，设置页的「运行通路」显示**不可用**。
 
@@ -16,7 +16,7 @@
 
 ```sh
 cd "$HOME/.dsh/profiles/desktop"    # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
-pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.7
+pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.8
 ```
 
 `dsh plugin --profile desktop …` 会被直接拒绝：桌面版 profile 由 Electron 应用独占。
@@ -69,6 +69,8 @@ grok-4.6
 
 **没有弹出登录窗口。** 看面板是否已经显示可点击的授权链接和验证码。浏览器没有弹出，不一定等于 `auth.x.ai` 不可达；点「打开登录页面」。需要代理时，在 DSH 启动环境或 `~/.dsh/.env` 设置 `https_proxy` 后完全重启。注意 `DSH_*` 是 DSH 的 bootstrap 前缀，写进 `~/.dsh/.env` 会让该环境层直接报错。
 
+**点击登录后报 `Cannot reach auth.x.ai`（2.0.4–2.0.7 显示为 `Grok subscription RPC "login/cli" timed out after 20000ms`）。** DSH 进程连不上 `auth.x.ai`。常见于浏览器靠代理软件的“系统代理”开关上网的环境：DSH 不读取 macOS / Windows 的系统代理设置，所以浏览器能打开 x.ai 不代表 DSH 也能。在 `~/.dsh/.env`（Windows 为 `%USERPROFILE%\.dsh\.env`）写入 `https_proxy=http://127.0.0.1:<端口>`，端口填代理软件的 HTTP（或 mixed）端口；`socks5://` 不受支持，会被跳过并直连。保存后完全退出并重启 DSH，或改用代理软件的 TUN 模式。登录之后的对话与用量请求（`cli-chat-proxy.grok.com`）也依赖同一设置。
+
 **`fetch failed` / `Billing request timed out`。** 分别检查账号服务和 `cli-chat-proxy.grok.com` 的网络连接。需要代理时，在 DSH 启动环境或 `~/.dsh/.env` 中设置标准 `https_proxy` / `http_proxy`，而不是放进项目目录的 `.env`；再手动重启 DSH。插件沿用宿主网络配置，不提供单独代理服务。网络只是可能原因，还应检查认证和服务端错误。
 
 **模型列表为空。** 先完成订阅登录，或点击「读取已保存的会话」。检查是否只有 API-key 条目；查看目录状态，不要公开原始响应。
@@ -95,7 +97,7 @@ grok-4.6
 
 ```sh
 cd "$HOME/.dsh/profiles/desktop"    # Windows: cd "$env:USERPROFILE\.dsh\profiles\desktop"
-pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.7
+pnpm add --save-exact --config.minimumReleaseAge=0 dsh-grok-subscription@2.0.8
 ```
 
 然后完全退出并重启桌面版。更新成功后该 profile 的 `package.json` 里依赖应变为目标版本，`dsh.profile.bundles` 条目保持不变。仅刷新网页不够：Host 未重启时仍会加载旧版本。

package/lib/client.js

@@ -39,7 +39,7 @@ var import_react2 = require("react");
 var zh = {
   nav: "Grok \u8BA2\u9605",
   title: "Grok \u8BA2\u9605",
-  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 2.0.7",
+  subtitle: "\u7528 SuperGrok / X Premium\uFF08Grok Build\uFF09\u4F1A\u8BDD\uFF0C\u800C\u4E0D\u662F XAI_API_KEY\u3002\xB7 2.0.8",
   signedIn: "\u5DF2\u767B\u5F55",
   signedOut: "\u672A\u767B\u5F55",
   account: "\u8D26\u6237",
@@ -57,7 +57,7 @@ var zh = {
   deviceHint: "\u9762\u677F\u4F1A\u663E\u793A\u4E00\u6B21\u6027\u9A8C\u8BC1\u7801\u3002\u82E5\u6D4F\u89C8\u5668\u6CA1\u6709\u81EA\u52A8\u6253\u5F00\uFF0C\u70B9\u63D0\u793A\u91CC\u7684\u201C\u6253\u5F00\u767B\u5F55\u9875\u9762\u201D\uFF0C\u5E76\u5728\u9875\u9762\u4E0A\u786E\u8BA4\u540C\u4E00\u4E2A\u9A8C\u8BC1\u7801\u3002",
   loginWaiting: "\u7B49\u5F85\u6D4F\u89C8\u5668\u6388\u6743\u2026",
   loginOpenBrowser: "\u6253\u5F00\u767B\u5F55\u9875\u9762",
-  loginNoUrl: "\u6CA1\u62FF\u5230\u767B\u5F55\u94FE\u63A5\uFF1A\u8BF7\u786E\u8BA4\u672C\u673A\u80FD\u8BBF\u95EE auth.x.ai\u3002\u684C\u9762\u7248\u9700\u8981\u4EE3\u7406\u65F6\uFF0C\u5728 ~/.dsh/.env \u8BBE\u7F6E https_proxy \u540E\u91CD\u542F\u3002",
+  loginUnreachable: "DSH \u8FDE\u4E0D\u4E0A auth.x.ai\u3002\u6D4F\u89C8\u5668\u80FD\u6253\u5F00 x.ai \u4E0D\u4EE3\u8868 DSH \u4E5F\u80FD\uFF1ADSH \u4E0D\u8BFB\u53D6\u7CFB\u7EDF\u4EE3\u7406\uFF08\u4F8B\u5982 Clash\u3001v2rayN \u7684\u201C\u7CFB\u7EDF\u4EE3\u7406\u201D\u5F00\u5173\uFF09\u3002\u8BF7\u5728 ~/.dsh/.env\uFF08Windows \u4E3A %USERPROFILE%\\.dsh\\.env\uFF09\u5199\u5165 https_proxy=http://127.0.0.1:\u7AEF\u53E3\uFF08\u586B\u4EE3\u7406\u8F6F\u4EF6\u7684 HTTP \u7AEF\u53E3\uFF0C\u4E0D\u652F\u6301 socks5://\uFF09\uFF0C\u7136\u540E\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u542F DSH\uFF1B\u4E5F\u53EF\u4EE5\u6539\u7528\u4EE3\u7406\u8F6F\u4EF6\u7684 TUN \u6A21\u5F0F\u3002",
   loginTimeout: "\u7B49\u5F85\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u70B9\u51FB\u767B\u5F55\u3002",
   pullHint: "\u5B89\u5168\u8BFB\u53D6 ~/.grok/auth.json\uFF08\u62D2\u7EDD\u7B26\u53F7\u94FE\u63A5\u4E0E\u7EC4/\u5176\u4ED6\u4EBA\u53EF\u8BFB\uFF09\u3002\u63D2\u4EF6\u767B\u5F55\u548C\u7EED\u671F\u4E5F\u4F1A\u5199\u56DE\u8FD9\u4E2A\u6587\u4EF6\uFF1B\u53EA\u628A\u77ED\u671F access token \u5199\u5165 DSH\u3002",
   loginHelp: "\u767B\u5F55\u65B9\u5F0F\u8BF4\u660E",
@@ -122,7 +122,7 @@ var zh = {
 var en = {
   nav: "Grok Subscription",
   title: "Grok Subscription",
-  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 2.0.7",
+  subtitle: "Use a SuperGrok / X Premium (Grok Build) session, not XAI_API_KEY. \xB7 2.0.8",
   signedIn: "Signed in",
   signedOut: "Signed out",
   account: "Account",
@@ -140,7 +140,7 @@ var en = {
   deviceHint: "The panel shows a one-time code. If no browser opened, use \u201COpen the sign-in page\u201D in the status line and confirm that same code.",
   loginWaiting: "Waiting for browser authorization\u2026",
   loginOpenBrowser: "Open the sign-in page",
-  loginNoUrl: "No sign-in link was returned: make sure this machine can reach auth.x.ai. If the desktop app needs a proxy, set https_proxy in ~/.dsh/.env and restart.",
+  loginUnreachable: "DSH cannot reach auth.x.ai. A browser that opens x.ai does not mean DSH can: DSH ignores the system proxy setting (such as the \u201Csystem proxy\u201D switch in Clash or v2rayN). Add https_proxy=http://127.0.0.1:PORT to ~/.dsh/.env (on Windows, %USERPROFILE%\\.dsh\\.env), using your proxy app\u2019s HTTP port (socks5:// is not supported), then quit and restart DSH completely. A proxy app\u2019s TUN mode also works.",
   loginTimeout: "Timed out waiting for authorization; click sign-in again.",
   pullHint: "Reads ~/.grok/auth.json securely (refuses symlinks and group/other-readable files). Sign-in and renewal write this file too, and only the short-lived access token is stored in DSH.",
   loginHelp: "How signing in works",
@@ -905,6 +905,7 @@ function GrokSubscriptionSection({ rpc, t }) {
   const [busy, setBusy] = (0, import_react2.useState)("");
   const [usageBusy, setUsageBusy] = (0, import_react2.useState)(false);
   const [error, setError] = (0, import_react2.useState)("");
+  const [unreachable, setUnreachable] = (0, import_react2.useState)(false);
   const [notice, setNotice] = (0, import_react2.useState)("");
   const [status, setStatus] = (0, import_react2.useState)(void 0);
   const [loginPending, setLoginPending] = (0, import_react2.useState)(void 0);
@@ -975,6 +976,7 @@ function GrokSubscriptionSection({ rpc, t }) {
       setBusy(endpoint);
     }
     setError("");
+    setUnreachable(false);
     setNotice("");
     let value;
     try {
@@ -987,8 +989,9 @@ function GrokSubscriptionSection({ rpc, t }) {
       if (value?.ok === false && value.error) {
         setNotice("");
         setError(value.error);
+        if (isLogin && value.errorCode === "network") setUnreachable(true);
       } else if (value?.pending === true) {
-        setLoginPending({ url: value.loginUrl, code: value.userCode, warning: value.warning });
+        setLoginPending({ url: value.loginUrl, code: value.userCode });
         setNotice("");
       } else if (value?.ok !== false) {
         const successKey = {
@@ -1005,8 +1008,10 @@ function GrokSubscriptionSection({ rpc, t }) {
         }
       }
     } catch (item) {
+      const message = item instanceof Error ? item.message : String(item);
       setNotice("");
-      setError(item instanceof Error ? item.message : String(item));
+      setError(message);
+      if (isLogin && /timed out/iu.test(message)) setUnreachable(true);
     } finally {
       if (isUsageRefresh) setUsageBusy(false);
       else setBusy("");
@@ -1047,13 +1052,13 @@ function GrokSubscriptionSection({ rpc, t }) {
           /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("a", { className: "gsLink", href: loginPending.url, target: "_blank", rel: "noreferrer", children: t("loginOpenBrowser") })
         ] }) : null
       ] }) : null,
-      loginPending?.warning ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--warn", children: t("loginNoUrl") }) : null,
       notice ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--ok", children: notice }) : null,
       error ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "gsStatus gsStatus--error", children: [
         t("error"),
         ": ",
         error
       ] }) : null,
+      error && unreachable ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsStatus gsStatus--warn", children: t("loginUnreachable") }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(DiagnosticsRows, { diagnostics: status?.diagnostics, t }),
       status?.diagnostics && !status.diagnostics.imageInput ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "gsHint", children: t("adapterHint") }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("details", { className: "gsDisclosure", children: [

package/lib/index.js

@@ -39,6 +39,7 @@ var IMAGE_INPUT_MODEL_IDS = Object.freeze([
 var IMPORT_TIMEOUT_MS = 2500;
 var CREDENTIALS_IO_TIMEOUT_MS = 1500;
 var RPC_HANDLER_TIMEOUT_MS = 8e3;
+var LOGIN_START_TIMEOUT_MS = 15e3;
 var LOGIN_HANDLER_TIMEOUT_MS = 2e4;
 
 // src/session.js
@@ -1302,15 +1303,67 @@ function timeoutSignal(ms) {
   }
   return void 0;
 }
-async function postForm(url, params, fetchImpl) {
-  const response = await fetchImpl(url, {
+var OauthNetworkError = class extends Error {
+  constructor(host, reason, options) {
+    super(`Cannot reach ${host} (${reason})`, options);
+    this.name = "OauthNetworkError";
+    this.code = "network";
+    this.host = host;
+  }
+};
+var NETWORK_REASONS = Object.freeze({
+  UND_ERR_CONNECT_TIMEOUT: "connection timed out",
+  ETIMEDOUT: "connection timed out",
+  UND_ERR_HEADERS_TIMEOUT: "no response from the server",
+  UND_ERR_BODY_TIMEOUT: "the response stalled",
+  ECONNREFUSED: "connection refused",
+  ECONNRESET: "connection reset",
+  UND_ERR_SOCKET: "connection closed",
+  EPIPE: "connection closed",
+  ENOTFOUND: "DNS lookup failed",
+  EAI_AGAIN: "DNS lookup failed",
+  ENETUNREACH: "network unreachable",
+  EHOSTUNREACH: "host unreachable"
+});
+function networkCodeOf(error) {
+  let current = error;
+  for (let depth = 0; current && depth < 5; depth += 1) {
+    if (typeof current.code === "string" && current.code) return current.code;
+    current = current.cause ?? (Array.isArray(current.errors) ? current.errors[0] : void 0);
+  }
+  return void 0;
+}
+function networkReason(error) {
+  const name2 = error?.name;
+  if (name2 === "TimeoutError" || name2 === "AbortError") return "timed out";
+  const code = networkCodeOf(error);
+  if (code && NETWORK_REASONS[code]) return NETWORK_REASONS[code];
+  if (code && /CERT|TLS|SSL/u.test(code)) return `TLS certificate rejected: ${code}`;
+  return code ? `network error: ${code}` : "network error";
+}
+function hostOf(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return "the sign-in server";
+  }
+}
+async function fetchOrNetworkError(fetchImpl, url, init) {
+  try {
+    return await fetchImpl(url, init);
+  } catch (error) {
+    throw new OauthNetworkError(hostOf(url), networkReason(error), { cause: error });
+  }
+}
+async function postForm(url, params, fetchImpl, signal) {
+  const response = await fetchOrNetworkError(fetchImpl, url, {
     method: "POST",
     headers: {
       accept: "application/json",
       "content-type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams(params).toString(),
-    signal: timeoutSignal(CLI_REFRESH_TIMEOUT_MS)
+    signal: signal ?? timeoutSignal(CLI_REFRESH_TIMEOUT_MS)
   });
   const body = await readOauthBody(response);
   return { status: typeof response.status === "number" ? response.status : 0, body };
@@ -1350,11 +1403,12 @@ function fallbackOauthEndpoints(issuer = XAI_OAUTH_ISSUER) {
 async function discoverOauthEndpoints(issuer = XAI_OAUTH_ISSUER, options = {}) {
   const fetchImpl = options.fetch ?? fetch;
   const base = String(issuer).replace(/\/+$/u, "");
+  const url = `${base}/.well-known/openid-configuration`;
+  const response = await fetchOrNetworkError(fetchImpl, url, {
+    headers: { accept: "application/json" },
+    signal: options.signal ?? timeoutSignal(CLI_REFRESH_TIMEOUT_MS)
+  });
   try {
-    const response = await fetchImpl(`${base}/.well-known/openid-configuration`, {
-      headers: { accept: "application/json" },
-      signal: timeoutSignal(CLI_REFRESH_TIMEOUT_MS)
-    });
     const body = await readOauthBody(response);
     const status = typeof response.status === "number" ? response.status : 0;
     if (status < 200 || status >= 300) throw new Error(`OIDC discovery failed (HTTP ${status})`);
@@ -1400,7 +1454,7 @@ async function requestDeviceAuthorization(options = {}) {
   const { status, body } = await postForm(endpoint, {
     client_id: clientId,
     scope: scopes
-  }, fetchImpl);
+  }, fetchImpl, options.signal);
   if (body?.error || status < 200 || status >= 300) {
     throw new Error(`Could not start device sign-in: ${oauthError(body, status)}`);
   }
@@ -1582,6 +1636,7 @@ function createSessionService({
   authPath,
   env,
   oauthEndpoints,
+  loginStartTimeoutMs = LOGIN_START_TIMEOUT_MS,
   now = () => Date.now()
 } = {}) {
   const renew = renewSession ?? (() => defaultRenewSession({
@@ -1834,17 +1889,28 @@ function createSessionService({
     const sleep = loginOptions?.sleep ?? defaultSleep;
     const openUrl = loginOptions?.openUrl ?? ((url) => openExternal(url, { spawn: loginOptions?.openSpawn }));
     const clock = () => typeof loginOptions?.now === "function" ? loginOptions.now() : now();
+    const requestedStartMs = loginOptions?.startTimeoutMs ?? loginStartTimeoutMs;
+    const startTimeoutMs = typeof requestedStartMs === "number" && requestedStartMs > 0 ? requestedStartMs : LOGIN_START_TIMEOUT_MS;
+    const startSignal = loginOptions?.signal ?? timeoutSignal(startTimeoutMs);
     let endpoints;
     let device;
     try {
-      endpoints = loginOptions?.endpoints ?? oauthEndpoints ?? await discoverOauthEndpoints(XAI_OAUTH_ISSUER, { fetch: fetchLogin });
+      endpoints = loginOptions?.endpoints ?? oauthEndpoints ?? await discoverOauthEndpoints(XAI_OAUTH_ISSUER, { fetch: fetchLogin, signal: startSignal });
       device = await requestDeviceAuthorization({
         endpoint: endpoints.deviceAuthorizationEndpoint,
-        fetch: fetchLogin
+        fetch: fetchLogin,
+        signal: startSignal
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Could not start sign-in";
-      return { ok: false, error: message, ...await status() };
+      const network = error?.code === "network";
+      if (network) logger?.warn?.("Grok subscription sign-in could not start: %s", message);
+      return {
+        ok: false,
+        error: message,
+        ...network ? { errorCode: "network" } : {},
+        ...await status()
+      };
     }
     const loginUrl = device.verificationUriComplete || device.verificationUri;
     if (!isXaiHttpsUrl(loginUrl) || !device.userCode || !device.deviceCode) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-grok-subscription",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Use a SuperGrok or X Premium Grok Build subscription in DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",