dsh-openai-subscription 0.1.0 → 0.1.2

package/dist/host.d.ts

@@ -1,7 +1,10 @@
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import type { Context } from '@deepseek-ai/cordis';
+/** Stable progress keys let the browser localize notices without exposing diagnostics. */
+type FlowNoticeKind = 'requesting-code' | 'enter-code' | 'refreshing' | 'models-synced' | 'models-sync-failed';
 /** Host-side notice queued for the polling client. Mirrors `AuthorizationNotice`. */
 interface FlowNotice {
+    kind?: FlowNoticeKind;
     message: string;
     url?: string;
     code?: string;
@@ -15,19 +18,16 @@ interface FlowState {
     controller: AbortController;
     task: Promise<void> | null;
 }
-/** `openaiSubscription/status` reply. */
+/** `openaiSubscription/status` reply: semantic UI facts, never raw account metadata. */
 type StatusResult = {
     configured: false;
     ready: boolean;
 } | {
     configured: true;
     ready: boolean;
-    accountId: string | null;
-    expires: number | null;
-    loginMethod: string | null;
-    obtainedAt: number | null;
-    refreshedAt: number | null;
-    hasRefresh: boolean;
+    refreshable: boolean;
+    modelsSynced: boolean;
+    modelCount: number;
 };
 /** `openaiSubscription/authorize` reply. */
 type AuthorizeResult = {
@@ -36,6 +36,11 @@ type AuthorizeResult = {
 } | {
     started: true;
 };
+/** `openaiSubscription/syncModels` reply. */
+interface ModelSyncResult {
+    synced: true;
+    count: number;
+}
 /** `openaiSubscription/poll` reply. */
 type PollResult = {
     status: 'idle';
@@ -54,23 +59,27 @@ declare class OpenAISubscriptionController extends TypertRemoteService {
     private cachedModule;
     private locatingModule;
     private pendingBridge;
+    private syncingModels;
+    private modelSyncController;
+    private modelDiscovery;
     constructor(ctx: Context);
     private credentials;
     private shell;
     private timer;
     private authorization;
+    private llm;
     private ensureAuthorizationFlow;
     private locateAuthModule;
     private runDevice;
     private runRefresh;
     /** Store the credential used by the `openai-codex` provider. */
     private mirrorToPiAi;
-    /** Enable the default provider without replacing user configuration. */
-    private ensurePiRoute;
-    /** Mark the default provider as plugin-managed. */
-    private markPiRouteManaged;
-    /** Remove only the unchanged default provider created by this plugin. */
-    private removePiRouteIfBare;
+    /** Keep one cancellable model sync in flight so login, refresh, and UI actions cannot race. */
+    private synchronizeModels;
+    /** Fetch the account-scoped catalog and replace only this plugin's previous rows. */
+    private performModelSync;
+    /** Remove only unchanged dynamic rows, preserving every local model and profile field. */
+    private removeManagedPiRoute;
     private beginLogin;
     private registerAuthorizationFlow;
     private shq;
@@ -80,6 +89,7 @@ declare class OpenAISubscriptionController extends TypertRemoteService {
     cancel(): Promise<{
         ok: true;
     }>;
+    syncModels(): Promise<ModelSyncResult>;
     /** Cancel active authorization and remove plugin-managed credentials and settings. */
     logout(): Promise<{
         ok: true;

package/dist/host.js

@@ -2,6 +2,7 @@
 // OAuth is delegated to the OpenAI Codex integration bundled with DSH.
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { normalizeOAuthCredential } from './oauth.js';
+import { discoverOpenAIModels, mergeModelCatalog, removeManagedModels, } from './models.js';
 /** Plugin-owned authorization metadata. */
 const KEY = 'dsh-openai-subscription/chatgpt';
 /** Credential consumed by the `openai-codex` model provider. */
@@ -64,9 +65,58 @@ function errorMessage(error) {
     const message = error?.message;
     return message ? String(message) : String(error);
 }
+function recordOf(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+function grantPayload(record) {
+    const typed = recordOf(record);
+    return typed?.kind === 'grant' ? recordOf(typed.payload) ?? {} : {};
+}
+function modelIds(value) {
+    if (!Array.isArray(value))
+        return [];
+    const ids = [];
+    for (const candidate of value) {
+        const id = recordOf(candidate)?.id;
+        if (typeof id === 'string' && id.length > 0 && !ids.includes(id))
+            ids.push(id);
+    }
+    return ids;
+}
+function piRoute(section) {
+    const providers = recordOf(recordOf(section)?.providers);
+    return providers === null ? null : recordOf(providers['openai-codex']);
+}
+function explicitRouteModels(user, base) {
+    const userRoute = piRoute(user);
+    if (userRoute !== null && Object.prototype.hasOwnProperty.call(userRoute, 'models'))
+        return userRoute.models;
+    const baseRoute = piRoute(base);
+    if (baseRoute !== null && Object.prototype.hasOwnProperty.call(baseRoute, 'models'))
+        return baseRoute.models;
+    return undefined;
+}
+function unionModelCatalog(remote, builtin) {
+    const models = remote.models.map((model) => ({ ...model }));
+    const mentionedUpstream = new Set(remote.seenIds);
+    for (const candidate of builtin) {
+        if (typeof candidate.id !== 'string' || candidate.id.length === 0 || mentionedUpstream.has(candidate.id))
+            continue;
+        mentionedUpstream.add(candidate.id);
+        // Keep unmentioned catalog rows minimal so llm-pi-ai supplies complete
+        // metadata, but never resurrect an id the account endpoint explicitly hid.
+        models.push({ id: candidate.id });
+    }
+    return models;
+}
+function settingsConflict(error) {
+    return recordOf(error)?.code === 'SETTINGS_CONFLICT';
+}
 //#endregion
 /** Register source-mode remote methods without decorator syntax. */
-const REMOTE_METHODS = ['status', 'authorize', 'poll', 'cancel', 'logout'];
+const REMOTE_METHODS = ['status', 'authorize', 'poll', 'cancel', 'syncModels', 'logout'];
 function decorateRemoteMethods(klass, methods) {
     const initializers = [];
     for (const name of methods) {
@@ -90,6 +140,9 @@ class OpenAISubscriptionController extends TypertRemoteService {
     cachedModule = null;
     locatingModule = null;
     pendingBridge = null;
+    syncingModels = null;
+    modelSyncController = null;
+    modelDiscovery = discoverOpenAIModels;
     constructor(ctx) {
         super(ctx, 'openaiSubscription', { namespace: 'openaiSubscription' });
         // Resolve optional services per operation so late mounts and reloads work.
@@ -106,6 +159,9 @@ class OpenAISubscriptionController extends TypertRemoteService {
     authorization() {
         return this.ctx.get('authorization');
     }
+    llm() {
+        return this.ctx.get('llm');
+    }
     ensureAuthorizationFlow() {
         const authorization = this.authorization();
         if (authorization === undefined) {
@@ -162,7 +218,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
             notify({ message: '当前 DSH 环境缺少 OpenAI 登录组件，请更新 DSH 后重试。' });
             throw new Error('OpenAI login component unavailable');
         }
-        notify({ message: '正在向 OpenAI 请求设备登录码…' });
+        notify({ kind: 'requesting-code', message: '正在向 OpenAI 请求设备登录码…' });
         const spec = shell.resolve({
             command: 'node --input-type=module --eval ' + this.shq(DRIVER_DEVICE) + ' ' + this.shq(modulePath),
             timeoutMs: 16 * 60 * 1000,
@@ -206,6 +262,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
                 }
                 if (typeof msg.userCode === 'string' && msg.userCode) {
                     notify({
+                        kind: 'enter-code',
                         message: '请打开链接，使用有 Codex 权限的 ChatGPT 账号登录并输入设备码。',
                         url: typeof msg.verificationUri === 'string' ? msg.verificationUri : 'https://auth.openai.com/codex/device',
                         code: msg.userCode,
@@ -278,6 +335,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
             return {
                 kind: 'grant',
                 payload: {
+                    ...currentPayload,
                     provider: 'openai',
                     loginMethod: 'device_code',
                     accountId: granted.accountId ?? null,
@@ -299,8 +357,16 @@ class OpenAISubscriptionController extends TypertRemoteService {
         }
         if (control.aborted())
             return null;
-        if (await this.ensurePiRoute())
-            await this.markPiRouteManaged();
+        try {
+            await this.synchronizeModels(control.signal);
+            notify({ kind: 'models-synced', message: '可用模型已同步。' });
+        }
+        catch (error) {
+            if (control.aborted())
+                return null;
+            console.error('[openai-subscription] initial model sync failed: ' + errorMessage(error));
+            notify({ kind: 'models-sync-failed', message: '授权已保存，模型目录可稍后重试同步。' });
+        }
         return granted;
     }
     async runRefresh(control, notify) {
@@ -345,7 +411,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
             previous.expires = secretPayload.expires;
         if (typeof secretPayload.accountId === 'string' && secretPayload.accountId)
             previous.accountId = secretPayload.accountId;
-        notify({ message: '正在刷新 ChatGPT 订阅授权…' });
+        notify({ kind: 'refreshing', message: '正在刷新 ChatGPT 订阅授权…' });
         const spec = shell.resolve({
             command: 'node --input-type=module --eval ' + this.shq(DRIVER_REFRESH) + ' ' + this.shq(modulePath),
             timeoutMs: 120000,
@@ -400,6 +466,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
             return {
                 kind: 'grant',
                 payload: {
+                    ...latestPayload,
                     provider: 'openai',
                     loginMethod: typeof latestPayload.loginMethod === 'string' ? latestPayload.loginMethod : 'refresh',
                     accountId: next.accountId ?? null,
@@ -414,8 +481,16 @@ class OpenAISubscriptionController extends TypertRemoteService {
         });
         if (control.aborted())
             return null;
-        if (await this.ensurePiRoute())
-            await this.markPiRouteManaged();
+        try {
+            await this.synchronizeModels(control.signal);
+            notify({ kind: 'models-synced', message: '授权与可用模型已更新。' });
+        }
+        catch (error) {
+            if (control.aborted())
+                return null;
+            console.error('[openai-subscription] model sync after refresh failed: ' + errorMessage(error));
+            notify({ kind: 'models-sync-failed', message: '授权已更新，模型目录可稍后重试同步。' });
+        }
         return next;
     }
     /** Store the credential used by the `openai-codex` provider. */
@@ -453,64 +528,201 @@ class OpenAISubscriptionController extends TypertRemoteService {
             return false;
         }
     }
-    /** Enable the default provider without replacing user configuration. */
-    async ensurePiRoute() {
-        const settings = this.ctx.get('settings');
-        if (settings === undefined || typeof settings.mutate !== 'function')
-            return false;
-        try {
-            const descriptor = settings.describe({ redactSecrets: true }).find((entry) => entry.ns === 'llm-pi-ai');
-            if (descriptor === undefined)
-                return false;
-            const section = (descriptor.value && typeof descriptor.value === 'object') ? descriptor.value : {};
-            const providers = (section.providers && typeof section.providers === 'object') ? section.providers : {};
-            if (providers['openai-codex'] !== undefined)
-                return false;
-            await settings.mutate('llm-pi-ai', [{ op: 'set', path: ['providers', 'openai-codex'], value: {} }], descriptor.revision);
-            return true;
-        }
-        catch (error) {
-            console.error('[openai-subscription] enable openai-codex route failed: ' + errorMessage(error));
-            return false;
-        }
+    /** Keep one cancellable model sync in flight so login, refresh, and UI actions cannot race. */
+    synchronizeModels(signal, adoptExistingModels = false) {
+        if (this.syncingModels !== null)
+            return this.syncingModels;
+        const controller = new AbortController();
+        const relayAbort = () => controller.abort(signal?.reason);
+        if (signal?.aborted)
+            relayAbort();
+        else
+            signal?.addEventListener('abort', relayAbort, { once: true });
+        const pending = this.performModelSync(controller.signal, adoptExistingModels);
+        this.syncingModels = pending;
+        this.modelSyncController = controller;
+        void pending.finally(() => {
+            signal?.removeEventListener('abort', relayAbort);
+            if (this.syncingModels === pending)
+                this.syncingModels = null;
+            if (this.modelSyncController === controller)
+                this.modelSyncController = null;
+        }).catch(() => {
+            // The original caller observes the failure; this branch only settles finally().
+        });
+        return pending;
     }
-    /** Mark the default provider as plugin-managed. */
-    async markPiRouteManaged() {
+    /** Fetch the account-scoped catalog and replace only this plugin's previous rows. */
+    async performModelSync(signal, adoptExistingModels) {
         const credentials = this.credentials();
         if (credentials === undefined)
-            return;
+            throw new Error('DSH 凭证服务不可用，请重启后重试');
+        const settings = this.ctx.get('settings');
+        if (settings === undefined || typeof settings.mutate !== 'function') {
+            throw new Error('DSH 模型设置服务不可用，请重启后重试');
+        }
+        const [ownerRecord, adapterRecord] = await Promise.all([
+            credentials.readRecord(KEY),
+            credentials.readRecord(PI_AI_RECORD),
+        ]);
+        if (recordOf(ownerRecord)?.kind !== 'grant')
+            throw new Error('尚未通过此插件连接 ChatGPT，请先完成登录');
+        const adapter = grantPayload(adapterRecord);
+        const access = typeof adapter.access === 'string' ? adapter.access : '';
+        if (!access)
+            throw new Error('尚未连接 ChatGPT，请先完成登录');
+        const accountId = typeof adapter.accountId === 'string' && adapter.accountId.length > 0
+            ? adapter.accountId
+            : undefined;
+        const discoveryCredential = { access };
+        if (accountId !== undefined)
+            discoveryCredential.accountId = accountId;
+        // Refuse automatic adoption before any network request when an existing
+        // user/profile allow-list has no prior plugin ownership snapshot.
+        const initialDescriptor = settings.describe({ redactSecrets: true }).find((entry) => entry.ns === 'llm-pi-ai');
+        if (initialDescriptor === undefined)
+            throw new Error('DSH 模型适配器未启用，请更新 DSH 后重试');
+        const initialPlugin = grantPayload(ownerRecord);
+        if (!adoptExistingModels
+            && modelIds(initialPlugin.managedModels).length === 0
+            && explicitRouteModels(initialDescriptor.user, initialDescriptor.base) !== undefined) {
+            throw new Error('现有模型列表由配置管理，请在 ChatGPT 设置页确认同步');
+        }
+        const remoteModels = await this.modelDiscovery(discoveryCredential, { signal });
+        const llm = this.llm();
+        if (llm === undefined || typeof llm.discoverModels !== 'function') {
+            throw new Error('DSH 模型目录服务不可用，请重启后重试');
+        }
+        let builtinModels;
         try {
-            await credentials.modifyRecord(KEY, async (current) => {
-                if (current === undefined || current.kind !== 'grant')
-                    return undefined;
-                const payload = (current.payload && typeof current.payload === 'object') ? current.payload : {};
-                return { ...current, payload: { ...payload, managedPiRoute: true } };
-            });
+            builtinModels = await llm.discoverModels('llm-pi-ai', { provider: 'openai-codex' }, signal);
         }
         catch (error) {
-            console.error('[openai-subscription] remember managed openai-codex route failed: ' + errorMessage(error));
+            console.error('[openai-subscription] read installed openai-codex catalog failed: ' + errorMessage(error));
+            throw new Error('无法读取 DSH 内置模型目录，现有设置未更改');
+        }
+        const discovered = unionModelCatalog(remoteModels, builtinModels);
+        for (let attempt = 0; attempt < 3; attempt++) {
+            if (signal.aborted)
+                throw new Error('模型同步已取消');
+            const [currentOwner, currentAdapter] = await Promise.all([
+                credentials.readRecord(KEY),
+                credentials.readRecord(PI_AI_RECORD),
+            ]);
+            if (recordOf(currentOwner)?.kind !== 'grant')
+                throw new Error('ChatGPT 连接已被移除');
+            const liveAdapter = grantPayload(currentAdapter);
+            const liveAccess = typeof liveAdapter.access === 'string' ? liveAdapter.access : '';
+            const liveAccountId = typeof liveAdapter.accountId === 'string' ? liveAdapter.accountId : undefined;
+            if (!liveAccess || (accountId === undefined ? liveAccess !== access : liveAccountId !== accountId)) {
+                throw new Error('ChatGPT 连接在同步期间发生变化，请重试');
+            }
+            const descriptor = settings.describe({ redactSecrets: true }).find((entry) => entry.ns === 'llm-pi-ai');
+            if (descriptor === undefined)
+                throw new Error('DSH 模型适配器未启用，请更新 DSH 后重试');
+            const plugin = grantPayload(currentOwner);
+            const explicitModels = explicitRouteModels(descriptor.user, descriptor.base);
+            if (!adoptExistingModels && modelIds(plugin.managedModels).length === 0 && explicitModels !== undefined) {
+                throw new Error('现有模型列表由配置管理，请在 ChatGPT 设置页确认同步');
+            }
+            const merged = mergeModelCatalog(explicitModels, plugin.managedModels, discovered, plugin.suppressedModelIds);
+            const createdRoute = piRoute(descriptor.value) === null;
+            const operation = createdRoute
+                ? { op: 'set', path: ['providers', 'openai-codex'], value: { models: merged.models } }
+                : { op: 'set', path: ['providers', 'openai-codex', 'models'], value: merged.models };
+            try {
+                if (signal.aborted)
+                    throw new Error('模型同步已取消');
+                await settings.mutate('llm-pi-ai', [operation], descriptor.revision);
+            }
+            catch (error) {
+                if (attempt < 2 && settingsConflict(error))
+                    continue;
+                if (settingsConflict(error))
+                    throw new Error('模型设置刚刚发生变化，请重试同步');
+                throw error;
+            }
+            try {
+                await credentials.modifyRecord(KEY, async (latest) => {
+                    if (latest === undefined || latest.kind !== 'grant')
+                        throw new Error('ChatGPT 连接在同步期间被移除');
+                    const payload = recordOf(latest.payload) ?? {};
+                    if (accountId !== undefined && typeof payload.accountId === 'string' && payload.accountId !== accountId) {
+                        throw new Error('ChatGPT 账号在同步期间发生变化');
+                    }
+                    return {
+                        ...latest,
+                        payload: {
+                            ...payload,
+                            managedPiRoute: payload.managedPiRoute === true || createdRoute,
+                            managedModels: merged.managed,
+                            suppressedModelIds: merged.suppressed,
+                            modelsSyncedAt: Date.now(),
+                        },
+                    };
+                });
+            }
+            catch (error) {
+                // Settings already contain the safe complete snapshot. A later sync will
+                // conservatively treat it as local rather than risk overwriting it.
+                console.error('[openai-subscription] remember managed model catalog failed: ' + errorMessage(error));
+            }
+            return { synced: true, count: modelIds(merged.models).length };
         }
+        throw new Error('模型设置刚刚发生变化，请重试同步');
     }
-    /** Remove only the unchanged default provider created by this plugin. */
-    async removePiRouteIfBare() {
-        const settings = this.ctx.get('settings');
-        if (settings === undefined || typeof settings.mutate !== 'function')
+    /** Remove only unchanged dynamic rows, preserving every local model and profile field. */
+    async removeManagedPiRoute(managedRoute, managedModels) {
+        const managedIds = modelIds(managedModels);
+        if (!managedRoute && managedIds.length === 0)
             return;
-        try {
+        const settings = this.ctx.get('settings');
+        if (settings === undefined || typeof settings.mutate !== 'function') {
+            throw new Error('DSH 模型设置服务不可用，尚未断开连接');
+        }
+        for (let attempt = 0; attempt < 3; attempt++) {
             const descriptor = settings.describe({ redactSecrets: true }).find((entry) => entry.ns === 'llm-pi-ai');
             if (descriptor === undefined)
+                throw new Error('DSH 模型适配器未启用，尚未断开连接');
+            const route = piRoute(descriptor.user);
+            if (route === null)
                 return;
-            const user = (descriptor.user && typeof descriptor.user === 'object') ? descriptor.user : {};
-            const providers = (user.providers && typeof user.providers === 'object') ? user.providers : {};
-            const entry = providers['openai-codex'];
-            if (entry === undefined)
+            const profileFields = Object.keys(route).filter((key) => key !== 'models');
+            const existingIds = modelIds(route.models);
+            let operation = null;
+            if (managedIds.length === 0) {
+                if (managedRoute && existingIds.length === 0 && profileFields.length === 0) {
+                    operation = { op: 'unset', path: ['providers', 'openai-codex'] };
+                }
+            }
+            else if (existingIds.length === 0) {
+                if (managedRoute && profileFields.length === 0) {
+                    operation = { op: 'unset', path: ['providers', 'openai-codex'] };
+                }
+            }
+            else {
+                const remaining = removeManagedModels(route.models, managedModels);
+                if (remaining.length < existingIds.length) {
+                    operation = managedRoute && remaining.length === 0 && profileFields.length === 0
+                        ? { op: 'unset', path: ['providers', 'openai-codex'] }
+                        : remaining.length === 0
+                            ? { op: 'unset', path: ['providers', 'openai-codex', 'models'] }
+                            : { op: 'set', path: ['providers', 'openai-codex', 'models'], value: remaining };
+                }
+            }
+            if (operation === null)
                 return;
-            if (!(typeof entry === 'object' && entry !== null && Object.keys(entry).length === 0))
+            try {
+                await settings.mutate('llm-pi-ai', [operation], descriptor.revision);
                 return;
-            await settings.mutate('llm-pi-ai', [{ op: 'unset', path: ['providers', 'openai-codex'] }], descriptor.revision);
-        }
-        catch (error) {
-            console.error('[openai-subscription] disable openai-codex route failed: ' + errorMessage(error));
+            }
+            catch (error) {
+                if (attempt < 2 && settingsConflict(error))
+                    continue;
+                if (settingsConflict(error))
+                    throw new Error('模型设置持续发生变化，尚未断开连接');
+                throw error;
+            }
         }
     }
     beginLogin(method) {
@@ -525,7 +737,7 @@ class OpenAISubscriptionController extends TypertRemoteService {
         const state = { notices: [], done: false, outcome: null, error: null, controller, task: null };
         this.pendingBridge = state;
         const notify = (notice) => {
-            state.notices.push({ message: notice.message, url: notice.url, code: notice.code });
+            state.notices.push({ kind: notice.kind, message: notice.message, url: notice.url, code: notice.code });
             if (state.notices.length > 50)
                 state.notices.shift();
         };
@@ -608,23 +820,32 @@ class OpenAISubscriptionController extends TypertRemoteService {
             credentials.readRecord(KEY),
             credentials.readRecord(PI_AI_RECORD),
         ]);
-        const p = record?.kind === 'grant' && record.payload && typeof record.payload === 'object'
-            ? record.payload
-            : {};
-        const adapter = adapterRecord?.kind === 'grant' && adapterRecord.payload && typeof adapterRecord.payload === 'object'
-            ? adapterRecord.payload
-            : {};
-        if (typeof adapter.access !== 'string' || !adapter.access)
+        const plugin = grantPayload(record);
+        const adapter = grantPayload(adapterRecord);
+        if (recordOf(record)?.kind !== 'grant' || typeof adapter.access !== 'string' || !adapter.access) {
             return { configured: false, ready: !!modulePath };
+        }
+        const managedIds = modelIds(plugin.managedModels);
+        const suppressed = new Set(Array.isArray(plugin.suppressedModelIds)
+            ? plugin.suppressedModelIds.filter((id) => typeof id === 'string')
+            : []);
+        const expectedIds = managedIds.filter((id) => !suppressed.has(id));
+        let configuredIds = [];
+        try {
+            const settings = this.ctx.get('settings');
+            const descriptor = settings?.describe({ redactSecrets: true }).find((entry) => entry.ns === 'llm-pi-ai');
+            configuredIds = modelIds(explicitRouteModels(descriptor?.user, descriptor?.base));
+        }
+        catch (error) {
+            console.error('[openai-subscription] read model sync status failed: ' + errorMessage(error));
+        }
+        const modelsSynced = managedIds.length > 0 && expectedIds.every((id) => configuredIds.includes(id));
         return {
             configured: true,
             ready: !!modulePath,
-            accountId: typeof adapter.accountId === 'string' ? adapter.accountId : (typeof p.accountId === 'string' ? p.accountId : null),
-            expires: typeof adapter.expires === 'number' && Number.isFinite(adapter.expires) ? adapter.expires : null,
-            loginMethod: typeof p.loginMethod === 'string' ? p.loginMethod : null,
-            obtainedAt: typeof p.obtainedAt === 'number' ? p.obtainedAt : null,
-            refreshedAt: typeof p.refreshedAt === 'number' ? p.refreshedAt : null,
-            hasRefresh: typeof adapter.refresh === 'string' && adapter.refresh.length > 0,
+            refreshable: typeof adapter.refresh === 'string' && adapter.refresh.length > 0,
+            modelsSynced,
+            modelCount: modelsSynced ? configuredIds.length : 0,
         };
     }
     async authorize(method) {
@@ -651,6 +872,11 @@ class OpenAISubscriptionController extends TypertRemoteService {
         }
         return { ok: true };
     }
+    async syncModels() {
+        // This explicit UI action is the opt-in for treating an existing allow-list
+        // as locally owned additions on top of the live and installed catalogs.
+        return this.synchronizeModels(undefined, true);
+    }
     /** Cancel active authorization and remove plugin-managed credentials and settings. */
     async logout() {
         const pending = this.pendingBridge;
@@ -668,19 +894,52 @@ class OpenAISubscriptionController extends TypertRemoteService {
             }
             catch { }
         }
+        this.modelSyncController?.abort();
+        const activeSync = this.syncingModels;
+        if (activeSync !== null)
+            await activeSync.catch(() => { });
         const credentials = this.credentials();
         if (credentials === undefined)
             throw new Error('DSH credential service unavailable');
         const record = await credentials.readRecord(KEY);
-        const payload = record?.kind === 'grant' && record.payload && typeof record.payload === 'object'
-            ? record.payload
-            : {};
+        if (recordOf(record)?.kind !== 'grant')
+            throw new Error('ChatGPT 连接不属于此插件');
+        const payload = grantPayload(record);
         const managedPiRoute = payload.managedPiRoute === true;
-        // Delete the provider credential before reporting a successful logout.
+        const managedModels = payload.managedModels;
+        // Keep the ownership snapshot until settings cleanup succeeds, so a
+        // revision conflict can never turn into an unrecoverable orphaned catalog.
+        await this.removeManagedPiRoute(managedPiRoute, managedModels);
+        // Remove duplicate secrets from the plugin record before deleting the
+        // provider credential. If provider deletion fails, retry remains possible
+        // without retaining a second access/refresh-token copy.
+        const containsSecret = (typeof payload.access === 'string' && payload.access.length > 0)
+            || (typeof payload.refresh === 'string' && payload.refresh.length > 0);
+        if (containsSecret) {
+            let staged = false;
+            await credentials.modifyRecord(KEY, async (latest) => {
+                if (latest === undefined || latest.kind !== 'grant')
+                    throw new Error('ChatGPT 连接在断开期间发生变化');
+                const latestPayload = grantPayload(latest);
+                if (latestPayload.access !== payload.access || latestPayload.refresh !== payload.refresh) {
+                    throw new Error('ChatGPT 连接在断开期间发生变化');
+                }
+                staged = true;
+                return { kind: 'grant', payload: { provider: 'openai', cleanupPending: true } };
+            });
+            if (!staged)
+                throw new Error('ChatGPT 连接在断开期间发生变化');
+        }
+        // The adapter credential is the authorization actually used for requests.
         await credentials.deleteRecord(PI_AI_RECORD);
-        await credentials.deleteRecord(KEY);
-        if (managedPiRoute)
-            await this.removePiRouteIfBare();
+        try {
+            await credentials.deleteRecord(KEY);
+        }
+        catch (error) {
+            // At this point settings are clean and both token copies are gone; a
+            // harmless cleanup marker may remain but must not make disconnect fail.
+            console.error('[openai-subscription] remove cleanup marker failed: ' + errorMessage(error));
+        }
         return { ok: true };
     }
 }