dsh-plugin-subscription-oauth 0.16.2 → 0.17.0

package/README.dev.md

@@ -70,7 +70,7 @@ quota, which is read per subscription period and per model's free allowance.
 | --- | --- |
 | `ctx.llm` | the `kimi`, `grok`, `antigravity`, `glm` and `auto` provider routes (models, reasoning efforts, streaming) |
 | Settings | a **Subscriptions** section: one card per provider — sign in, sign out, default account, token refresh, plan quota, model catalog, manage dialog |
-| Model picker | each provider's own models, plus **`auto` as its own route** spanning them — Kimi ships `kimi-for-coding`, `k3`, `k3[1m]`, `k3-256k`; Grok seeds `grok-4.6`, `grok-4.5` and adds whatever its live catalog reports; Antigravity lists the agent-callable subset of what its endpoint reports (`fetchAvailableModels`), filtering out tabs, commit-message and transcription surfaces; GLM ships the `glm-5.3` family (`glm-5.3`, `glm-5.3-flash`, `glm-5.2`, `glm-5.1`, `glm-5`) and adds whatever its coding host lists |
+| Model picker | each provider's own models, plus **`auto` as its own route** spanning them. Membership comes from the provider's own model list, read once and cached as that route's table (`~/.dsh/plugins/kimi-oauth/model-catalog.json`), so the picker never spends a request and a release or retirement server-side needs no plugin update. Kimi serves `kimi-for-coding`, `k3` (1M) and `k3-256k`; Grok adds whatever its live catalog reports on top of `grok-4.6`/`grok-4.5`; Antigravity lists the agent-callable subset of what its endpoint reports (`fetchAvailableModels`), filtering out tabs, commit-message and transcription surfaces; GLM adds whatever its coding host lists on top of the `glm-5.3` family |
 
 Credentials live at `~/.dsh/plugins/kimi-oauth/auth.json` (mode `0600`,
 written atomically, one section per provider). The directory keeps the name this

package/README.md

@@ -13,12 +13,12 @@ Sign in once per provider from **Settings → Subscriptions** and that provider'
 
 | Provider | What you get | Sign-in |
 | --- | --- | --- |
-| **Kimi Code** | `kimi-for-coding`, `k3`, `k3[1m]`, `k3-256k` + live catalog | OAuth device flow (show code, confirm in browser) |
-| **Grok (X Premium)** | `grok-4.7`, `grok-4.6`, … + live catalog, **⚡ lightspeed** fast variant | Browser OAuth (auto-redirect) |
-| **Google Antigravity** | Claude Sonnet/Opus, Gemini Flash, GPT-OSS, with reasoning tiers | Google account OAuth |
-| **GLM (BigModel)** | `glm-5.3`, `glm-5.3-flash`, `glm-5.2`, `glm-5.1`, `glm-5` | ZCode browser sign-in (polled) |
-| **Volcengine Ark** | Ark coding models + live catalog | Volcengine SSO |
-| **Xiaomi MiMo** | MiMo Pro, MiMo Flash | Xiaomi account (QR / password) |
+| **Kimi Code** | `kimi-for-coding`, `k3` (1M), `k3-256k` — read from the endpoint's own model list | OAuth device flow (show code, confirm in browser) |
+| **Grok (X Premium)** | whatever the account's own model list reports (e.g. `grok-4.7`), **⚡ lightspeed** fast variant | Browser OAuth (auto-redirect) |
+| **Google Antigravity** | Claude Sonnet/Opus, Gemini Flash, GPT-OSS, with reasoning tiers — read from the account's own list | Google account OAuth |
+| **GLM (BigModel)** | whatever the coding host lists (e.g. `glm-5.3`, `glm-5.3-flash`) | ZCode browser sign-in (polled) |
+| **Volcengine Ark** | the plan's own coding models | Volcengine SSO |
+| **Xiaomi MiMo** | MiMo's own model list, with the app's two-model set as the fallback | Xiaomi account (QR / password) |
 | **WorkBuddy (国内版)** | Hy, GLM, Kimi, DeepSeek, MiniMax models | Browser OAuth (Tencent) |
 
 Every provider also feeds the **`auto`** route, which spans them all: pick `auto` and the harness walks your enabled models in order until one answers.
@@ -28,6 +28,7 @@ Every provider also feeds the **`auto`** route, which spans them all: pick `auto
 - **One sign-in per provider** — no API keys to find, paste, or rotate. The plugin runs the provider's own OAuth/device flow and keeps the token on disk (`~/.dsh/plugins/kimi-oauth/auth.json`, mode `0600`).
 - **Live plan usage** — the Settings card and the composer chip show each account's remaining quota (Kimi's 5-hour / weekly windows + credit, Grok's weekly credit, Antigravity's Gemini + Claude buckets, GLM/Ark/MiMo/WorkBuddy credits), with a meter and reset time.
 - **Model picker integration** — each provider's models appear in the session picker with context windows and reasoning tiers; hide or re-order them per provider.
+- **Catalogs come from the provider, not from this build** — every route reads its own model list once and caches it as the provider's table, so a model released, renamed or retired server-side shows up (or disappears) without a plugin update. Signing in and the Settings **refresh models** action are what re-read it; browsing the picker never spends a request.
 - **⚡ Fast / lightspeed variants** — for models that have one (e.g. Grok 4.7 → `grok-4.7-build-fast`), a bolt button beside the model selector switches to the fast variant; it reads as a reasoning rung so the base model always stays selectable.
 - **Cross-account pool** — sign in to several accounts on one provider; the plugin draws on the next account when one's allowance runs out.
 - **Auto fallback** — `auto` moves to the next enabled model when a provider refuses the preferred one (renamed, rate-limited, out of quota), and stops falling back once a stream has started.

package/README.zh.dev.md

@@ -56,7 +56,7 @@ Antigravity 的流程是 Google 的桌面 OAuth 客户端（`accounts.google.com
 | --- | --- |
 | `ctx.llm` | `kimi`、`grok`、`antigravity`、`glm` 和 `auto` 提供方路由（模型、推理强度、流式输出） |
 | Settings | 一个 **Subscriptions** 区域：每个提供方一张卡片——登录、退出登录、默认账户、令牌刷新、套餐配额、模型目录、管理对话框 |
-| 模型选择器 | 每个提供方自己的模型，外加**作为独立路由的 `auto`**，横跨它们——Kimi 提供 `kimi-for-coding`、`k3`、`k3[1m]`、`k3-256k`；Grok 内置 `grok-4.6`、`grok-4.5`，并加入其实时目录所报告的任何模型；Antigravity 列出其端点所报告内容（`fetchAvailableModels`）中可供 agent 调用的子集，过滤掉 tabs、commit-message 和 transcription 相关层面；GLM 提供 `glm-5.3` 系列（`glm-5.3`、`glm-5.3-flash`、`glm-5.2`、`glm-5.1`、`glm-5`），并加入其编码主机所列出的一切 |
+| 模型选择器 | 每个提供方自己的模型，外加**作为独立路由的 `auto`**，横跨它们。成员资格来自提供方自己的模型列表：每个路由只读取一次并缓存为该路由的目录（`~/.dsh/plugins/kimi-oauth/model-catalog.json`），因此选择器不会发出请求，服务端新增或下线模型也无需插件更新。Kimi 提供 `kimi-for-coding`、`k3`（1M）与 `k3-256k`；Grok 在 `grok-4.6`、`grok-4.5` 之上加入其实时目录所报告的任何模型；Antigravity 列出其端点所报告内容（`fetchAvailableModels`）中可供 agent 调用的子集，过滤掉 tabs、commit-message 和 transcription 相关层面；GLM 在 `glm-5.3` 系列之上加入其编码主机所列出的一切 |
 
 凭证存放在 `~/.dsh/plugins/kimi-oauth/auth.json`（模式 `0600`，原子写入，每个提供方
 一个区段）。该目录保留了本插件在只服务 Kimi Code 时所用的名称：它保存着**活跃的

package/README.zh.md

@@ -13,12 +13,12 @@
 
 | 服务 | 可用模型 | 登录方式 |
 | --- | --- | --- |
-| **Kimi Code** | `kimi-for-coding`、`k3`、`k3[1m]`、`k3-256k` + 实时目录 | OAuth 设备流（显示代码，浏览器确认） |
-| **Grok (X Premium)** | `grok-4.7`、`grok-4.6`… + 实时目录，**⚡ lightspeed** 快速变体 | 浏览器 OAuth（自动回调） |
-| **Google Antigravity** | Claude Sonnet/Opus、Gemini Flash、GPT-OSS，带推理档 | Google 账号 OAuth |
-| **GLM (BigModel)** | `glm-5.3`、`glm-5.3-flash`、`glm-5.2`、`glm-5.1`、`glm-5` | ZCode 浏览器登录（轮询） |
-| **Volcengine Ark** | Ark 编程模型 + 实时目录 | 火山引擎 SSO |
-| **Xiaomi MiMo** | MiMo Pro、MiMo Flash | 小米账号（扫码 / 密码） |
+| **Kimi Code** | `kimi-for-coding`、`k3`（1M）、`k3-256k` —— 直接来自端点自己的模型列表 | OAuth 设备流（显示代码，浏览器确认） |
+| **Grok (X Premium)** | 账号自己的模型列表所报告的一切（如 `grok-4.7`），**⚡ lightspeed** 快速变体 | 浏览器 OAuth（自动回调） |
+| **Google Antigravity** | Claude Sonnet/Opus、Gemini Flash、GPT-OSS，带推理档 —— 来自账号自己的列表 | Google 账号 OAuth |
+| **GLM (BigModel)** | 编码主机列出的一切（如 `glm-5.3`、`glm-5.3-flash`） | ZCode 浏览器登录（轮询） |
+| **Volcengine Ark** | 套餐自己的编程模型 | 火山引擎 SSO |
+| **Xiaomi MiMo** | MiMo 自己的模型列表，读取失败时回退到应用内置的两个模型 | 小米账号（扫码 / 密码） |
 | **WorkBuddy (国内版)** | Hy、GLM、Kimi、DeepSeek、MiniMax 模型 | 浏览器 OAuth（腾讯） |
 
 每个服务也会汇入 **`auto`** 路由，它横跨全部：选 `auto`，harness 会按顺序尝试你已启用的模型，直到有响应。
@@ -28,6 +28,7 @@
 - **每个服务登录一次** —— 无需找、贴、轮换 API Key。插件运行服务自己的 OAuth/设备流，令牌保存在磁盘（`~/.dsh/plugins/kimi-oauth/auth.json`，权限 `0600`）。
 - **实时套餐额度** —— 设置卡片和输入框 chip 显示每个账号的剩余额度（Kimi 的 5 小时 / 每周窗口 + 额度，Grok 每周额度，Antigravity 的 Gemini + Claude 分组，GLM/Ark/MiMo/WorkBuddy 的额度），带进度条和重置时间。
 - **模型选择器集成** —— 每个服务的模型带上下文窗口和推理档出现在选择器里；可按服务隐藏或排序。
+- **模型目录来自服务本身，而不是本插件** —— 每个路由只读取一次服务自己的模型列表，并把它缓存为该路由的目录，因此服务端新增、改名或下线的模型无需插件更新即可出现（或消失）。重新读取的时机是登录成功和设置页的**刷新模型**；浏览选择器不会发出任何请求。
 - **⚡ 快速 / lightspeed 变体** —— 对有快速变体的模型（如 Grok 4.7 → `grok-4.7-build-fast`），模型选择器旁的闪电按钮一键切换；它作为推理档实现，基础模型始终可选。
 - **多账号池** —— 一个服务可登录多个账号；某账号额度用尽时自动切到下一个。
 - **Auto 回退** —— `auto` 在首选模型被拒（改名、限流、额度尽）时改用下一个已启用模型，且流开始后不再回退。

package/lib/auth/workbuddy-flow.d.ts

@@ -85,7 +85,7 @@ export declare function finishWorkBuddySignIn(start: WorkBuddySignInStart, fetch
 }>;
 /** The domain a token names, else the API host. */
 export declare function workbuddyDomain(token: Pick<WorkBuddyTokenSet, 'domain'>): string;
-/** The headers WorkBuddy's chat gateway accepts: its own CLI's, nothing more. */
+/** The headers WorkBuddy's desktop client sends with a chat, as magpie's workbuddy sets. */
 export declare function workbuddyHeaders(token: WorkBuddyTokenSet): Record<string, string>;
 /** Whether a token is close enough to its end that a request should refresh it. */
 export declare function workbuddyStale(token: Pick<WorkBuddyTokenSet, 'expiresAt'>): boolean;

package/lib/auth/workbuddy-flow.js

@@ -214,21 +214,26 @@ async function workbuddyEnterprise(token, who, fetchFn) {
     const pick = same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : undefined;
     return pick && typeof pick.enterpriseId === 'string' ? pick.enterpriseId.trim() : '';
 }
-/** The headers WorkBuddy's chat gateway accepts: its own CLI's, nothing more. */
+/** The headers WorkBuddy's desktop client sends with a chat, as magpie's workbuddy sets. */
 export function workbuddyHeaders(token) {
     const headers = {
-        'Accept': 'application/json, text/plain, */*',
-        'X-Requested-With': 'XMLHttpRequest',
-        'Origin': 'https://copilot.tencent.com',
-        'Referer': 'https://copilot.tencent.com/',
-        'User-Agent': 'CLI/2.63.2 CodeBuddy/2.63.2',
-        'Content-Type': 'application/json',
         'Authorization': `Bearer ${token.accessToken}`,
-        ...token.uid === undefined || token.uid === '' ? { 'X-No-User-Id': '1' } : { 'X-User-Id': token.uid },
-        ...token.enterpriseId === undefined || token.enterpriseId === '' ? { 'X-No-Enterprise-Id': '1' } : { 'X-Enterprise-Id': token.enterpriseId },
+        'X-User-Id': token.uid ?? '',
         'X-Domain': workbuddyDomain(token),
         'X-Product': 'SaaS',
+        'X-IDE-Type': 'WorkBuddy',
+        'User-Agent': `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+        'X-Requested-With': 'XMLHttpRequest',
+        'X-Agent-Intent': 'craft',
+        'X-Agent-Purpose': 'conversation',
+        'X-IDE-Name': 'WorkBuddy',
+        'X-IDE-Version': WORKBUDDY_UA_VERSION,
     };
+    const enterprise = typeof token.enterpriseId === 'string' ? token.enterpriseId.trim() : '';
+    if (enterprise !== '') {
+        headers['X-Enterprise-Id'] = enterprise;
+        headers['X-Tenant-Id'] = enterprise;
+    }
     return headers;
 }
 /** Whether a token is close enough to its end that a request should refresh it. */

package/lib/client/index.js

@@ -113,7 +113,16 @@ export function apply(ctx) {
 function modelDirectoryFor(modelDirectories, sessionId) {
     if (sessionId === undefined || modelDirectories?.directoryFor === undefined)
         return undefined;
-    const directory = modelDirectories.directoryFor(sessionId);
+    // The host throws when the session has no directory yet (a fresh session, say); that is
+    // a missing control, not a fault, so the button renders nothing instead of breaking the
+    // whole composer.
+    let directory;
+    try {
+        directory = modelDirectories.directoryFor(sessionId);
+    }
+    catch {
+        return undefined;
+    }
     if (directory?.select === undefined)
         return undefined;
     return {

package/lib/client.js

@@ -3272,7 +3272,12 @@ function apply(ctx) {
 */
 function modelDirectoryFor(modelDirectories, sessionId) {
 	if (sessionId === void 0 || modelDirectories?.directoryFor === void 0) return void 0;
-	const directory = modelDirectories.directoryFor(sessionId);
+	let directory;
+	try {
+		directory = modelDirectories.directoryFor(sessionId);
+	} catch {
+		return;
+	}
 	if (directory?.select === void 0) return void 0;
 	return { select: (selection) => directory.select?.(selection) ?? Promise.resolve() };
 }