dsh-plugin-subscription-oauth 0.5.0 → 0.6.0

package/lib/index.d.ts

@@ -44,6 +44,18 @@ export interface Config {
      * the other routes. Defaults to true.
      */
     auto?: boolean;
+    /**
+     * The credential reference a non-subscription provider's balance query uses, by
+     * provider id.
+     *
+     * A provider that is not a subscription this plugin serves has no usage windows to
+     * meter, so the chip shows its balance instead — read by cc-switch's query, which needs
+     * the provider's API key. The provider's profile names that key by reference
+     * (`apiKeyEnv`), and the host's credential service resolves the name; this map is the
+     * one place a provider id is tied to that reference. A provider with no entry, or
+     * whose key does not resolve, gets no balance and the chip stays silent.
+     */
+    balanceCredentialRefs?: Record<string, string>;
 }
 /** Configuration schema, with the config file's own defaults applied. */
 export declare const Config: z<Config>;

package/lib/index.js

@@ -188,7 +188,39 @@ export function apply(ctx, config = {}) {
         handles.set(route.id, handle);
         ctx.effect(() => () => handle(), `${name}: ${route.id} provider route`);
     }
-    registerSubscriptionRpc(ctx, registry);
+    // A non-subscription provider's balance is read by cc-switch's query, which needs the
+    // provider's API key. The provider's profile names that key by reference (`apiKeyEnv`),
+    // and the configured map ties a provider id to that reference; the host's credential
+    // service resolves it. The map lives in server config because that is where the rest
+    // of the plugin's wiring is, and the client learns a provider's balance by id, never
+    // by its credential reference.
+    const credentialRefs = config.balanceCredentialRefs ?? {};
+    // The DeepSeek account's balance is read on the node half through the host's
+    // `deepseekAccount` service; the browser reaches it through the plugin's own RPC, the
+    // same channel as the rest of the chip's data. The service is read lazily, per request
+    // (not once in apply), because it may register after this plugin applies; a composition
+    // without it still serves every other endpoint, and the balance endpoint answers nothing.
+    const balanceContext = {
+        credentialRefs,
+        resolveDeepSeekAccount: () => {
+            try {
+                return ctx.get('deepseekAccount');
+            }
+            catch {
+                return undefined;
+            }
+        },
+        resolveCredential: async (ref) => {
+            try {
+                const credentials = ctx.get('credentials');
+                return (await credentials?.resolve?.(ref))?.value;
+            }
+            catch {
+                return undefined;
+            }
+        },
+    };
+    registerSubscriptionRpc(ctx, registry, balanceContext);
     // Warm each route's live catalog for an install that is already signed in.
     for (const id of registry.ids()) {
         void registry.discover(id, false).catch((error) => {

package/lib/protocol.d.ts

@@ -12,7 +12,7 @@
 /** Prefix of every RPC method this plugin serves. */
 export declare const RPC_PREFIX = "subscription-oauth.";
 /** Endpoints the Settings page may call. */
-export declare const RPC_ENDPOINTS: readonly ["status", "login", "cancel", "logout", "setDefault", "refresh", "discover", "setModelVisible", "setModelOrder", "addModel", "removeModel", "usage", "reload", "ccswitch-balance"];
+export declare const RPC_ENDPOINTS: readonly ["status", "login", "cancel", "logout", "setDefault", "refresh", "discover", "setModelVisible", "setModelOrder", "addModel", "removeModel", "usage", "reload", "deepseek-balance", "ccswitch-balance"];
 /** One endpoint name. */
 export type RpcEndpoint = typeof RPC_ENDPOINTS[number];
 /** Client → host envelope. */
@@ -313,6 +313,10 @@ export interface RpcMap {
         payload: undefined;
         value: SubscriptionStatus;
     };
+    'deepseek-balance': {
+        payload: DeepSeekBalanceRequest;
+        value: DeepSeekBalanceResult;
+    };
     'ccswitch-balance': {
         payload: CcSwitchBalanceRequest;
         value: CcSwitchBalanceResult;
@@ -343,10 +347,36 @@ export type BalanceResult =
  | {
     ok: false;
 };
+/** Payload of `deepseek-balance`. */
+export interface DeepSeekBalanceRequest {
+    /** Client metadata the host's account service expects. */
+    version?: string;
+    locale?: string;
+    timezoneOffsetSeconds?: number;
+}
+/** One currency's wallet, as the host's account service reports it. */
+export interface DeepSeekWallet {
+    /** ISO currency the balance is denominated in. */
+    currency: string;
+    /** Remaining balance, as a decimal string. */
+    balance: string;
+}
+/**
+ * Result of `deepseek-balance`.
+ *
+ * `undefined` means the account is signed out or the read failed, so a chip stays
+ * silent rather than showing a wrong figure.
+ */
+export type DeepSeekBalanceResult = {
+    /** Normal (topped-up) wallets, one per currency. */
+    wallets: readonly DeepSeekWallet[];
+    /** Bonus / promotional wallets, one per currency. */
+    bonusWallets: readonly DeepSeekWallet[];
+} | undefined;
 /** Payload of `ccswitch-balance`. */
 export interface CcSwitchBalanceRequest {
-    /** The credential reference the provider's profile names (its apiKeyEnv). */
-    credentialRef: string;
+    /** The provider whose balance to read; the server maps it to its credential reference. */
+    provider: string;
 }
 /**
  * Result of `ccswitch-balance`.

package/lib/protocol.js

@@ -26,5 +26,6 @@ export const RPC_ENDPOINTS = [
     'removeModel',
     'usage',
     'reload',
+    'deepseek-balance',
     'ccswitch-balance',
 ];

package/lib/providers/kimi.js

@@ -14,6 +14,7 @@ import { idleWatchdog, httpLlmError, isMissingOrInvalidCredential, mapFetchFailu
 import { streamProviderResponses } from './responses-stream.js';
 import { fallbackEntry, findEntry, resolveCatalog } from './catalog.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
+import { moonshotToolParameters } from '../translate/moonshot-schema.js';
 /**
  * Coerce one decoded credential entry into a Kimi session.
  * @param value - decoded JSON value for one account.
@@ -310,7 +311,7 @@ export class KimiAdapter extends LlmAdapter {
             input: resolved.input,
             ...options.tools === undefined || options.tools.length === 0
                 ? {}
-                : { tools: toResponsesTools(options.tools), tool_choice: 'auto', parallel_tool_calls: true },
+                : { tools: toResponsesTools(options.tools, moonshotToolParameters), tool_choice: 'auto', parallel_tool_calls: true },
             ...options.maxTokens === undefined ? {} : { max_output_tokens: options.maxTokens },
             ...options.reasoningEffort === undefined
                 ? {}

package/lib/translate/moonshot-schema.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Tool-schema preparation for the Moonshot wire (Kimi Code).
+ *
+ * Moonshot validates `tools[].function.parameters` with its own JSON-Schema
+ * reader, and that reader cannot settle a `$ref` that carries sibling
+ * keywords: instead of intersecting the two, it re-expands the node, so the
+ * whole request is refused with
+ * `detected infinite recursion without termination condition`. The harness
+ * forwards tool schemas exactly as their owner declared them, and the MCP
+ * tools REA registers use that shape heavily —
+ * `{"$ref": "#/$defs/__schema12", "description": "..."}` — 153 of 170 tools
+ * carried at least one such node, and the first one Moonshot reached killed
+ * every Kimi request that included a tool.
+ *
+ * A `$ref` that stands alone is accepted, and so is keeping `$defs` for it, so
+ * only the offending nodes are rewritten: the referenced schema is inlined
+ * under the node's own keywords (JSON Schema 2020-12 applies both, and the
+ * node's own keywords win on a conflict), which leaves the wire schema with
+ * standalone references only. Resolution is bounded by the reference stack, so
+ * a real cycle ends by dropping the `$ref` and keeping the sibling keywords
+ * rather than recursing.
+ *
+ * @module dsh-plugin-subscription-oauth/translate/moonshot-schema
+ */
+/**
+ * Prepare one tool's parameters for Moonshot.
+ *
+ * @param parameters - the tool's declared argument schema.
+ * @returns a detached schema whose `$ref` nodes carry no sibling keywords.
+ */
+export declare function moonshotToolParameters(parameters: Record<string, unknown>): Record<string, unknown>;

package/lib/translate/moonshot-schema.js

@@ -0,0 +1,81 @@
+/**
+ * Tool-schema preparation for the Moonshot wire (Kimi Code).
+ *
+ * Moonshot validates `tools[].function.parameters` with its own JSON-Schema
+ * reader, and that reader cannot settle a `$ref` that carries sibling
+ * keywords: instead of intersecting the two, it re-expands the node, so the
+ * whole request is refused with
+ * `detected infinite recursion without termination condition`. The harness
+ * forwards tool schemas exactly as their owner declared them, and the MCP
+ * tools REA registers use that shape heavily —
+ * `{"$ref": "#/$defs/__schema12", "description": "..."}` — 153 of 170 tools
+ * carried at least one such node, and the first one Moonshot reached killed
+ * every Kimi request that included a tool.
+ *
+ * A `$ref` that stands alone is accepted, and so is keeping `$defs` for it, so
+ * only the offending nodes are rewritten: the referenced schema is inlined
+ * under the node's own keywords (JSON Schema 2020-12 applies both, and the
+ * node's own keywords win on a conflict), which leaves the wire schema with
+ * standalone references only. Resolution is bounded by the reference stack, so
+ * a real cycle ends by dropping the `$ref` and keeping the sibling keywords
+ * rather than recursing.
+ *
+ * @module dsh-plugin-subscription-oauth/translate/moonshot-schema
+ */
+/** True for a plain object usable as a schema node. */
+function object(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Follow one local JSON pointer, or undefined when it does not resolve. */
+function pointed(root, ref) {
+    if (!ref.startsWith('#/'))
+        return undefined;
+    let node = root;
+    for (const segment of ref.slice(2).split('/')) {
+        const key = segment.replaceAll('~1', '/').replaceAll('~0', '~');
+        if (Array.isArray(node))
+            node = node[Number(key)];
+        else if (object(node) && Object.hasOwn(node, key))
+            node = node[key];
+        else
+            return undefined;
+    }
+    return node;
+}
+/**
+ * Rewrite one node so every `$ref` left on the wire stands alone.
+ *
+ * @param node - the node to rewrite.
+ * @param root - the tool's root schema, which local pointers resolve against.
+ * @param refs - pointers already being resolved on the path to this node.
+ * @returns the rewritten node.
+ */
+function inline(node, root, refs) {
+    if (Array.isArray(node))
+        return node.map((item) => inline(item, root, refs));
+    if (!object(node))
+        return node;
+    const { $ref, ...siblings } = node;
+    if (typeof $ref !== 'string') {
+        return Object.fromEntries(Object.entries(node).map(([key, value]) => [key, inline(value, root, refs)]));
+    }
+    // A standalone reference is exactly what Moonshot expects, so it stays as is
+    // and keeps its `$defs` entry.
+    if (Object.keys(siblings).length === 0)
+        return { $ref };
+    // A repeated pointer, or one that is not a local object, cannot be inlined:
+    // the sibling keywords are all that is left to terminate on.
+    const target = refs.has($ref) ? undefined : pointed(root, $ref);
+    return object(target)
+        ? inline({ ...target, ...siblings }, root, new Set([...refs, $ref]))
+        : inline(siblings, root, refs);
+}
+/**
+ * Prepare one tool's parameters for Moonshot.
+ *
+ * @param parameters - the tool's declared argument schema.
+ * @returns a detached schema whose `$ref` nodes carry no sibling keywords.
+ */
+export function moonshotToolParameters(parameters) {
+    return inline(parameters, parameters, new Set());
+}

package/lib/translate/responses.d.ts

@@ -53,9 +53,11 @@ export declare function toResponsesInput(messages: readonly RequestMessage[], sy
  * than letting the endpoint normalize every schema into strict mode.
  *
  * @param tools - the request's tool schemas.
+ * @param prepare - an endpoint-specific rewrite of one parameters schema, for
+ * a route whose JSON-Schema reader refuses the schema as declared.
  * @returns `tools` array entries.
  */
-export declare function toResponsesTools(tools: readonly ToolSchema[]): Record<string, unknown>[];
+export declare function toResponsesTools(tools: readonly ToolSchema[], prepare?: (parameters: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown>[];
 /** The `usage` object of a completed response. */
 export interface ResponsesUsage {
     input_tokens?: number;

package/lib/translate/responses.js

@@ -124,14 +124,16 @@ export async function toResponsesInput(messages, system, resolveImage) {
  * than letting the endpoint normalize every schema into strict mode.
  *
  * @param tools - the request's tool schemas.
+ * @param prepare - an endpoint-specific rewrite of one parameters schema, for
+ * a route whose JSON-Schema reader refuses the schema as declared.
  * @returns `tools` array entries.
  */
-export function toResponsesTools(tools) {
+export function toResponsesTools(tools, prepare) {
     return tools.map((tool) => ({
         type: 'function',
         name: tool.name,
         description: tool.description,
-        parameters: tool.parameters,
+        parameters: prepare === undefined ? tool.parameters : prepare(tool.parameters),
         strict: false,
     }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",