dsh-plugin-subscription-oauth 0.5.0 → 0.6.1

package/lib/index.d.ts

@@ -44,6 +44,18 @@ export interface Config {
      * the other routes. Defaults to true.
      */
     auto?: boolean;
+    /**
+     * The credential reference a non-subscription provider's balance query uses, by
+     * provider id.
+     *
+     * A provider that is not a subscription this plugin serves has no usage windows to
+     * meter, so the chip shows its balance instead — read by cc-switch's query, which needs
+     * the provider's API key. The provider's profile names that key by reference
+     * (`apiKeyEnv`), and the host's credential service resolves the name; this map is the
+     * one place a provider id is tied to that reference. A provider with no entry, or
+     * whose key does not resolve, gets no balance and the chip stays silent.
+     */
+    balanceCredentialRefs?: Record<string, string>;
 }
 /** Configuration schema, with the config file's own defaults applied. */
 export declare const Config: z<Config>;

package/lib/index.js

@@ -188,7 +188,39 @@ export function apply(ctx, config = {}) {
         handles.set(route.id, handle);
         ctx.effect(() => () => handle(), `${name}: ${route.id} provider route`);
     }
-    registerSubscriptionRpc(ctx, registry);
+    // A non-subscription provider's balance is read by cc-switch's query, which needs the
+    // provider's API key. The provider's profile names that key by reference (`apiKeyEnv`),
+    // and the configured map ties a provider id to that reference; the host's credential
+    // service resolves it. The map lives in server config because that is where the rest
+    // of the plugin's wiring is, and the client learns a provider's balance by id, never
+    // by its credential reference.
+    const credentialRefs = config.balanceCredentialRefs ?? {};
+    // The DeepSeek account's balance is read on the node half through the host's
+    // `deepseekAccount` service; the browser reaches it through the plugin's own RPC, the
+    // same channel as the rest of the chip's data. The service is read lazily, per request
+    // (not once in apply), because it may register after this plugin applies; a composition
+    // without it still serves every other endpoint, and the balance endpoint answers nothing.
+    const balanceContext = {
+        credentialRefs,
+        resolveDeepSeekAccount: () => {
+            try {
+                return ctx.get('deepseekAccount');
+            }
+            catch {
+                return undefined;
+            }
+        },
+        resolveCredential: async (ref) => {
+            try {
+                const credentials = ctx.get('credentials');
+                return (await credentials?.resolve?.(ref))?.value;
+            }
+            catch {
+                return undefined;
+            }
+        },
+    };
+    registerSubscriptionRpc(ctx, registry, balanceContext);
     // Warm each route's live catalog for an install that is already signed in.
     for (const id of registry.ids()) {
         void registry.discover(id, false).catch((error) => {

package/lib/protocol.d.ts

@@ -12,7 +12,7 @@
 /** Prefix of every RPC method this plugin serves. */
 export declare const RPC_PREFIX = "subscription-oauth.";
 /** Endpoints the Settings page may call. */
-export declare const RPC_ENDPOINTS: readonly ["status", "login", "cancel", "logout", "setDefault", "refresh", "discover", "setModelVisible", "setModelOrder", "addModel", "removeModel", "usage", "reload", "ccswitch-balance"];
+export declare const RPC_ENDPOINTS: readonly ["status", "login", "cancel", "logout", "setDefault", "refresh", "discover", "setModelVisible", "setModelOrder", "addModel", "removeModel", "usage", "reload", "deepseek-balance", "ccswitch-balance"];
 /** One endpoint name. */
 export type RpcEndpoint = typeof RPC_ENDPOINTS[number];
 /** Client → host envelope. */
@@ -313,6 +313,10 @@ export interface RpcMap {
         payload: undefined;
         value: SubscriptionStatus;
     };
+    'deepseek-balance': {
+        payload: DeepSeekBalanceRequest;
+        value: DeepSeekBalanceResult;
+    };
     'ccswitch-balance': {
         payload: CcSwitchBalanceRequest;
         value: CcSwitchBalanceResult;
@@ -343,10 +347,36 @@ export type BalanceResult =
  | {
     ok: false;
 };
+/** Payload of `deepseek-balance`. */
+export interface DeepSeekBalanceRequest {
+    /** Client metadata the host's account service expects. */
+    version?: string;
+    locale?: string;
+    timezoneOffsetSeconds?: number;
+}
+/** One currency's wallet, as the host's account service reports it. */
+export interface DeepSeekWallet {
+    /** ISO currency the balance is denominated in. */
+    currency: string;
+    /** Remaining balance, as a decimal string. */
+    balance: string;
+}
+/**
+ * Result of `deepseek-balance`.
+ *
+ * `undefined` means the account is signed out or the read failed, so a chip stays
+ * silent rather than showing a wrong figure.
+ */
+export type DeepSeekBalanceResult = {
+    /** Normal (topped-up) wallets, one per currency. */
+    wallets: readonly DeepSeekWallet[];
+    /** Bonus / promotional wallets, one per currency. */
+    bonusWallets: readonly DeepSeekWallet[];
+} | undefined;
 /** Payload of `ccswitch-balance`. */
 export interface CcSwitchBalanceRequest {
-    /** The credential reference the provider's profile names (its apiKeyEnv). */
-    credentialRef: string;
+    /** The provider whose balance to read; the server maps it to its credential reference. */
+    provider: string;
 }
 /**
  * Result of `ccswitch-balance`.

package/lib/protocol.js

@@ -26,5 +26,6 @@ export const RPC_ENDPOINTS = [
     'removeModel',
     'usage',
     'reload',
+    'deepseek-balance',
     'ccswitch-balance',
 ];

package/lib/providers/kimi.d.ts

@@ -95,7 +95,15 @@ export declare class KimiAdapter extends LlmAdapter {
     private discovered;
     /** Ids the user added by hand, cached so the sync catalog can name them. */
     private userAddedIds;
+    /** Tools already reported as flattened, so each is stated once. */
+    private readonly flattenedTools;
     constructor(options: KimiAdapterOptions);
+    /**
+     * Tool schemas in the shape Moonshot accepts: no `$ref`, and under its size
+     * ceiling. A declaration too large to send keeps its arguments, and that is
+     * reported once per tool rather than on every turn.
+     */
+    private moonshotTools;
     providerInfo(provider: string): LlmProviderInfo;
     providerRetryPolicy(): undefined;
     listModels(_provider: string): Promise<readonly LlmModelInfo[]>;

package/lib/providers/kimi.js

@@ -14,6 +14,7 @@ import { idleWatchdog, httpLlmError, isMissingOrInvalidCredential, mapFetchFailu
 import { streamProviderResponses } from './responses-stream.js';
 import { fallbackEntry, findEntry, resolveCatalog } from './catalog.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
+import { prepareMoonshotTool } from '../translate/moonshot-schema.js';
 /**
  * Coerce one decoded credential entry into a Kimi session.
  * @param value - decoded JSON value for one account.
@@ -130,10 +131,31 @@ export class KimiAdapter extends LlmAdapter {
     discovered;
     /** Ids the user added by hand, cached so the sync catalog can name them. */
     userAddedIds = [];
+    /** Tools already reported as flattened, so each is stated once. */
+    flattenedTools = new Set();
     constructor(options) {
         super();
         this.options = options;
     }
+    /**
+     * Tool schemas in the shape Moonshot accepts: no `$ref`, and under its size
+     * ceiling. A declaration too large to send keeps its arguments, and that is
+     * reported once per tool rather than on every turn.
+     */
+    moonshotTools(tools) {
+        return tools.map((tool) => {
+            const prepared = prepareMoonshotTool(tool.parameters);
+            if (prepared.preparedAs !== 'as-declared' && !this.flattenedTools.has(tool.name)) {
+                this.flattenedTools.add(tool.name);
+                this.options.onWarn?.(prepared.preparedAs === 'flattened'
+                    ? `kimi: ${tool.name} declares an argument schema larger than the endpoint accepts; `
+                        + 'its arguments are described without their nested structure'
+                    : `kimi: ${tool.name} declares an argument schema larger than the endpoint accepts; `
+                        + 'it is offered as an unrestricted object');
+            }
+            return { ...tool, parameters: prepared.parameters };
+        });
+    }
     providerInfo(provider) {
         return { id: provider, name: KIMI_PROVIDER_NAME };
     }
@@ -310,7 +332,11 @@ export class KimiAdapter extends LlmAdapter {
             input: resolved.input,
             ...options.tools === undefined || options.tools.length === 0
                 ? {}
-                : { tools: toResponsesTools(options.tools), tool_choice: 'auto', parallel_tool_calls: true },
+                : {
+                    tools: toResponsesTools(this.moonshotTools(options.tools)),
+                    tool_choice: 'auto',
+                    parallel_tool_calls: true,
+                },
             ...options.maxTokens === undefined ? {} : { max_output_tokens: options.maxTokens },
             ...options.reasoningEffort === undefined
                 ? {}

package/lib/translate/moonshot-schema.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Tool-schema preparation for the Moonshot wire (Kimi Code).
+ *
+ * Moonshot validates `tools[].function.parameters` with its own reader, and
+ * that reader expands every `$ref` before it measures or checks the schema. The
+ * harness forwards each tool's schema exactly as its owner declared it, and
+ * every MCP tool REA registers holds its shapes in a `$defs` block that its
+ * properties reference, so Kimi refused the whole request with
+ * `tools.function.parameters is not a valid moonshot flavored json schema`.
+ *
+ * Live probes against `api.kimi.com` measured both edges of that reader:
+ *
+ * - a `$ref` whose target itself holds `$ref`s is refused as
+ *   `detected infinite recursion without termination condition` — the failing
+ *   tool reported the node `properties.actions` and, once that node was
+ *   inlined so its reference stood alone, the deeper `properties.actions.items`.
+ *   A one-level reference is accepted; a chain is not.
+ * - the expanded schema has a size ceiling between 80,081 B (accepted) and
+ *   124,389 B (refused). `compare_web_captures` declares 57,175 B of shared
+ *   definitions but expands past 153,000 B, so it was refused even as declared.
+ *
+ * So this module sends no references at all — every local pointer is replaced
+ * by the definition it names, and the document keywords that only existed to
+ * hold them (`$defs`, `$schema`, `$id`, `definitions`) are dropped. A pointer
+ * that re-enters itself cannot be inlined, and there the referencing node keeps
+ * its own keywords instead of recursing. A tool whose expanded schema still
+ * exceeds the ceiling is flattened in steps — the arguments with their prose,
+ * then the arguments alone, then an unrestricted object — so that one oversized
+ * tool costs its own detail rather than the whole request.
+ *
+ * @module dsh-plugin-subscription-oauth/translate/moonshot-schema
+ */
+/** How much of a declaration a schema too large to send had to give up. */
+export type MoonshotPreparation = 
+/** Sent as declared, with its references inlined. */
+'as-declared'
+/** Only the arguments: names, types, choices, `required`, and prose while it fits. */
+ | 'flattened'
+/** An unrestricted object, because even the arguments did not fit. */
+ | 'permissive';
+/** One prepared tool schema together with what had to be done to it. */
+export interface MoonshotToolSchema {
+    /** The schema to send. */
+    parameters: Record<string, unknown>;
+    /** What the declaration had to give up to fit. */
+    preparedAs: MoonshotPreparation;
+}
+/**
+ * Prepare one tool's parameters for Moonshot.
+ *
+ * @param parameters - the tool's declared argument schema.
+ * @returns the schema to send and what it had to give up to fit the endpoint.
+ */
+export declare function prepareMoonshotTool(parameters: Record<string, unknown>): MoonshotToolSchema;

package/lib/translate/moonshot-schema.js

@@ -0,0 +1,142 @@
+/**
+ * Tool-schema preparation for the Moonshot wire (Kimi Code).
+ *
+ * Moonshot validates `tools[].function.parameters` with its own reader, and
+ * that reader expands every `$ref` before it measures or checks the schema. The
+ * harness forwards each tool's schema exactly as its owner declared it, and
+ * every MCP tool REA registers holds its shapes in a `$defs` block that its
+ * properties reference, so Kimi refused the whole request with
+ * `tools.function.parameters is not a valid moonshot flavored json schema`.
+ *
+ * Live probes against `api.kimi.com` measured both edges of that reader:
+ *
+ * - a `$ref` whose target itself holds `$ref`s is refused as
+ *   `detected infinite recursion without termination condition` — the failing
+ *   tool reported the node `properties.actions` and, once that node was
+ *   inlined so its reference stood alone, the deeper `properties.actions.items`.
+ *   A one-level reference is accepted; a chain is not.
+ * - the expanded schema has a size ceiling between 80,081 B (accepted) and
+ *   124,389 B (refused). `compare_web_captures` declares 57,175 B of shared
+ *   definitions but expands past 153,000 B, so it was refused even as declared.
+ *
+ * So this module sends no references at all — every local pointer is replaced
+ * by the definition it names, and the document keywords that only existed to
+ * hold them (`$defs`, `$schema`, `$id`, `definitions`) are dropped. A pointer
+ * that re-enters itself cannot be inlined, and there the referencing node keeps
+ * its own keywords instead of recursing. A tool whose expanded schema still
+ * exceeds the ceiling is flattened in steps — the arguments with their prose,
+ * then the arguments alone, then an unrestricted object — so that one oversized
+ * tool costs its own detail rather than the whole request.
+ *
+ * @module dsh-plugin-subscription-oauth/translate/moonshot-schema
+ */
+/** Keywords that describe the schema document rather than the values it accepts. */
+const DOCUMENT_KEYS = new Set(['$schema', '$id', '$defs', 'definitions']);
+/** Root keywords a flattened schema keeps. */
+const ROOT_KEYS = ['type', 'description', 'required', 'additionalProperties', 'minProperties', 'maxProperties'];
+/**
+ * Largest expanded schema the endpoint is asked to take, in bytes.
+ *
+ * Measured rather than assumed: 80,081 B was accepted and 124,389 B was refused
+ * with `At path 'root': schema exceeds maximum allowed size`. This sits below
+ * both so a schema this plugin sends has room to spare.
+ */
+const SIZE_BUDGET = 64 * 1024;
+/** True for a plain object usable as a schema node. */
+function object(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Follow one local JSON pointer, or undefined when it does not resolve. */
+function pointed(root, ref) {
+    if (!ref.startsWith('#/'))
+        return undefined;
+    let node = root;
+    for (const segment of ref.slice(2).split('/')) {
+        const key = segment.replaceAll('~1', '/').replaceAll('~0', '~');
+        if (Array.isArray(node))
+            node = node[Number(key)];
+        else if (object(node) && Object.hasOwn(node, key))
+            node = node[key];
+        else
+            return undefined;
+    }
+    return node;
+}
+/**
+ * Replace every reference reachable from one node with what it names.
+ *
+ * @param node - the node to rewrite.
+ * @param root - the tool's root schema, which local pointers resolve against.
+ * @param refs - pointers already being resolved on the path to this node.
+ * @returns the rewritten node.
+ */
+function inline(node, root, refs) {
+    if (Array.isArray(node))
+        return node.map((item) => inline(item, root, refs));
+    if (!object(node))
+        return node;
+    const { $ref, ...siblings } = node;
+    if (typeof $ref === 'string') {
+        // A repeated pointer, or one that names nothing local, cannot be inlined:
+        // the node's own keywords are all that is left.
+        const target = refs.has($ref) ? undefined : pointed(root, $ref);
+        return object(target)
+            ? inline({ ...target, ...siblings }, root, new Set([...refs, $ref]))
+            : inline(siblings, root, refs);
+    }
+    return Object.fromEntries(Object.entries(node)
+        .filter(([key]) => !DOCUMENT_KEYS.has(key))
+        .map(([key, value]) => [key, inline(value, root, refs)]));
+}
+/**
+ * Keep only what a model needs to call the tool: the root's own keywords, and
+ * each argument's name, type, value choices and — while the budget allows —
+ * its description.
+ *
+ * @param schema - an already inlined schema.
+ * @param prose - whether descriptions are worth their bytes.
+ * @returns the flattened schema.
+ */
+function flatten(schema, prose) {
+    const out = {};
+    for (const key of ROOT_KEYS) {
+        if (Object.hasOwn(schema, key) && (prose || key !== 'description'))
+            out[key] = schema[key];
+    }
+    if (!object(schema.properties))
+        return out;
+    out.properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
+        const node = object(property) ? property : {};
+        const reduced = {};
+        if (typeof node.type === 'string')
+            reduced.type = node.type;
+        if (Array.isArray(node.enum))
+            reduced.enum = node.enum;
+        if (prose && typeof node.description === 'string')
+            reduced.description = node.description;
+        return [name, reduced];
+    }));
+    return out;
+}
+/** Bytes the endpoint measures once it has expanded every reference. */
+function expandedBytes(schema) {
+    return Buffer.byteLength(JSON.stringify(schema));
+}
+/**
+ * Prepare one tool's parameters for Moonshot.
+ *
+ * @param parameters - the tool's declared argument schema.
+ * @returns the schema to send and what it had to give up to fit the endpoint.
+ */
+export function prepareMoonshotTool(parameters) {
+    const inlined = inline(parameters, parameters, new Set());
+    if (expandedBytes(inlined) <= SIZE_BUDGET)
+        return { parameters: inlined, preparedAs: 'as-declared' };
+    const documented = flatten(inlined, true);
+    if (expandedBytes(documented) <= SIZE_BUDGET)
+        return { parameters: documented, preparedAs: 'flattened' };
+    const bare = flatten(inlined, false);
+    if (expandedBytes(bare) <= SIZE_BUDGET)
+        return { parameters: bare, preparedAs: 'flattened' };
+    return { parameters: { type: 'object', additionalProperties: true }, preparedAs: 'permissive' };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",