dsh-plugin-subscription-oauth 0.8.18 → 0.10.0

package/lib/auth/workbuddy-flow.js

@@ -0,0 +1,265 @@
+/**
+ * WorkBuddy China's sign-in and token handling.
+ *
+ * A WorkBuddy account signs in in the browser (Tencent's page, polled for the
+ * token as WorkBuddy's desktop app does). Chats are chat completions at
+ * `<endpoint>/v2`, streamed only, and the API answers `{code, msg, data}` where a
+ * non-zero code is an error. Adapted from magpie's `workbuddy` for this plugin's
+ * typed flow/store contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/workbuddy-flow
+ */
+/** WorkBuddy China build's endpoints. */
+export const WORKBUDDY_ENDPOINT = 'https://copilot.tencent.com';
+export const WORKBUDDY_PLATFORM = 'workbuddy';
+/** The version the sign-in page is opened with. */
+export const WORKBUDDY_APP_VERSION = '2.0.0';
+/** The User-Agent version the chat API accepts; another is refused (10085). */
+export const WORKBUDDY_UA_VERSION = '5.5.6';
+/** A token this close to its end is refreshed before a request. */
+export const WORKBUDDY_EARLY_MS = 60_000;
+/** A sign-in attempt is abandoned after this long. */
+export const WORKBUDDY_SIGN_IN_MS = 5 * 60 * 1000;
+const POLL_MS = 1000;
+/** Validate one stored value as a WorkBuddy session, or undefined when it is not one. */
+export function parseWorkBuddySession(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    if (typeof record.accessToken !== 'string' || record.accessToken.length === 0)
+        return undefined;
+    if (typeof record.expiresAt !== 'number')
+        return undefined;
+    return {
+        accessToken: record.accessToken,
+        expiresAt: record.expiresAt,
+        ...typeof record.refreshToken === 'string' ? { refreshToken: record.refreshToken } : {},
+        ...typeof record.accountId === 'string' ? { accountId: record.accountId } : {},
+        ...typeof record.email === 'string' ? { email: record.email } : {},
+        ...typeof record.uid === 'string' ? { uid: record.uid } : {},
+        ...typeof record.enterpriseId === 'string' ? { enterpriseId: record.enterpriseId } : {},
+        ...typeof record.domain === 'string' ? { domain: record.domain } : {},
+        ...typeof record.tokenType === 'string' ? { tokenType: record.tokenType } : {},
+        ...typeof record.refreshExpiresAt === 'number' ? { refreshExpiresAt: record.refreshExpiresAt } : {},
+    };
+}
+/** A WorkBuddy API failure, carrying the wire code and magpie's phrasing. */
+export class WBError extends Error {
+    code;
+    status;
+    said;
+    constructor(message, code, status, said) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.said = said;
+    }
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The chat completions endpoint for the China build. */
+export const workbuddyApi = (endpoint) => `${endpoint}/v2`;
+/**
+ * Make one request of WorkBuddy's plugin API, which answers `{code, msg, data}`.
+ * A non-zero `code`, or a non-2xx status, is an error.
+ *
+ * @param endpoint - the site base, e.g. `https://copilot.tencent.com`.
+ * @param method - HTTP method.
+ * @param path - path beneath the base.
+ * @param headers - extra headers.
+ * @param body - JSON body, when present.
+ * @param fetchFn - fetch implementation.
+ * @returns the response's `data`.
+ */
+export async function workbuddyCall(endpoint, method, path, headers, body, fetchFn) {
+    const response = await fetchFn(endpoint + path, {
+        method,
+        headers: {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+            'User-Agent': `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+            ...headers,
+        },
+        ...body === undefined ? {} : { body: JSON.stringify(body) },
+        signal: AbortSignal.timeout(30_000),
+    });
+    const text = await response.text();
+    let env = {};
+    try {
+        env = JSON.parse(text);
+    }
+    catch {
+        env = {};
+    }
+    const code = Number.parseInt(String(env.code ?? ''), 10) || 0;
+    if (!response.ok) {
+        const why = String(env.msg ?? env.message ?? (isRecord(env.error) ? env.error.message : '') ?? '').trim() ||
+            text.slice(0, 200) || response.statusText;
+        const said = code ? String(env.msg ?? `error ${code}`) : String(env.msg ?? `${response.status}`);
+        throw new WBError(`WorkBuddy: ${why} (HTTP ${response.status}${env.code ? `, code ${String(env.code)}` : ''})`, env.code, response.status, said);
+    }
+    if (code !== 0) {
+        throw new WBError(`WorkBuddy: ${String(env.msg ?? 'error')} (${String(env.code)})`, env.code, response.status, String(env.msg ?? `error ${code}`));
+    }
+    return env.data;
+}
+/** Start a browser sign-in: the page URL to open, and the state to poll for the token. */
+export async function startWorkBuddySignIn(fetchFn) {
+    const data = await workbuddyCall(WORKBUDDY_ENDPOINT, 'POST', `/v2/plugin/auth/state?platform=${encodeURIComponent(WORKBUDDY_PLATFORM)}`, {
+        'X-No-Authorization': 'true',
+        'X-No-User-Id': 'true',
+        'X-No-Enterprise-Id': 'true',
+        'X-No-Department-Info': 'true',
+    }, {}, fetchFn);
+    if (!isRecord(data) || typeof data.state !== 'string' || typeof data.authUrl !== 'string') {
+        throw new Error('WorkBuddy gave no sign-in page');
+    }
+    const url = new URL(data.authUrl);
+    if (url.protocol !== 'https:')
+        throw new Error("WorkBuddy's sign-in page isn't https");
+    url.searchParams.set('version', WORKBUDDY_APP_VERSION);
+    url.searchParams.set('loginSessionId', randomHex());
+    return { state: data.state, url: url.toString(), expiresAt: Date.now() + WORKBUDDY_SIGN_IN_MS };
+}
+const randomHex = () => {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+};
+/** Ask a path until it answers data, retrying the codes that mean "not yet". */
+async function workbuddyPoll(path, headers, retry, deadline, fetchFn) {
+    for (;;) {
+        if (Date.now() > deadline)
+            throw new Error('WorkBuddy sign-in timed out');
+        try {
+            const data = await workbuddyCall(WORKBUDDY_ENDPOINT, 'GET', path, headers, undefined, fetchFn);
+            if (isRecord(data) && Object.keys(data).length > 0)
+                return data;
+        }
+        catch (error) {
+            if (!(error instanceof WBError && (retry.includes(Number(error.code)) || error.status === 408 || error.status === 429))) {
+                throw error;
+            }
+        }
+        await sleep(POLL_MS);
+    }
+}
+/** Merge a token WorkBuddy gave into the stored sign-in's fields. */
+export function mergeWorkBuddyToken(base, got) {
+    const now = Date.now();
+    const out = { ...base, accessToken: String(got.accessToken ?? '') };
+    if (typeof got.refreshToken === 'string' && got.refreshToken !== '')
+        out.refreshToken = got.refreshToken;
+    if (typeof got.domain === 'string' && got.domain !== '')
+        out.domain = got.domain;
+    if (typeof got.tokenType === 'string' && got.tokenType !== '')
+        out.tokenType = got.tokenType;
+    const expiresAt = Number(got.expiresAt);
+    const expiresIn = Number(got.expiresIn);
+    if (expiresAt > 0)
+        out.expiresAt = expiresAt;
+    else if (expiresIn > 0)
+        out.expiresAt = now + expiresIn * 1000;
+    const refreshExpiresAt = Number(got.refreshExpiresAt);
+    const refreshExpiresIn = Number(got.refreshExpiresIn);
+    if (refreshExpiresAt > 0)
+        out.refreshExpiresAt = refreshExpiresAt;
+    else if (refreshExpiresIn > 0)
+        out.refreshExpiresAt = now + refreshExpiresIn * 1000;
+    return out;
+}
+/** Poll for the token a finished browser sign-in produced. */
+export async function finishWorkBuddySignIn(start, fetchFn) {
+    const deadline = start.expiresAt;
+    const query = encodeURIComponent(start.state);
+    const tokenData = await workbuddyPoll(`/v2/plugin/auth/token?state=${query}`, {}, [11217], deadline, fetchFn);
+    if (typeof tokenData.accessToken !== 'string' || tokenData.accessToken === '') {
+        throw new Error('WorkBuddy sent back no token');
+    }
+    const token = mergeWorkBuddyToken({ accessToken: '', expiresAt: 0 }, tokenData);
+    const who = await workbuddyPoll(`/v2/plugin/login/account?state=${query}`, {
+        'Authorization': `Bearer ${token.accessToken}`,
+        'X-Domain': workbuddyDomain(token),
+        'X-No-User-Id': 'true',
+        'X-No-Enterprise-Id': 'true',
+    }, [12151], deadline, fetchFn);
+    token.uid = typeof who.uid === 'string' ? who.uid : '';
+    token.enterpriseId = await workbuddyEnterprise(token, who, fetchFn);
+    const name = String(who.nickname ?? who.phoneNumber ?? who.uid ?? '');
+    return { token, name };
+}
+/** The domain a token names, else the API host. */
+export function workbuddyDomain(token) {
+    return token.domain || new URL(workbuddyApi(WORKBUDDY_ENDPOINT)).host;
+}
+/** The enterprise an account signed in as, when it isn't a personal account. */
+async function workbuddyEnterprise(token, who, fetchFn) {
+    const own = typeof who.enterpriseId === 'string' ? who.enterpriseId.trim() : '';
+    if (own)
+        return own;
+    const type = String(who.type ?? '').trim().toLowerCase();
+    if (type === '' || type === 'personal')
+        return '';
+    let list;
+    try {
+        list = await workbuddyCall(WORKBUDDY_ENDPOINT, 'GET', '/v2/plugin/accounts', { 'Authorization': `Bearer ${token.accessToken}`, 'X-Domain': workbuddyDomain(token) }, undefined, fetchFn);
+    }
+    catch {
+        return '';
+    }
+    const accounts = isRecord(list) && Array.isArray(list.accounts) ? list.accounts.filter(isRecord) : [];
+    const mine = accounts.filter((entry) => entry.uid === who.uid && typeof entry.enterpriseId === 'string' && entry.enterpriseId.trim() !== '');
+    const same = mine.filter((entry) => String(entry.type ?? '').trim().toLowerCase() === type);
+    const last = mine.filter((entry) => entry.lastLogin);
+    const pick = same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : undefined;
+    return pick && typeof pick.enterpriseId === 'string' ? pick.enterpriseId.trim() : '';
+}
+/** The headers WorkBuddy's desktop app sends with a chat and its account. */
+export function workbuddyHeaders(token) {
+    const headers = {
+        'Authorization': `Bearer ${token.accessToken}`,
+        'X-User-Id': token.uid ?? '',
+        'X-Domain': workbuddyDomain(token),
+        'X-Product': 'SaaS',
+        'X-IDE-Type': 'WorkBuddy',
+        'User-Agent': `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+        'X-Requested-With': 'XMLHttpRequest',
+        'X-Agent-Intent': 'craft',
+        'X-Agent-Purpose': 'conversation',
+        'X-IDE-Name': 'WorkBuddy',
+        'X-IDE-Version': WORKBUDDY_UA_VERSION,
+    };
+    const enterprise = typeof token.enterpriseId === 'string' ? token.enterpriseId.trim() : '';
+    if (enterprise !== '') {
+        headers['X-Enterprise-Id'] = enterprise;
+        headers['X-Tenant-Id'] = enterprise;
+    }
+    return headers;
+}
+/** Whether a token is close enough to its end that a request should refresh it. */
+export function workbuddyStale(token) {
+    return token.expiresAt > 0 && Date.now() >= token.expiresAt - WORKBUDDY_EARLY_MS;
+}
+/** Whether a token can still be refreshed. */
+export function workbuddyRefreshable(token) {
+    if (typeof token.refreshToken !== 'string' || token.refreshToken === '')
+        return false;
+    return !(token.refreshExpiresAt !== undefined && Date.now() >= token.refreshExpiresAt);
+}
+/** Spend a refresh token for a new access token. */
+export async function refreshWorkBuddyToken(token, fetchFn) {
+    const data = await workbuddyCall(WORKBUDDY_ENDPOINT, 'POST', '/v2/plugin/auth/token/refresh', {
+        'X-Refresh-Token': token.refreshToken ?? '',
+        'X-Auth-Refresh-Source': 'plugin',
+        'X-Domain': workbuddyDomain(token),
+        ...workbuddyEnterpriseHeaders(token),
+    }, {}, fetchFn);
+    if (!isRecord(data) || typeof data.accessToken !== 'string' || data.accessToken === '') {
+        throw new Error('WorkBuddy gave no refreshed token');
+    }
+    return mergeWorkBuddyToken(token, data);
+}
+function workbuddyEnterpriseHeaders(token) {
+    const enterprise = typeof token.enterpriseId === 'string' ? token.enterpriseId.trim() : '';
+    return enterprise === '' ? {} : { 'X-Enterprise-Id': enterprise, 'X-Tenant-Id': enterprise };
+}

package/lib/index.d.ts

@@ -16,9 +16,9 @@ export declare const name = "dsh-plugin-subscription-oauth";
 /** The provider routes need the LLM runtime; everything else is optional. */
 export declare const inject: string[];
 /** Every route key this plugin accepts in configuration. */
-export declare const PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark"];
+export declare const PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo", "workbuddy"];
 /** The routes this build can actually register. */
-export declare const IMPLEMENTED_PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark"];
+export declare const IMPLEMENTED_PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo", "workbuddy"];
 /** One route key. */
 export type ProviderId = typeof PROVIDER_IDS[number];
 /** Plugin configuration, as accepted from `cordis.patch.yml`. */

package/lib/index.js

@@ -22,15 +22,17 @@ import { createGrokProvider } from './providers/grok.js';
 import { createKimiProvider } from './providers/kimi-provider.js';
 import { createGlmProvider } from './providers/glm-provider.js';
 import { createArkProvider } from './providers/ark-provider.js';
+import { createMimoProvider } from './providers/mimo-provider.js';
+import { createWorkBuddyProvider } from './providers/workbuddy-provider.js';
 import { ModelPreferences } from './settings.js';
 /** Plugin id; also the name every effect label and log line is prefixed with. */
 export const name = 'dsh-plugin-subscription-oauth';
 /** The provider routes need the LLM runtime; everything else is optional. */
 export const inject = ['llm'];
 /** Every route key this plugin accepts in configuration. */
-export const PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark'];
+export const PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo', 'workbuddy'];
 /** The routes this build can actually register. */
-export const IMPLEMENTED_PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark'];
+export const IMPLEMENTED_PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo', 'workbuddy'];
 /** Configuration schema, with the config file's own defaults applied. */
 export const Config = z.object({
     providers: z.array(z.union([...PROVIDER_IDS])).default([...IMPLEMENTED_PROVIDER_IDS]),
@@ -138,6 +140,27 @@ export function apply(ctx, config = {}) {
                     fetchFn: proxiedFetch,
                 }));
                 break;
+            case 'mimo':
+                routes.push(createMimoProvider({
+                    credentialFile,
+                    streamIdleTimeoutMs,
+                    preferences,
+                    resolveAttachments: () => ctx.get('attachments'),
+                    onCatalogChanged: () => { reannounce('mimo'); },
+                    onWarn,
+                    fetchFn: proxiedFetch,
+                }));
+                break;
+            case 'workbuddy':
+                routes.push(createWorkBuddyProvider({
+                    credentialFile,
+                    streamIdleTimeoutMs,
+                    preferences,
+                    onCatalogChanged: () => { reannounce('workbuddy'); },
+                    onWarn,
+                    fetchFn: proxiedFetch,
+                }));
+                break;
             default:
                 // A configured route with no module yet must not silently disappear.
                 onWarn(`provider ${id} is configured but not implemented in this build`);

package/lib/providers/mimo-provider.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `mimo` provider route's wiring: credential store, Xiaomi QR/password
+ * login, model catalog, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo-provider
+ */
+import type { ProviderRoute } from '../auth/registry.js';
+import type { ModelPreferences } from '../settings.js';
+import type { FetchFn } from '../http.js';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+/** Everything the MiMo route needs from the plugin configuration. */
+export interface MimoProviderOptions {
+    /** Absolute path of `auth.json`. */
+    credentialFile: string;
+    /** Abandon a stream after this much silence. */
+    streamIdleTimeoutMs: number;
+    /** Model the picker preselects. */
+    defaultModel?: string;
+    /** Shared model-visibility preferences. */
+    preferences: ModelPreferences;
+    /** Resolve the attachment service per request. */
+    resolveAttachments?: () => AttachmentStore | undefined;
+    /** Invoked when the catalog or its visibility changed. */
+    onCatalogChanged?: () => void;
+    onWarn?: (message: string) => void;
+    /** Fetch implementation; defaults to the proxy-aware fetch. */
+    fetchFn?: FetchFn;
+}
+/**
+ * Build the `mimo` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved endpoints, paths, and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export declare function createMimoProvider(options: MimoProviderOptions): ProviderRoute;

package/lib/providers/mimo-provider.js

@@ -0,0 +1,170 @@
+/**
+ * The `mimo` provider route's wiring: credential store, Xiaomi QR/password
+ * login, model catalog, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo-provider
+ */
+import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
+import { TokenStore } from '../auth/store.js';
+import { TokenManager } from '../auth/tokens.js';
+import { LOGIN_CANCELLED_MESSAGE } from '../auth/device-flow.js';
+import { finishMimoSignIn, mimoCredentialsFrom, refreshMimoSession, startMimoSignIn, waitMimoPoll, } from '../auth/mimo-flow.js';
+import { MimoAdapter, MIMO_CODE_URL, MIMO_CONTEXT_WINDOW, MIMO_DEFAULT_MODEL, MIMO_MODELS, MIMO_PROVIDER_ID, MIMO_PROVIDER_NAME, parseMimoSession, } from './mimo.js';
+import { ProviderController } from '../auth/provider-controller.js';
+import { proxiedFetch } from '../http.js';
+/** Wait, honouring cancellation. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+        }
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Build the `mimo` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved endpoints, paths, and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export function createMimoProvider(options) {
+    const fetchFn = options.fetchFn ?? proxiedFetch;
+    const store = new TokenStore(options.credentialFile, MIMO_PROVIDER_ID, parseMimoSession);
+    const toSession = (creds, cookies, userId) => ({
+        accessToken: JSON.stringify(cookies),
+        expiresAt: Date.now() + 24 * 60 * 60 * 1000,
+        accountId: userId,
+        apiBase: creds.base,
+        mimoCreds: JSON.stringify(creds),
+        mimoCookies: JSON.stringify(cookies),
+        region: creds.region,
+    });
+    /** The in-flight attempt, so `pending()` is stable across calls. */
+    let current;
+    const flow = {
+        async start() {
+            const start = await startMimoSignIn(fetchFn);
+            const controller = new AbortController();
+            const session = (async () => {
+                while (true) {
+                    if (controller.signal.aborted)
+                        throw new Error(LOGIN_CANCELLED_MESSAGE);
+                    const poll = await waitMimoPoll(start, fetchFn);
+                    if (poll !== undefined) {
+                        const { creds, cookies } = await finishMimoSignIn(poll, start.device, fetchFn);
+                        return toSession(creds, cookies, creds.userId);
+                    }
+                    await sleep(1000, controller.signal);
+                }
+            })();
+            const attempt = {
+                prompt: {
+                    url: start.url,
+                    expiresAt: start.until,
+                    mode: 'open-url',
+                },
+                session,
+                cancel: () => { controller.abort(); },
+            };
+            current = attempt;
+            void session.catch(() => undefined).finally(() => {
+                if (current === attempt)
+                    current = undefined;
+            });
+            return attempt;
+        },
+        pending() {
+            return current;
+        },
+    };
+    const tokens = new TokenManager({
+        store,
+        displayName: MIMO_PROVIDER_NAME,
+        // The app signs on again after a day; renew a little ahead of that.
+        preemptMs: 10 * 60 * 1000,
+        refresh: async (session) => {
+            let creds;
+            try {
+                creds = JSON.parse(session.mimoCreds);
+            }
+            catch {
+                throw new ProviderError(`${MIMO_PROVIDER_NAME} sign-in has expired; connect the account again`, REAUTH_REQUIRED);
+            }
+            try {
+                const renewed = await refreshMimoSession(creds, fetchFn);
+                return { accessToken: JSON.stringify(renewed.cookies), expiresAt: renewed.expiresAt };
+            }
+            catch (error) {
+                if (error instanceof Error && /lapsed/i.test(error.message)) {
+                    throw new ProviderError(`${MIMO_PROVIDER_NAME} sign-in has expired; connect the account again`, REAUTH_REQUIRED);
+                }
+                throw error;
+            }
+        },
+    });
+    const adapter = new MimoAdapter({
+        streamIdleTimeoutMs: options.streamIdleTimeoutMs,
+        tokens,
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+        ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
+        hiddenModels: () => options.preferences.hiddenIds(MIMO_PROVIDER_ID),
+        userModels: () => options.preferences.extraIds(MIMO_PROVIDER_ID),
+        fetchFn,
+    });
+    const spec = {
+        id: MIMO_PROVIDER_ID,
+        displayName: MIMO_PROVIDER_NAME,
+        codeUrl: MIMO_CODE_URL,
+        credentialFile: options.credentialFile,
+        // MiMo ships a fixed two-model catalog; there is no discovery endpoint.
+        discovery: false,
+        defaultModel: options.defaultModel ?? MIMO_DEFAULT_MODEL,
+        catalog: () => adapter.catalogEntries(),
+        catalogOwn: () => adapter.ownCatalogEntries(),
+        fallbackContextWindow: MIMO_CONTEXT_WINDOW,
+        discover: () => Promise.resolve(undefined),
+        usage: () => Promise.resolve({ windows: [] }),
+        details: () => [
+            { key: 'provider', value: MIMO_PROVIDER_NAME },
+            { key: 'credentialFile', value: options.credentialFile },
+        ],
+        applyDiscovery: () => { },
+    };
+    const controller = new ProviderController({
+        spec,
+        store,
+        tokens,
+        flow,
+        preferences: options.preferences,
+        ...options.onCatalogChanged === undefined ? {} : { onCatalogChanged: options.onCatalogChanged },
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+    });
+    return {
+        id: controller.id,
+        displayName: controller.displayName,
+        credentialFile: controller.credentialFile,
+        adapter,
+        status: () => controller.status(),
+        login: (account) => controller.login(account),
+        cancel: () => controller.cancel(),
+        logout: (account) => controller.logout(account),
+        setDefault: (account) => controller.setDefault(account),
+        refresh: (account) => controller.refresh(account),
+        discover: (force) => controller.discover(force),
+        setModelVisible: (id, visible) => controller.setModelVisible(id, visible),
+        setModelOrder: (ids) => controller.setModelOrder(ids),
+        addModel: (id) => controller.addModel(id),
+        removeModel: (id) => controller.removeModel(id),
+        usage: (force) => controller.usage(force),
+        reload: () => controller.reload(),
+    };
+}

package/lib/providers/mimo.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The Xiaomi MiMo wire adapter serving the `mimo` route.
+ *
+ * Model requests are chat completions at the MiMo server's `/route`, carrying the
+ * session cookies the sign-on set — not a bearer token. Two models ship: MiMo Pro
+ * and MiMo Flash. The open platform's Token Plan spends its own `tp-` key at a
+ * separate endpoint; that fallback lives beside the account-level stream here.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo
+ */
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmProviderInfo, type LlmResolvedModelInfo, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { type FetchFn } from '../http.js';
+import type { TokenManager } from '../auth/tokens.js';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+/** The `mimo` provider route key. */
+export declare const MIMO_PROVIDER_ID = "mimo";
+/** Human name for the route and its cards. */
+export declare const MIMO_PROVIDER_NAME = "Xiaomi MiMo";
+/** Where the Settings page sends someone to get an account. */
+export declare const MIMO_CODE_URL = "https://platform.xiaomimimo.com";
+/** MiMo context window shared by Pro and Flash. */
+export declare const MIMO_CONTEXT_WINDOW = 1000000;
+/** The output ceiling MiMo advertises. */
+export declare const MIMO_DEFAULT_MAX_TOKENS = 128000;
+/** The model the picker preselects. */
+export declare const MIMO_DEFAULT_MODEL = "mimo-pro";
+/** One signed-in MiMo account, as stored. */
+export interface MimoSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    accountId?: string;
+    email?: string;
+    /** The MiMo server base this account signs on at. */
+    apiBase: string;
+    /** The durable Xiaomi credential (JSON), used to re-sign-on. */
+    mimoCreds: string;
+    /** The live session cookies (JSON), sent as the Cookie header. */
+    mimoCookies: string;
+    /** The account's region. */
+    region?: string;
+}
+/** Validate one stored value as a MiMo session, or undefined when it is not one. */
+export declare function parseMimoSession(value: unknown): MimoSession | undefined;
+/** One catalog row. */
+interface MimoModelEntry {
+    id: string;
+    name: string;
+    description: string;
+    contextWindow: number;
+}
+/** The two models the MiMo app serves. */
+export declare const MIMO_MODELS: readonly MimoModelEntry[];
+/** Constructor dependencies for {@link MimoAdapter}. */
+export interface MimoAdapterOptions {
+    /** MiMo server base; `<base>/route/chat/completions` is the endpoint. */
+    apiBase?: string;
+    streamIdleTimeoutMs: number;
+    tokens: TokenManager<MimoSession>;
+    onWarn?: (message: string) => void;
+    resolveAttachments?: () => AttachmentStore | undefined;
+    hiddenModels?: () => Promise<ReadonlySet<string>>;
+    userModels?: () => Promise<readonly string[]>;
+    fetchFn?: FetchFn;
+}
+/** The MiMo wire adapter serving the `mimo` route. */
+export declare class MimoAdapter extends LlmAdapter {
+    private readonly options;
+    private readonly fetchFn;
+    constructor(options: MimoAdapterOptions);
+    providerInfo(provider: string): LlmProviderInfo;
+    listModels(_provider: string): Promise<readonly LlmModelInfo[]>;
+    private hidden;
+    resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    providerRetryPolicy(): undefined;
+    /** The catalog the Settings list reads: every shipped model. */
+    catalogEntries(): readonly {
+        id: string;
+        name: string;
+        contextWindow: number;
+    }[];
+    /** The ids the route itself serves, without hand-added extras. */
+    ownCatalogEntries(): readonly MimoModelEntry[];
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /**
+     * The session cookies as one Cookie header, in a steady order.
+     *
+     * MiMo is a cookie session, not a bearer: the wire credential is the cookie
+     * header built from the stored session's cookie record.
+     */
+    private cookieHeader;
+    private requestBody;
+    private toChatMessage;
+    private readStream;
+}
+export {};