dsh-plugin-subscription-oauth 0.8.18 → 0.10.0

package/lib/providers/mimo.js

@@ -0,0 +1,260 @@
+/**
+ * The Xiaomi MiMo wire adapter serving the `mimo` route.
+ *
+ * Model requests are chat completions at the MiMo server's `/route`, carrying the
+ * session cookies the sign-on set — not a bearer token. Two models ship: MiMo Pro
+ * and MiMo Flash. The open platform's Token Plan spends its own `tp-` key at a
+ * separate endpoint; that fallback lives beside the account-level stream here.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo
+ */
+import { LlmAdapter, errorChain, } from '@deepseek-ai/dsh-llm';
+import { httpLlmError, isMissingOrInvalidCredential, mapFetchFailure, idleWatchdog } from './common.js';
+import { proxiedFetch } from '../http.js';
+import { refreshMimoSession } from '../auth/mimo-flow.js';
+/** The `mimo` provider route key. */
+export const MIMO_PROVIDER_ID = 'mimo';
+/** Human name for the route and its cards. */
+export const MIMO_PROVIDER_NAME = 'Xiaomi MiMo';
+/** Where the Settings page sends someone to get an account. */
+export const MIMO_CODE_URL = 'https://platform.xiaomimimo.com';
+/** MiMo context window shared by Pro and Flash. */
+export const MIMO_CONTEXT_WINDOW = 1_000_000;
+/** The output ceiling MiMo advertises. */
+export const MIMO_DEFAULT_MAX_TOKENS = 128_000;
+/** The model the picker preselects. */
+export const MIMO_DEFAULT_MODEL = 'mimo-pro';
+/** Validate one stored value as a MiMo session, or undefined when it is not one. */
+export function parseMimoSession(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    if (typeof record.accessToken !== 'string' || record.accessToken.length === 0)
+        return undefined;
+    if (typeof record.expiresAt !== 'number')
+        return undefined;
+    if (typeof record.apiBase !== 'string' || record.apiBase.length === 0)
+        return undefined;
+    if (typeof record.mimoCreds !== 'string')
+        return undefined;
+    if (typeof record.mimoCookies !== 'string')
+        return undefined;
+    return {
+        accessToken: record.accessToken,
+        expiresAt: record.expiresAt,
+        apiBase: record.apiBase,
+        mimoCreds: record.mimoCreds,
+        mimoCookies: record.mimoCookies,
+        ...typeof record.refreshToken === 'string' ? { refreshToken: record.refreshToken } : {},
+        ...typeof record.accountId === 'string' ? { accountId: record.accountId } : {},
+        ...typeof record.email === 'string' ? { email: record.email } : {},
+        ...typeof record.region === 'string' ? { region: record.region } : {},
+    };
+}
+/** The two models the MiMo app serves. */
+export const MIMO_MODELS = [
+    { id: 'mimo-pro', name: 'MiMo Pro', description: 'Flagship MiMo model', contextWindow: MIMO_CONTEXT_WINDOW },
+    { id: 'mimo-flash', name: 'MiMo Flash', description: 'Fast MiMo model', contextWindow: MIMO_CONTEXT_WINDOW },
+];
+/** The MiMo wire adapter serving the `mimo` route. */
+export class MimoAdapter extends LlmAdapter {
+    options;
+    fetchFn;
+    constructor(options) {
+        super();
+        this.options = options;
+        this.fetchFn = options.fetchFn ?? proxiedFetch;
+    }
+    providerInfo(provider) {
+        return { id: provider, name: MIMO_PROVIDER_NAME };
+    }
+    async listModels(_provider) {
+        if (await this.options.tokens.session() === undefined)
+            return [];
+        const hidden = await this.hidden();
+        return MIMO_MODELS.filter((entry) => !hidden.has(entry.id)).map((entry) => ({
+            provider: MIMO_PROVIDER_ID,
+            id: entry.id,
+            name: entry.name,
+            description: entry.description,
+            inputModalities: ['text', 'image'],
+        }));
+    }
+    async hidden() {
+        if (this.options.hiddenModels === undefined)
+            return new Set();
+        try {
+            return await this.options.hiddenModels();
+        }
+        catch {
+            return new Set();
+        }
+    }
+    async resolveModel(_provider, model) {
+        const entry = MIMO_MODELS.find((candidate) => candidate.id === model);
+        if (entry === undefined) {
+            return {
+                provider: MIMO_PROVIDER_ID,
+                id: model,
+                name: model,
+                context: { contextWindow: MIMO_CONTEXT_WINDOW },
+                defaultMaxTokens: MIMO_DEFAULT_MAX_TOKENS,
+                inputModalities: ['text', 'image'],
+            };
+        }
+        return {
+            provider: MIMO_PROVIDER_ID,
+            id: entry.id,
+            name: entry.name,
+            description: entry.description,
+            context: { contextWindow: entry.contextWindow },
+            defaultMaxTokens: MIMO_DEFAULT_MAX_TOKENS,
+            inputModalities: ['text', 'image'],
+        };
+    }
+    providerRetryPolicy() {
+        return undefined;
+    }
+    /** The catalog the Settings list reads: every shipped model. */
+    catalogEntries() {
+        return MIMO_MODELS;
+    }
+    /** The ids the route itself serves, without hand-added extras. */
+    ownCatalogEntries() {
+        return MIMO_MODELS;
+    }
+    async *stream(options) {
+        const held = await this.options.tokens.session();
+        if (held === undefined)
+            throw await httpLlmError(new Response(null, { status: 401 }), 'Xiaomi MiMo');
+        const session = held.session;
+        const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+        try {
+            const cookies = this.cookieHeader(session);
+            const body = this.requestBody(options);
+            const response = await this.fetchFn(`${session.apiBase.replace(/\/+$/, '')}/route/chat/completions`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Accept': 'text/event-stream',
+                    'Cookie': cookies,
+                    'X-Mimo-Source': 'mimocode-cli-free',
+                    'User-Agent': 'miNative PC/Normal Windows_NT/10.0.26100 SDKV/1.0.0 DEVT/PC DEVS/Windows APP/miaccount_desktop APPV/0.1.0',
+                    'X-Client-Version': '26.929.292248',
+                },
+                body: JSON.stringify(body),
+                signal: watchdog.signal,
+            });
+            if (!response.ok || response.body === null) {
+                throw await httpLlmError(response, 'Xiaomi MiMo');
+            }
+            yield* this.readStream(response, watchdog);
+        }
+        catch (error) {
+            throw mapFetchFailure('Xiaomi MiMo', error, watchdog, options.signal);
+        }
+        finally {
+            watchdog.stop();
+        }
+    }
+    /**
+     * The session cookies as one Cookie header, in a steady order.
+     *
+     * MiMo is a cookie session, not a bearer: the wire credential is the cookie
+     * header built from the stored session's cookie record.
+     */
+    cookieHeader(session) {
+        const first = ['serviceToken', 'userId', 'cUserId'];
+        try {
+            const cookies = JSON.parse(session.mimoCookies);
+            const parts = first.filter((key) => key in cookies).map((key) => `${key}=${cookies[key]}`);
+            for (const [key, value] of Object.entries(cookies)) {
+                if (!first.includes(key))
+                    parts.push(`${key}=${value}`);
+            }
+            return parts.join('; ');
+        }
+        catch {
+            return '';
+        }
+    }
+    requestBody(options) {
+        const messages = [];
+        if (options.system !== undefined && options.system.trim() !== '') {
+            messages.push({ role: 'system', content: options.system });
+        }
+        for (const message of options.messages) {
+            messages.push(this.toChatMessage(message));
+        }
+        return {
+            model: options.model,
+            messages,
+            ...options.maxTokens === undefined ? {} : { max_tokens: options.maxTokens },
+            stream: true,
+        };
+    }
+    toChatMessage(message) {
+        const role = message.role === 'assistant' ? 'assistant' : 'user';
+        const textParts = [];
+        for (const block of message.content) {
+            if (block.type === 'text')
+                textParts.push(block.text);
+        }
+        return { role, content: textParts.join('\n') };
+    }
+    async *readStream(response, watchdog) {
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let started = false;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                watchdog.pulse();
+                buffer += decoder.decode(value, { stream: true });
+                const frames = buffer.split('\n\n');
+                buffer = frames.pop() ?? '';
+                for (const frame of frames) {
+                    const data = frame
+                        .split('\n')
+                        .filter((line) => line.startsWith('data:'))
+                        .map((line) => line.slice(5).trim())
+                        .join('\n');
+                    if (data === '' || data === '[DONE]')
+                        continue;
+                    let chunk;
+                    try {
+                        chunk = JSON.parse(data);
+                    }
+                    catch {
+                        continue;
+                    }
+                    const delta = chunk.choices?.[0]?.delta?.content;
+                    if (typeof delta === 'string' && delta !== '') {
+                        if (!started) {
+                            yield { type: 'block-start', index: 0, blockType: 'text' };
+                            started = true;
+                        }
+                        yield { type: 'text-delta', index: 0, text: delta };
+                    }
+                    if (chunk.usage !== undefined) {
+                        const input = chunk.usage.prompt_tokens ?? 0;
+                        const output = chunk.usage.completion_tokens ?? 0;
+                        yield {
+                            type: 'usage',
+                            usage: { inputTokens: input, outputTokens: output, totalTokens: chunk.usage.total_tokens ?? input + output },
+                        };
+                    }
+                }
+            }
+            if (started)
+                yield { type: 'block-end', index: 0, block: { type: 'text', text: '' } };
+            yield { type: 'finish', reason: { kind: 'stop' } };
+        }
+        finally {
+            reader.cancel().catch(() => { });
+        }
+    }
+}

package/lib/providers/workbuddy-provider.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The `workbuddy` provider route's wiring (WorkBuddy China build):
+ * credential store, browser sign-in, token refresh, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy-provider
+ */
+import type { ProviderRoute } from '../auth/registry.js';
+import type { ModelPreferences } from '../settings.js';
+import type { FetchFn } from '../http.js';
+/** Everything the WorkBuddy route needs from the plugin configuration. */
+export interface WorkBuddyProviderOptions {
+    /** Absolute path of `auth.json`. */
+    credentialFile: string;
+    /** Abandon a stream after this much silence. */
+    streamIdleTimeoutMs: number;
+    /** Model the picker preselects. */
+    defaultModel?: string;
+    /** Shared model-visibility preferences. */
+    preferences: ModelPreferences;
+    /** Invoked when the catalog or its visibility changed. */
+    onCatalogChanged?: () => void;
+    onWarn?: (message: string) => void;
+    /** Fetch implementation; defaults to the proxy-aware fetch. */
+    fetchFn?: FetchFn;
+}
+/**
+ * Build the `workbuddy` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved paths and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export declare function createWorkBuddyProvider(options: WorkBuddyProviderOptions): ProviderRoute;

package/lib/providers/workbuddy-provider.js

@@ -0,0 +1,181 @@
+/**
+ * The `workbuddy` provider route's wiring (WorkBuddy China build):
+ * credential store, browser sign-in, token refresh, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy-provider
+ */
+import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
+import { TokenStore } from '../auth/store.js';
+import { TokenManager } from '../auth/tokens.js';
+import { LOGIN_CANCELLED_MESSAGE } from '../auth/device-flow.js';
+import { finishWorkBuddySignIn, parseWorkBuddySession, refreshWorkBuddyToken, startWorkBuddySignIn, workbuddyRefreshable, workbuddyStale, WORKBUDDY_EARLY_MS, } from '../auth/workbuddy-flow.js';
+import { WorkBuddyAdapter, WORKBUDDY_CODE_URL, WORKBUDDY_CATALOG, WORKBUDDY_DEFAULT_MODEL, WORKBUDDY_PROVIDER_ID, WORKBUDDY_PROVIDER_NAME, } from './workbuddy.js';
+import { ProviderController } from '../auth/provider-controller.js';
+import { proxiedFetch } from '../http.js';
+/** Wait, honouring cancellation. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+        }
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Build the `workbuddy` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved paths and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export function createWorkBuddyProvider(options) {
+    const fetchFn = options.fetchFn ?? proxiedFetch;
+    const store = new TokenStore(options.credentialFile, WORKBUDDY_PROVIDER_ID, parseWorkBuddySession);
+    const toSession = (token, name) => ({
+        accessToken: token.accessToken,
+        expiresAt: token.expiresAt,
+        ...token.refreshToken === undefined ? {} : { refreshToken: token.refreshToken },
+        ...name === '' ? {} : { accountId: name },
+        ...token.uid === undefined ? {} : { uid: token.uid },
+        ...token.enterpriseId === undefined ? {} : { enterpriseId: token.enterpriseId },
+        ...token.domain === undefined ? {} : { domain: token.domain },
+        ...token.tokenType === undefined ? {} : { tokenType: token.tokenType },
+        ...token.refreshExpiresAt === undefined ? {} : { refreshExpiresAt: token.refreshExpiresAt },
+    });
+    /** The in-flight attempt, so `pending()` is stable across calls. */
+    let current;
+    const flow = {
+        async start() {
+            const start = await startWorkBuddySignIn(fetchFn);
+            const controller = new AbortController();
+            const session = (async () => {
+                while (true) {
+                    if (controller.signal.aborted)
+                        throw new Error(LOGIN_CANCELLED_MESSAGE);
+                    try {
+                        const { token, name } = await finishWorkBuddySignIn(start, fetchFn);
+                        return toSession(token, name);
+                    }
+                    catch (error) {
+                        if (controller.signal.aborted)
+                            throw new Error(LOGIN_CANCELLED_MESSAGE);
+                        // A "not yet" poll answer is normal; anything else fails the attempt.
+                        if (error instanceof Error && /timed out/i.test(error.message))
+                            throw error;
+                        throw error;
+                    }
+                }
+            })();
+            const attempt = {
+                prompt: {
+                    url: start.url,
+                    expiresAt: start.expiresAt,
+                    mode: 'open-url',
+                },
+                session,
+                cancel: () => { controller.abort(); },
+            };
+            current = attempt;
+            void session.catch(() => undefined).finally(() => {
+                if (current === attempt)
+                    current = undefined;
+            });
+            return attempt;
+        },
+        pending() {
+            return current;
+        },
+    };
+    const tokens = new TokenManager({
+        store,
+        displayName: WORKBUDDY_PROVIDER_NAME,
+        // Refresh a minute before the hour runs out, as the app does.
+        preemptMs: WORKBUDDY_EARLY_MS,
+        refresh: async (session) => {
+            const token = {
+                accessToken: session.accessToken,
+                expiresAt: session.expiresAt,
+                ...session.refreshToken === undefined ? {} : { refreshToken: session.refreshToken },
+                ...session.uid === undefined ? {} : { uid: session.uid },
+                ...session.enterpriseId === undefined ? {} : { enterpriseId: session.enterpriseId },
+                ...session.domain === undefined ? {} : { domain: session.domain },
+                ...session.tokenType === undefined ? {} : { tokenType: session.tokenType },
+                ...session.refreshExpiresAt === undefined ? {} : { refreshExpiresAt: session.refreshExpiresAt },
+            };
+            if (!workbuddyRefreshable(token)) {
+                throw new ProviderError(`${WORKBUDDY_PROVIDER_NAME} sign-in has expired; connect the account again`, REAUTH_REQUIRED);
+            }
+            try {
+                const renewed = await refreshWorkBuddyToken(token, fetchFn);
+                return { accessToken: renewed.accessToken, expiresAt: renewed.expiresAt };
+            }
+            catch (error) {
+                throw new ProviderError(`${WORKBUDDY_PROVIDER_NAME} token refresh failed: ${error instanceof Error ? error.message : String(error)}`, REAUTH_REQUIRED);
+            }
+        },
+    });
+    const adapter = new WorkBuddyAdapter({
+        streamIdleTimeoutMs: options.streamIdleTimeoutMs,
+        tokens,
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+        hiddenModels: () => options.preferences.hiddenIds(WORKBUDDY_PROVIDER_ID),
+        userModels: () => options.preferences.extraIds(WORKBUDDY_PROVIDER_ID),
+        fetchFn,
+    });
+    const spec = {
+        id: WORKBUDDY_PROVIDER_ID,
+        displayName: WORKBUDDY_PROVIDER_NAME,
+        codeUrl: WORKBUDDY_CODE_URL,
+        credentialFile: options.credentialFile,
+        // WorkBuddy ships a fixed catalog; there is no discovery endpoint.
+        discovery: false,
+        defaultModel: options.defaultModel ?? WORKBUDDY_DEFAULT_MODEL,
+        catalog: () => adapter.catalogEntries(),
+        catalogOwn: () => adapter.ownCatalogEntries(),
+        fallbackContextWindow: WORKBUDDY_CATALOG[0]?.contextWindow ?? 0,
+        discover: () => Promise.resolve(undefined),
+        usage: () => Promise.resolve({ windows: [] }),
+        details: () => [
+            { key: 'provider', value: WORKBUDDY_PROVIDER_NAME },
+            { key: 'endpoint', value: 'https://copilot.tencent.com' },
+            { key: 'credentialFile', value: options.credentialFile },
+        ],
+        applyDiscovery: () => { },
+    };
+    const controller = new ProviderController({
+        spec,
+        store,
+        tokens,
+        flow,
+        preferences: options.preferences,
+        ...options.onCatalogChanged === undefined ? {} : { onCatalogChanged: options.onCatalogChanged },
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+    });
+    return {
+        id: controller.id,
+        displayName: controller.displayName,
+        credentialFile: controller.credentialFile,
+        adapter,
+        status: () => controller.status(),
+        login: (account) => controller.login(account),
+        cancel: () => controller.cancel(),
+        logout: (account) => controller.logout(account),
+        setDefault: (account) => controller.setDefault(account),
+        refresh: (account) => controller.refresh(account),
+        discover: (force) => controller.discover(force),
+        setModelVisible: (id, visible) => controller.setModelVisible(id, visible),
+        setModelOrder: (ids) => controller.setModelOrder(ids),
+        addModel: (id) => controller.addModel(id),
+        removeModel: (id) => controller.removeModel(id),
+        usage: (force) => controller.usage(force),
+        reload: () => controller.reload(),
+    };
+}

package/lib/providers/workbuddy.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The WorkBuddy China wire adapter serving the `workbuddy` route.
+ *
+ * WorkBuddy chats are chat completions at `https://copilot.tencent.com/v2/chat/completions`,
+ * streamed only, and the API refuses a request whose User-Agent is not
+ * `WorkBuddy/<version>`. The route ships the China build's catalog (Hy, GLM, Kimi,
+ * DeepSeek, MiniMax). Adapted from magpie's `workbuddy` for this plugin's contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy
+ */
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmProviderInfo, type LlmResolvedModelInfo, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { type FetchFn } from '../http.js';
+import type { TokenManager } from '../auth/tokens.js';
+import type { CatalogEntry } from './catalog.js';
+import { type WorkBuddySession } from '../auth/workbuddy-flow.js';
+/** The `workbuddy` provider route key (China build). */
+export declare const WORKBUDDY_PROVIDER_ID = "workbuddy";
+/** Human name for the route and its cards. */
+export declare const WORKBUDDY_PROVIDER_NAME = "WorkBuddy";
+/** Where the Settings page sends someone to get an account. */
+export declare const WORKBUDDY_CODE_URL = "https://copilot.tencent.com";
+/** The model the picker preselects. */
+export declare const WORKBUDDY_DEFAULT_MODEL = "hy4-preview-f";
+/** One signed-in WorkBuddy session, as stored. */
+export interface WorkBuddyStored {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    accountId?: string;
+    email?: string;
+    uid?: string;
+    enterpriseId?: string;
+    domain?: string;
+    tokenType?: string;
+    refreshExpiresAt?: number;
+}
+/** The catalog the route serves. */
+export declare const WORKBUDDY_CATALOG: readonly CatalogEntry[];
+/** Constructor dependencies for {@link WorkBuddyAdapter}. */
+export interface WorkBuddyAdapterOptions {
+    streamIdleTimeoutMs: number;
+    tokens: TokenManager<WorkBuddySession>;
+    onWarn?: (message: string) => void;
+    hiddenModels?: () => Promise<ReadonlySet<string>>;
+    userModels?: () => Promise<readonly string[]>;
+    fetchFn?: FetchFn;
+}
+/** The WorkBuddy China wire adapter serving the `workbuddy` route. */
+export declare class WorkBuddyAdapter extends LlmAdapter {
+    private readonly options;
+    private readonly fetchFn;
+    constructor(options: WorkBuddyAdapterOptions);
+    providerInfo(provider: string): LlmProviderInfo;
+    listModels(_provider: string): Promise<readonly LlmModelInfo[]>;
+    private hidden;
+    /** The catalog the Settings list reads. */
+    catalogEntries(): readonly CatalogEntry[];
+    /** The entries the route itself serves, without hand-added extras. */
+    ownCatalogEntries(): readonly CatalogEntry[];
+    resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    providerRetryPolicy(): undefined;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** The stored session's fields as the token the request signs with. */
+    private tokenOf;
+    private requestBody;
+    private toChatMessage;
+    /** Turn a non-2xx into an LlmError, naming WorkBuddy's specific refusals. */
+    private errorOf;
+    private readStream;
+}