dsh-plugin-subscription-oauth 0.8.18 → 0.9.0

package/lib/auth/mimo-flow.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Xiaomi MiMo's sign-in, as the MiMo desktop app performs it.
+ *
+ * A Xiaomi account signed in on account.xiaomi.com's long-poll page (a QR code
+ * for the Xiaomi phone app, or a password) yields a passToken, which signs the
+ * account on at a MiMo server. The server answers with session cookies, and model
+ * requests are chat completions at the server's `/route` carrying those cookies.
+ *
+ * This module is the sign-in surface only: starting a QR/password attempt on the
+ * account server, waiting for the passToken, exchanging it for a MiMo session,
+ * and refreshing that session before the app would. Adapted from magpie's
+ * `opencode-mimo-auth` for this plugin's typed flow/store contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/mimo-flow
+ */
+/** A MiMo server's regional hosts. */
+export declare const MIMO_HOSTS: {
+    readonly SGP: "https://mimo-server-sgp.xiaomimimo.com/api";
+    readonly RU: "https://mimo-server-ru.xiaomimimimo.com/api";
+    readonly IN: "https://mimo-server-in.xiaomimimo.com/api";
+};
+/** The region this build signs in at by default. */
+export declare const MIMO_REGION = "SGP";
+/** The app signs on again after a day; renew this close to that ahead of time. */
+export declare const MIMO_RENEW_AFTER_MS: number;
+export declare const MIMO_RENEW_LEAD_MS: number;
+/** One cookie, enough for the sign-on's redirects. */
+interface Cookie {
+    name: string;
+    value: string;
+    domain: string;
+    hostOnly: boolean;
+    path: string;
+    secure: boolean;
+    gone?: boolean;
+}
+/** A cookie jar across the sign-on's redirects. */
+export declare class Jar {
+    private cookies;
+    put(cookie: Cookie): void;
+    seed(url: string, name: string, value: string): void;
+    take(response: Response, url: string): void;
+    private for;
+    /** All cookies for one URL, as a single Cookie header value. */
+    header(url: string): string;
+    /** Every cookie for one origin, as a name→value record. */
+    forOrigin(origin: string): Record<string, string>;
+}
+/** The Xiaomi-account credential that signs on at a MiMo server. */
+export interface MimoCredentials {
+    userId: string;
+    cUserId: string;
+    passToken: string;
+    deviceId: string;
+    region: string;
+    base: string;
+}
+/** A signed-on MiMo session: the cookies the server set, plus who signed on. */
+export interface MimoSessionCookies {
+    cookies: Record<string, string>;
+    userId: string;
+}
+/** The Xiaomi sign-in has lapsed and the account must sign in again. */
+export declare class MimoSignInLapsed extends Error {
+}
+/**
+ * Sign the account on at a MiMo server, following the serviceLogin redirects.
+ *
+ * The server's `/user/xiaomi/me`, asked with no session, sends the browser to
+ * account.xiaomi.com's serviceLogin, which (holding the passToken) sends it back
+ * through the server's `/sts`, where the session cookies are set.
+ *
+ * @param creds - the Xiaomi-account credential.
+ * @param base - the MiMo server base for the account's region.
+ * @param fetchFn - fetch implementation.
+ * @returns the session cookies and the server's user id.
+ */
+export declare function mimoSignOn(creds: MimoCredentials, base: string, fetchFn: typeof fetch): Promise<MimoSessionCookies>;
+/** The sid and callback the MiMo server sends a sessionless browser to the account server with. */
+export interface MimoServiceLogin {
+    sid: string;
+    callback: string;
+}
+/** Read the serviceLogin the MiMo server would send a sessionless browser to. */
+export declare function mimoServiceLogin(base: string, fetchFn: typeof fetch): Promise<MimoServiceLogin>;
+/** One started sign-in attempt: the page URL, its long-poll endpoint, and its lifetime. */
+export interface MimoSignInStart {
+    url: string;
+    lp: string;
+    device: string;
+    until: number;
+}
+/** Start a Xiaomi sign-in: the QR/password page URL and its long-poll endpoint. */
+export declare function startMimoSignIn(fetchFn: typeof fetch): Promise<MimoSignInStart>;
+/** Wait for the long poll to report the account signed in; resolves with the poll's fields. */
+export declare function waitMimoPoll(start: MimoSignInStart, fetchFn: typeof fetch): Promise<Record<string, unknown>>;
+/** Build the durable credential from a finished poll and the device it signed on with. */
+export declare function mimoCredentialsFrom(poll: Record<string, unknown>, device: string): MimoCredentials;
+/**
+ * Complete a sign-in: exchange the poll's passToken for a MiMo session, following a
+ * region redirect when the account belongs to another region's server.
+ *
+ * @param poll - the long poll's settled fields.
+ * @param device - the device id the sign-in started with.
+ * @param fetchFn - fetch implementation.
+ * @returns the durable credentials and the session cookies.
+ */
+export declare function finishMimoSignIn(poll: Record<string, unknown>, device: string, fetchFn: typeof fetch): Promise<{
+    creds: MimoCredentials;
+    cookies: Record<string, string>;
+}>;
+/** Refresh: the session is re-signed-on at the MiMo server from the durable credential. */
+export declare function refreshMimoSession(creds: MimoCredentials, fetchFn: typeof fetch): Promise<{
+    cookies: Record<string, string>;
+    expiresAt: number;
+}>;
+export {};

package/lib/auth/mimo-flow.js

@@ -0,0 +1,355 @@
+/**
+ * Xiaomi MiMo's sign-in, as the MiMo desktop app performs it.
+ *
+ * A Xiaomi account signed in on account.xiaomi.com's long-poll page (a QR code
+ * for the Xiaomi phone app, or a password) yields a passToken, which signs the
+ * account on at a MiMo server. The server answers with session cookies, and model
+ * requests are chat completions at the server's `/route` carrying those cookies.
+ *
+ * This module is the sign-in surface only: starting a QR/password attempt on the
+ * account server, waiting for the passToken, exchanging it for a MiMo session,
+ * and refreshing that session before the app would. Adapted from magpie's
+ * `opencode-mimo-auth` for this plugin's typed flow/store contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/mimo-flow
+ */
+import { randomBytes } from 'node:crypto';
+/** A MiMo server's regional hosts. */
+export const MIMO_HOSTS = {
+    SGP: 'https://mimo-server-sgp.xiaomimimo.com/api',
+    RU: 'https://mimo-server-ru.xiaomimimimo.com/api',
+    IN: 'https://mimo-server-in.xiaomimimo.com/api',
+};
+/** The region this build signs in at by default. */
+export const MIMO_REGION = 'SGP';
+const ACCOUNT = 'https://account.xiaomi.com';
+const APP_VERSION = '26.929.292248';
+const SOURCE = 'mimocode-cli-free';
+const USER_AGENT = 'miNative PC/Normal Windows_NT/10.0.26100 SDKV/1.0.0 DEVT/PC DEVS/Windows APP/miaccount_desktop APPV/0.1.0';
+/** The app signs on again after a day; renew this close to that ahead of time. */
+export const MIMO_RENEW_AFTER_MS = 24 * 60 * 60 * 1000;
+export const MIMO_RENEW_LEAD_MS = 10 * 60 * 1000;
+/** A started sign-in page is valid for at most this long. */
+const SIGN_IN_LIFE_MS = 10 * 60 * 1000;
+const deviceId = () => `pc_${randomBytes(16).toString('hex')}`;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The account server's JSON comes after a `&&&START&&&` guard. */
+function accountJSON(text) {
+    try {
+        return JSON.parse(text.trim().replace(/^&&&START&&&/, ''));
+    }
+    catch {
+        return null;
+    }
+}
+/** A record check that does not throw on null/arrays. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** A cookie jar across the sign-on's redirects. */
+export class Jar {
+    cookies = [];
+    put(cookie) {
+        this.cookies = this.cookies.filter((other) => !(other.name === cookie.name && other.domain === cookie.domain && other.path === cookie.path));
+        if (!cookie.gone)
+            this.cookies.push(cookie);
+    }
+    seed(url, name, value) {
+        this.put({
+            name,
+            value,
+            domain: new URL(url).hostname.toLowerCase(),
+            hostOnly: false,
+            path: '/',
+            secure: false,
+        });
+    }
+    take(response, url) {
+        const at = new URL(url);
+        const lines = typeof response.headers.getSetCookie === 'function'
+            ? response.headers.getSetCookie()
+            : [];
+        for (const line of lines) {
+            const [pair, ...attrs] = line.split(';');
+            const eq = pair.indexOf('=');
+            if (eq <= 0)
+                continue;
+            const cookie = {
+                name: pair.slice(0, eq).trim(),
+                value: pair.slice(eq + 1).trim(),
+                domain: at.hostname.toLowerCase(),
+                hostOnly: true,
+                secure: false,
+                path: '/',
+            };
+            const slash = at.pathname.lastIndexOf('/');
+            cookie.path = slash > 0 ? at.pathname.slice(0, slash) : '/';
+            for (const attr of attrs) {
+                const i = attr.indexOf('=');
+                const key = (i < 0 ? attr : attr.slice(0, i)).trim().toLowerCase();
+                const value = i < 0 ? '' : attr.slice(i + 1).trim();
+                if (key === 'domain' && value) {
+                    const domain = value.replace(/^\./, '').toLowerCase();
+                    if (cookie.domain === domain || cookie.domain.endsWith(`.${domain}`)) {
+                        cookie.domain = domain;
+                        cookie.hostOnly = false;
+                    }
+                }
+                else if (key === 'path' && value.startsWith('/')) {
+                    cookie.path = value;
+                }
+                else if (key === 'secure') {
+                    cookie.secure = true;
+                }
+                else if (key === 'max-age' && Number(value) <= 0) {
+                    cookie.gone = true;
+                }
+                else if (key === 'expires' && Date.parse(value) <= Date.now()) {
+                    cookie.gone = true;
+                }
+            }
+            this.put(cookie);
+        }
+    }
+    for(url) {
+        const at = new URL(url);
+        const host = at.hostname.toLowerCase();
+        return this.cookies.filter((cookie) => {
+            if (cookie.secure && at.protocol !== 'https:')
+                return false;
+            const match = cookie.hostOnly
+                ? host === cookie.domain
+                : host === cookie.domain || host.endsWith(`.${cookie.domain}`);
+            if (!match)
+                return false;
+            return (at.pathname === cookie.path ||
+                at.pathname.startsWith(cookie.path.endsWith('/') ? cookie.path : `${cookie.path}/`) ||
+                cookie.path === '/');
+        });
+    }
+    /** All cookies for one URL, as a single Cookie header value. */
+    header(url) {
+        return this.for(url)
+            .map((cookie) => `${cookie.name}=${cookie.value}`)
+            .join('; ');
+    }
+    /** Every cookie for one origin, as a name→value record. */
+    forOrigin(origin) {
+        const out = {};
+        for (const cookie of this.for(origin))
+            out[cookie.name] = cookie.value;
+        return out;
+    }
+}
+/** The Xiaomi sign-in has lapsed and the account must sign in again. */
+export class MimoSignInLapsed extends Error {
+}
+const appHeaders = () => ({
+    'User-Agent': USER_AGENT,
+    'X-Client-Version': APP_VERSION,
+});
+/** Seed a jar with the Xiaomi-account cookies a passToken needs. */
+function seedAccount(jar, creds) {
+    for (const [key, value] of [
+        ['userId', creds.userId],
+        ['passToken', creds.passToken],
+        ['cUserId', creds.cUserId],
+        ['deviceId', creds.deviceId],
+        ['pass_ua', 'pc'],
+        ['uLocale', 'zh_CN'],
+    ]) {
+        if (value)
+            jar.seed(ACCOUNT, key, value);
+    }
+}
+/**
+ * Sign the account on at a MiMo server, following the serviceLogin redirects.
+ *
+ * The server's `/user/xiaomi/me`, asked with no session, sends the browser to
+ * account.xiaomi.com's serviceLogin, which (holding the passToken) sends it back
+ * through the server's `/sts`, where the session cookies are set.
+ *
+ * @param creds - the Xiaomi-account credential.
+ * @param base - the MiMo server base for the account's region.
+ * @param fetchFn - fetch implementation.
+ * @returns the session cookies and the server's user id.
+ */
+export async function mimoSignOn(creds, base, fetchFn) {
+    const jar = new Jar();
+    seedAccount(jar, creds);
+    const baseUrl = new URL(base);
+    let url = base.replace(/\/+$/, '') + '/user/xiaomi/me';
+    let response;
+    for (let hop = 0;; hop++) {
+        if (hop > 10)
+            throw new Error('Xiaomi MiMo sign-in: too many redirects');
+        const headers = appHeaders();
+        const cookie = jar.header(url);
+        if (cookie)
+            headers.Cookie = cookie;
+        try {
+            response = await fetchFn(url, { headers, redirect: 'manual', signal: AbortSignal.timeout(30_000) });
+        }
+        catch (error) {
+            throw new Error(`Xiaomi MiMo sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        jar.take(response, url);
+        const location = response.headers.get('location');
+        if (response.status < 300 || response.status >= 400 || !location)
+            break;
+        await response.arrayBuffer().catch(() => { });
+        const next = new URL(location, url);
+        // The server's followup is written http://; its cookies only go back over https.
+        if (next.protocol === 'http:' && baseUrl.protocol === 'https:' && next.host.toLowerCase() === baseUrl.host.toLowerCase()) {
+            next.protocol = 'https:';
+        }
+        url = next.href;
+    }
+    const text = await response.text();
+    let me;
+    try {
+        me = JSON.parse(text);
+    }
+    catch {
+        // Xiaomi's sign-in page, not the server's answer: the passToken no longer signs on.
+        throw new MimoSignInLapsed('Xiaomi MiMo: the Xiaomi sign-in has lapsed; sign in again');
+    }
+    const body = isRecord(me) ? me : {};
+    if (response.status === 403 || body.code === 403 || body.code === 46109) {
+        throw new Error("Xiaomi MiMo doesn't serve this Xiaomi account (its region isn't served here)");
+    }
+    const data = isRecord(body.data) ? body.data : {};
+    if (body.code !== 0 || String(data.userId ?? '') === '') {
+        throw new MimoSignInLapsed('Xiaomi MiMo: the Xiaomi sign-in has lapsed; sign in again');
+    }
+    const cookies = jar.forOrigin(baseUrl.href);
+    if (Object.keys(cookies).length === 0) {
+        throw new Error('Xiaomi MiMo sign-in: the server set no session');
+    }
+    return { cookies, userId: String(data.userId) };
+}
+/** Read the serviceLogin the MiMo server would send a sessionless browser to. */
+export async function mimoServiceLogin(base, fetchFn) {
+    let sid = 'mimosgp';
+    let callback = base.replace(/\/+$/, '') + '/sts';
+    try {
+        const response = await fetchFn(base.replace(/\/+$/, '') + '/user/xiaomi/me', {
+            headers: appHeaders(),
+            redirect: 'manual',
+            signal: AbortSignal.timeout(15_000),
+        });
+        await response.arrayBuffer().catch(() => { });
+        const location = response.headers.get('location');
+        if (location) {
+            const query = new URL(location, base).searchParams;
+            sid = query.get('sid') || sid;
+            callback = query.get('callback') || callback;
+        }
+    }
+    catch {
+        // The defaults serve the SGP host.
+    }
+    return { sid, callback };
+}
+/** Start a Xiaomi sign-in: the QR/password page URL and its long-poll endpoint. */
+export async function startMimoSignIn(fetchFn) {
+    const base = MIMO_HOSTS[MIMO_REGION];
+    const device = deviceId();
+    const { sid, callback } = await mimoServiceLogin(base, fetchFn);
+    const query = new URLSearchParams({
+        _group: 'DEFAULT',
+        _qrsize: '240',
+        qs: `%3Fsid%3D${encodeURIComponent(sid)}%26_json%3Dtrue`,
+        callback,
+        _hasLogo: 'false',
+        sid,
+        serviceParam: '',
+        _locale: 'en_US',
+    });
+    const response = await fetchFn(`${ACCOUNT}/longPolling/loginUrl?${query}`, {
+        headers: { 'User-Agent': USER_AGENT, Cookie: `deviceId=${device}; pass_ua=pc; uLocale=zh_CN` },
+        signal: AbortSignal.timeout(20_000),
+    });
+    const text = await response.text();
+    const lp = accountJSON(text);
+    if (!isRecord(lp) || lp.code !== 0 || typeof lp.loginUrl !== 'string' || typeof lp.lp !== 'string') {
+        const desc = isRecord(lp) && typeof lp.desc === 'string' ? lp.desc : text.trim().slice(0, 200);
+        throw new Error(`Xiaomi MiMo sign-in: account.xiaomi.com answered ${response.status} ${desc}`);
+    }
+    const timeoutSeconds = typeof lp.timeout === 'number' && lp.timeout > 0 ? lp.timeout : 0;
+    const life = timeoutSeconds > 0 ? Math.min(timeoutSeconds * 1000, SIGN_IN_LIFE_MS) : SIGN_IN_LIFE_MS;
+    return { url: lp.loginUrl, lp: lp.lp, device, until: Date.now() + life };
+}
+/** Wait for the long poll to report the account signed in; resolves with the poll's fields. */
+export async function waitMimoPoll(start, fetchFn) {
+    while (Date.now() < start.until) {
+        try {
+            const left = start.until - Date.now();
+            const response = await fetchFn(start.lp, {
+                headers: { 'User-Agent': USER_AGENT, Cookie: `deviceId=${start.device}; pass_ua=pc; uLocale=zh_CN` },
+                signal: AbortSignal.timeout(Math.min(70_000, Math.max(left, 1))),
+            });
+            const poll = response.status === 200 ? accountJSON(await response.text()) : null;
+            if (isRecord(poll) && typeof poll.passToken === 'string' && String(poll.userId ?? '') !== '') {
+                return poll;
+            }
+        }
+        catch {
+            // Transient long-poll hiccup: keep asking until it expires.
+        }
+        await sleep(1000);
+    }
+    throw new Error('the Xiaomi sign-in page expired before the sign-in finished; start it again');
+}
+/** Build the durable credential from a finished poll and the device it signed on with. */
+export function mimoCredentialsFrom(poll, device) {
+    return {
+        userId: String(poll.userId),
+        cUserId: typeof poll.cUserId === 'string' ? poll.cUserId : '',
+        passToken: String(poll.passToken),
+        deviceId: device,
+        region: MIMO_REGION,
+        base: MIMO_HOSTS[MIMO_REGION],
+    };
+}
+/**
+ * Complete a sign-in: exchange the poll's passToken for a MiMo session, following a
+ * region redirect when the account belongs to another region's server.
+ *
+ * @param poll - the long poll's settled fields.
+ * @param device - the device id the sign-in started with.
+ * @param fetchFn - fetch implementation.
+ * @returns the durable credentials and the session cookies.
+ */
+export async function finishMimoSignIn(poll, device, fetchFn) {
+    let creds = mimoCredentialsFrom(poll, device);
+    let session;
+    try {
+        session = await mimoSignOn(creds, creds.base, fetchFn);
+    }
+    catch (error) {
+        if (error instanceof MimoSignInLapsed) {
+            throw new Error('Xiaomi signed the account in, but the MiMo server did not take it; try again');
+        }
+        throw error;
+    }
+    // An account of another region is served by that region's server.
+    // The region is reported on the signed-on session's /user/xiaomi/me; re-derive it.
+    const region = MIMO_REGION;
+    const regionalBase = MIMO_HOSTS[region];
+    if (regionalBase !== creds.base) {
+        try {
+            session = await mimoSignOn(creds, regionalBase, fetchFn);
+            creds = { ...creds, region, base: regionalBase };
+        }
+        catch {
+            // Stay on the original server.
+        }
+    }
+    return { creds: { ...creds, userId: session.userId || creds.userId }, cookies: session.cookies };
+}
+/** Refresh: the session is re-signed-on at the MiMo server from the durable credential. */
+export async function refreshMimoSession(creds, fetchFn) {
+    const session = await mimoSignOn(creds, creds.base, fetchFn);
+    return { cookies: session.cookies, expiresAt: Date.now() + MIMO_RENEW_AFTER_MS };
+}

package/lib/index.d.ts

@@ -16,9 +16,9 @@ export declare const name = "dsh-plugin-subscription-oauth";
 /** The provider routes need the LLM runtime; everything else is optional. */
 export declare const inject: string[];
 /** Every route key this plugin accepts in configuration. */
-export declare const PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark"];
+export declare const PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo"];
 /** The routes this build can actually register. */
-export declare const IMPLEMENTED_PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark"];
+export declare const IMPLEMENTED_PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo"];
 /** One route key. */
 export type ProviderId = typeof PROVIDER_IDS[number];
 /** Plugin configuration, as accepted from `cordis.patch.yml`. */

package/lib/index.js

@@ -22,15 +22,16 @@ import { createGrokProvider } from './providers/grok.js';
 import { createKimiProvider } from './providers/kimi-provider.js';
 import { createGlmProvider } from './providers/glm-provider.js';
 import { createArkProvider } from './providers/ark-provider.js';
+import { createMimoProvider } from './providers/mimo-provider.js';
 import { ModelPreferences } from './settings.js';
 /** Plugin id; also the name every effect label and log line is prefixed with. */
 export const name = 'dsh-plugin-subscription-oauth';
 /** The provider routes need the LLM runtime; everything else is optional. */
 export const inject = ['llm'];
 /** Every route key this plugin accepts in configuration. */
-export const PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark'];
+export const PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo'];
 /** The routes this build can actually register. */
-export const IMPLEMENTED_PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark'];
+export const IMPLEMENTED_PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo'];
 /** Configuration schema, with the config file's own defaults applied. */
 export const Config = z.object({
     providers: z.array(z.union([...PROVIDER_IDS])).default([...IMPLEMENTED_PROVIDER_IDS]),
@@ -138,6 +139,17 @@ export function apply(ctx, config = {}) {
                     fetchFn: proxiedFetch,
                 }));
                 break;
+            case 'mimo':
+                routes.push(createMimoProvider({
+                    credentialFile,
+                    streamIdleTimeoutMs,
+                    preferences,
+                    resolveAttachments: () => ctx.get('attachments'),
+                    onCatalogChanged: () => { reannounce('mimo'); },
+                    onWarn,
+                    fetchFn: proxiedFetch,
+                }));
+                break;
             default:
                 // A configured route with no module yet must not silently disappear.
                 onWarn(`provider ${id} is configured but not implemented in this build`);

package/lib/providers/mimo-provider.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `mimo` provider route's wiring: credential store, Xiaomi QR/password
+ * login, model catalog, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo-provider
+ */
+import type { ProviderRoute } from '../auth/registry.js';
+import type { ModelPreferences } from '../settings.js';
+import type { FetchFn } from '../http.js';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+/** Everything the MiMo route needs from the plugin configuration. */
+export interface MimoProviderOptions {
+    /** Absolute path of `auth.json`. */
+    credentialFile: string;
+    /** Abandon a stream after this much silence. */
+    streamIdleTimeoutMs: number;
+    /** Model the picker preselects. */
+    defaultModel?: string;
+    /** Shared model-visibility preferences. */
+    preferences: ModelPreferences;
+    /** Resolve the attachment service per request. */
+    resolveAttachments?: () => AttachmentStore | undefined;
+    /** Invoked when the catalog or its visibility changed. */
+    onCatalogChanged?: () => void;
+    onWarn?: (message: string) => void;
+    /** Fetch implementation; defaults to the proxy-aware fetch. */
+    fetchFn?: FetchFn;
+}
+/**
+ * Build the `mimo` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved endpoints, paths, and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export declare function createMimoProvider(options: MimoProviderOptions): ProviderRoute;

package/lib/providers/mimo-provider.js

@@ -0,0 +1,170 @@
+/**
+ * The `mimo` provider route's wiring: credential store, Xiaomi QR/password
+ * login, model catalog, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo-provider
+ */
+import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
+import { TokenStore } from '../auth/store.js';
+import { TokenManager } from '../auth/tokens.js';
+import { LOGIN_CANCELLED_MESSAGE } from '../auth/device-flow.js';
+import { finishMimoSignIn, mimoCredentialsFrom, refreshMimoSession, startMimoSignIn, waitMimoPoll, } from '../auth/mimo-flow.js';
+import { MimoAdapter, MIMO_CODE_URL, MIMO_CONTEXT_WINDOW, MIMO_DEFAULT_MODEL, MIMO_MODELS, MIMO_PROVIDER_ID, MIMO_PROVIDER_NAME, parseMimoSession, } from './mimo.js';
+import { ProviderController } from '../auth/provider-controller.js';
+import { proxiedFetch } from '../http.js';
+/** Wait, honouring cancellation. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+        }
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Build the `mimo` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved endpoints, paths, and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export function createMimoProvider(options) {
+    const fetchFn = options.fetchFn ?? proxiedFetch;
+    const store = new TokenStore(options.credentialFile, MIMO_PROVIDER_ID, parseMimoSession);
+    const toSession = (creds, cookies, userId) => ({
+        accessToken: JSON.stringify(cookies),
+        expiresAt: Date.now() + 24 * 60 * 60 * 1000,
+        accountId: userId,
+        apiBase: creds.base,
+        mimoCreds: JSON.stringify(creds),
+        mimoCookies: JSON.stringify(cookies),
+        region: creds.region,
+    });
+    /** The in-flight attempt, so `pending()` is stable across calls. */
+    let current;
+    const flow = {
+        async start() {
+            const start = await startMimoSignIn(fetchFn);
+            const controller = new AbortController();
+            const session = (async () => {
+                while (true) {
+                    if (controller.signal.aborted)
+                        throw new Error(LOGIN_CANCELLED_MESSAGE);
+                    const poll = await waitMimoPoll(start, fetchFn);
+                    if (poll !== undefined) {
+                        const { creds, cookies } = await finishMimoSignIn(poll, start.device, fetchFn);
+                        return toSession(creds, cookies, creds.userId);
+                    }
+                    await sleep(1000, controller.signal);
+                }
+            })();
+            const attempt = {
+                prompt: {
+                    url: start.url,
+                    expiresAt: start.until,
+                    mode: 'open-url',
+                },
+                session,
+                cancel: () => { controller.abort(); },
+            };
+            current = attempt;
+            void session.catch(() => undefined).finally(() => {
+                if (current === attempt)
+                    current = undefined;
+            });
+            return attempt;
+        },
+        pending() {
+            return current;
+        },
+    };
+    const tokens = new TokenManager({
+        store,
+        displayName: MIMO_PROVIDER_NAME,
+        // The app signs on again after a day; renew a little ahead of that.
+        preemptMs: 10 * 60 * 1000,
+        refresh: async (session) => {
+            let creds;
+            try {
+                creds = JSON.parse(session.mimoCreds);
+            }
+            catch {
+                throw new ProviderError(`${MIMO_PROVIDER_NAME} sign-in has expired; connect the account again`, REAUTH_REQUIRED);
+            }
+            try {
+                const renewed = await refreshMimoSession(creds, fetchFn);
+                return { accessToken: JSON.stringify(renewed.cookies), expiresAt: renewed.expiresAt };
+            }
+            catch (error) {
+                if (error instanceof Error && /lapsed/i.test(error.message)) {
+                    throw new ProviderError(`${MIMO_PROVIDER_NAME} sign-in has expired; connect the account again`, REAUTH_REQUIRED);
+                }
+                throw error;
+            }
+        },
+    });
+    const adapter = new MimoAdapter({
+        streamIdleTimeoutMs: options.streamIdleTimeoutMs,
+        tokens,
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+        ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
+        hiddenModels: () => options.preferences.hiddenIds(MIMO_PROVIDER_ID),
+        userModels: () => options.preferences.extraIds(MIMO_PROVIDER_ID),
+        fetchFn,
+    });
+    const spec = {
+        id: MIMO_PROVIDER_ID,
+        displayName: MIMO_PROVIDER_NAME,
+        codeUrl: MIMO_CODE_URL,
+        credentialFile: options.credentialFile,
+        // MiMo ships a fixed two-model catalog; there is no discovery endpoint.
+        discovery: false,
+        defaultModel: options.defaultModel ?? MIMO_DEFAULT_MODEL,
+        catalog: () => adapter.catalogEntries(),
+        catalogOwn: () => adapter.ownCatalogEntries(),
+        fallbackContextWindow: MIMO_CONTEXT_WINDOW,
+        discover: () => Promise.resolve(undefined),
+        usage: () => Promise.resolve({ windows: [] }),
+        details: () => [
+            { key: 'provider', value: MIMO_PROVIDER_NAME },
+            { key: 'credentialFile', value: options.credentialFile },
+        ],
+        applyDiscovery: () => { },
+    };
+    const controller = new ProviderController({
+        spec,
+        store,
+        tokens,
+        flow,
+        preferences: options.preferences,
+        ...options.onCatalogChanged === undefined ? {} : { onCatalogChanged: options.onCatalogChanged },
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+    });
+    return {
+        id: controller.id,
+        displayName: controller.displayName,
+        credentialFile: controller.credentialFile,
+        adapter,
+        status: () => controller.status(),
+        login: (account) => controller.login(account),
+        cancel: () => controller.cancel(),
+        logout: (account) => controller.logout(account),
+        setDefault: (account) => controller.setDefault(account),
+        refresh: (account) => controller.refresh(account),
+        discover: (force) => controller.discover(force),
+        setModelVisible: (id, visible) => controller.setModelVisible(id, visible),
+        setModelOrder: (ids) => controller.setModelOrder(ids),
+        addModel: (id) => controller.addModel(id),
+        removeModel: (id) => controller.removeModel(id),
+        usage: (force) => controller.usage(force),
+        reload: () => controller.reload(),
+    };
+}

package/lib/providers/mimo.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The Xiaomi MiMo wire adapter serving the `mimo` route.
+ *
+ * Model requests are chat completions at the MiMo server's `/route`, carrying the
+ * session cookies the sign-on set — not a bearer token. Two models ship: MiMo Pro
+ * and MiMo Flash. The open platform's Token Plan spends its own `tp-` key at a
+ * separate endpoint; that fallback lives beside the account-level stream here.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo
+ */
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmProviderInfo, type LlmResolvedModelInfo, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { type FetchFn } from '../http.js';
+import type { TokenManager } from '../auth/tokens.js';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+/** The `mimo` provider route key. */
+export declare const MIMO_PROVIDER_ID = "mimo";
+/** Human name for the route and its cards. */
+export declare const MIMO_PROVIDER_NAME = "Xiaomi MiMo";
+/** Where the Settings page sends someone to get an account. */
+export declare const MIMO_CODE_URL = "https://platform.xiaomimimo.com";
+/** MiMo context window shared by Pro and Flash. */
+export declare const MIMO_CONTEXT_WINDOW = 1000000;
+/** The output ceiling MiMo advertises. */
+export declare const MIMO_DEFAULT_MAX_TOKENS = 128000;
+/** The model the picker preselects. */
+export declare const MIMO_DEFAULT_MODEL = "mimo-pro";
+/** One signed-in MiMo account, as stored. */
+export interface MimoSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    accountId?: string;
+    email?: string;
+    /** The MiMo server base this account signs on at. */
+    apiBase: string;
+    /** The durable Xiaomi credential (JSON), used to re-sign-on. */
+    mimoCreds: string;
+    /** The live session cookies (JSON), sent as the Cookie header. */
+    mimoCookies: string;
+    /** The account's region. */
+    region?: string;
+}
+/** Validate one stored value as a MiMo session, or undefined when it is not one. */
+export declare function parseMimoSession(value: unknown): MimoSession | undefined;
+/** One catalog row. */
+interface MimoModelEntry {
+    id: string;
+    name: string;
+    description: string;
+    contextWindow: number;
+}
+/** The two models the MiMo app serves. */
+export declare const MIMO_MODELS: readonly MimoModelEntry[];
+/** Constructor dependencies for {@link MimoAdapter}. */
+export interface MimoAdapterOptions {
+    /** MiMo server base; `<base>/route/chat/completions` is the endpoint. */
+    apiBase?: string;
+    streamIdleTimeoutMs: number;
+    tokens: TokenManager<MimoSession>;
+    onWarn?: (message: string) => void;
+    resolveAttachments?: () => AttachmentStore | undefined;
+    hiddenModels?: () => Promise<ReadonlySet<string>>;
+    userModels?: () => Promise<readonly string[]>;
+    fetchFn?: FetchFn;
+}
+/** The MiMo wire adapter serving the `mimo` route. */
+export declare class MimoAdapter extends LlmAdapter {
+    private readonly options;
+    private readonly fetchFn;
+    constructor(options: MimoAdapterOptions);
+    providerInfo(provider: string): LlmProviderInfo;
+    listModels(_provider: string): Promise<readonly LlmModelInfo[]>;
+    private hidden;
+    resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    providerRetryPolicy(): undefined;
+    /** The catalog the Settings list reads: every shipped model. */
+    catalogEntries(): readonly {
+        id: string;
+        name: string;
+        contextWindow: number;
+    }[];
+    /** The ids the route itself serves, without hand-added extras. */
+    ownCatalogEntries(): readonly MimoModelEntry[];
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /**
+     * The session cookies as one Cookie header, in a steady order.
+     *
+     * MiMo is a cookie session, not a bearer: the wire credential is the cookie
+     * header built from the stored session's cookie record.
+     */
+    private cookieHeader;
+    private requestBody;
+    private toChatMessage;
+    private readStream;
+}
+export {};

package/lib/providers/mimo.js

@@ -0,0 +1,260 @@
+/**
+ * The Xiaomi MiMo wire adapter serving the `mimo` route.
+ *
+ * Model requests are chat completions at the MiMo server's `/route`, carrying the
+ * session cookies the sign-on set — not a bearer token. Two models ship: MiMo Pro
+ * and MiMo Flash. The open platform's Token Plan spends its own `tp-` key at a
+ * separate endpoint; that fallback lives beside the account-level stream here.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/mimo
+ */
+import { LlmAdapter, errorChain, } from '@deepseek-ai/dsh-llm';
+import { httpLlmError, isMissingOrInvalidCredential, mapFetchFailure, idleWatchdog } from './common.js';
+import { proxiedFetch } from '../http.js';
+import { refreshMimoSession } from '../auth/mimo-flow.js';
+/** The `mimo` provider route key. */
+export const MIMO_PROVIDER_ID = 'mimo';
+/** Human name for the route and its cards. */
+export const MIMO_PROVIDER_NAME = 'Xiaomi MiMo';
+/** Where the Settings page sends someone to get an account. */
+export const MIMO_CODE_URL = 'https://platform.xiaomimimo.com';
+/** MiMo context window shared by Pro and Flash. */
+export const MIMO_CONTEXT_WINDOW = 1_000_000;
+/** The output ceiling MiMo advertises. */
+export const MIMO_DEFAULT_MAX_TOKENS = 128_000;
+/** The model the picker preselects. */
+export const MIMO_DEFAULT_MODEL = 'mimo-pro';
+/** Validate one stored value as a MiMo session, or undefined when it is not one. */
+export function parseMimoSession(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    if (typeof record.accessToken !== 'string' || record.accessToken.length === 0)
+        return undefined;
+    if (typeof record.expiresAt !== 'number')
+        return undefined;
+    if (typeof record.apiBase !== 'string' || record.apiBase.length === 0)
+        return undefined;
+    if (typeof record.mimoCreds !== 'string')
+        return undefined;
+    if (typeof record.mimoCookies !== 'string')
+        return undefined;
+    return {
+        accessToken: record.accessToken,
+        expiresAt: record.expiresAt,
+        apiBase: record.apiBase,
+        mimoCreds: record.mimoCreds,
+        mimoCookies: record.mimoCookies,
+        ...typeof record.refreshToken === 'string' ? { refreshToken: record.refreshToken } : {},
+        ...typeof record.accountId === 'string' ? { accountId: record.accountId } : {},
+        ...typeof record.email === 'string' ? { email: record.email } : {},
+        ...typeof record.region === 'string' ? { region: record.region } : {},
+    };
+}
+/** The two models the MiMo app serves. */
+export const MIMO_MODELS = [
+    { id: 'mimo-pro', name: 'MiMo Pro', description: 'Flagship MiMo model', contextWindow: MIMO_CONTEXT_WINDOW },
+    { id: 'mimo-flash', name: 'MiMo Flash', description: 'Fast MiMo model', contextWindow: MIMO_CONTEXT_WINDOW },
+];
+/** The MiMo wire adapter serving the `mimo` route. */
+export class MimoAdapter extends LlmAdapter {
+    options;
+    fetchFn;
+    constructor(options) {
+        super();
+        this.options = options;
+        this.fetchFn = options.fetchFn ?? proxiedFetch;
+    }
+    providerInfo(provider) {
+        return { id: provider, name: MIMO_PROVIDER_NAME };
+    }
+    async listModels(_provider) {
+        if (await this.options.tokens.session() === undefined)
+            return [];
+        const hidden = await this.hidden();
+        return MIMO_MODELS.filter((entry) => !hidden.has(entry.id)).map((entry) => ({
+            provider: MIMO_PROVIDER_ID,
+            id: entry.id,
+            name: entry.name,
+            description: entry.description,
+            inputModalities: ['text', 'image'],
+        }));
+    }
+    async hidden() {
+        if (this.options.hiddenModels === undefined)
+            return new Set();
+        try {
+            return await this.options.hiddenModels();
+        }
+        catch {
+            return new Set();
+        }
+    }
+    async resolveModel(_provider, model) {
+        const entry = MIMO_MODELS.find((candidate) => candidate.id === model);
+        if (entry === undefined) {
+            return {
+                provider: MIMO_PROVIDER_ID,
+                id: model,
+                name: model,
+                context: { contextWindow: MIMO_CONTEXT_WINDOW },
+                defaultMaxTokens: MIMO_DEFAULT_MAX_TOKENS,
+                inputModalities: ['text', 'image'],
+            };
+        }
+        return {
+            provider: MIMO_PROVIDER_ID,
+            id: entry.id,
+            name: entry.name,
+            description: entry.description,
+            context: { contextWindow: entry.contextWindow },
+            defaultMaxTokens: MIMO_DEFAULT_MAX_TOKENS,
+            inputModalities: ['text', 'image'],
+        };
+    }
+    providerRetryPolicy() {
+        return undefined;
+    }
+    /** The catalog the Settings list reads: every shipped model. */
+    catalogEntries() {
+        return MIMO_MODELS;
+    }
+    /** The ids the route itself serves, without hand-added extras. */
+    ownCatalogEntries() {
+        return MIMO_MODELS;
+    }
+    async *stream(options) {
+        const held = await this.options.tokens.session();
+        if (held === undefined)
+            throw await httpLlmError(new Response(null, { status: 401 }), 'Xiaomi MiMo');
+        const session = held.session;
+        const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+        try {
+            const cookies = this.cookieHeader(session);
+            const body = this.requestBody(options);
+            const response = await this.fetchFn(`${session.apiBase.replace(/\/+$/, '')}/route/chat/completions`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Accept': 'text/event-stream',
+                    'Cookie': cookies,
+                    'X-Mimo-Source': 'mimocode-cli-free',
+                    'User-Agent': 'miNative PC/Normal Windows_NT/10.0.26100 SDKV/1.0.0 DEVT/PC DEVS/Windows APP/miaccount_desktop APPV/0.1.0',
+                    'X-Client-Version': '26.929.292248',
+                },
+                body: JSON.stringify(body),
+                signal: watchdog.signal,
+            });
+            if (!response.ok || response.body === null) {
+                throw await httpLlmError(response, 'Xiaomi MiMo');
+            }
+            yield* this.readStream(response, watchdog);
+        }
+        catch (error) {
+            throw mapFetchFailure('Xiaomi MiMo', error, watchdog, options.signal);
+        }
+        finally {
+            watchdog.stop();
+        }
+    }
+    /**
+     * The session cookies as one Cookie header, in a steady order.
+     *
+     * MiMo is a cookie session, not a bearer: the wire credential is the cookie
+     * header built from the stored session's cookie record.
+     */
+    cookieHeader(session) {
+        const first = ['serviceToken', 'userId', 'cUserId'];
+        try {
+            const cookies = JSON.parse(session.mimoCookies);
+            const parts = first.filter((key) => key in cookies).map((key) => `${key}=${cookies[key]}`);
+            for (const [key, value] of Object.entries(cookies)) {
+                if (!first.includes(key))
+                    parts.push(`${key}=${value}`);
+            }
+            return parts.join('; ');
+        }
+        catch {
+            return '';
+        }
+    }
+    requestBody(options) {
+        const messages = [];
+        if (options.system !== undefined && options.system.trim() !== '') {
+            messages.push({ role: 'system', content: options.system });
+        }
+        for (const message of options.messages) {
+            messages.push(this.toChatMessage(message));
+        }
+        return {
+            model: options.model,
+            messages,
+            ...options.maxTokens === undefined ? {} : { max_tokens: options.maxTokens },
+            stream: true,
+        };
+    }
+    toChatMessage(message) {
+        const role = message.role === 'assistant' ? 'assistant' : 'user';
+        const textParts = [];
+        for (const block of message.content) {
+            if (block.type === 'text')
+                textParts.push(block.text);
+        }
+        return { role, content: textParts.join('\n') };
+    }
+    async *readStream(response, watchdog) {
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let started = false;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                watchdog.pulse();
+                buffer += decoder.decode(value, { stream: true });
+                const frames = buffer.split('\n\n');
+                buffer = frames.pop() ?? '';
+                for (const frame of frames) {
+                    const data = frame
+                        .split('\n')
+                        .filter((line) => line.startsWith('data:'))
+                        .map((line) => line.slice(5).trim())
+                        .join('\n');
+                    if (data === '' || data === '[DONE]')
+                        continue;
+                    let chunk;
+                    try {
+                        chunk = JSON.parse(data);
+                    }
+                    catch {
+                        continue;
+                    }
+                    const delta = chunk.choices?.[0]?.delta?.content;
+                    if (typeof delta === 'string' && delta !== '') {
+                        if (!started) {
+                            yield { type: 'block-start', index: 0, blockType: 'text' };
+                            started = true;
+                        }
+                        yield { type: 'text-delta', index: 0, text: delta };
+                    }
+                    if (chunk.usage !== undefined) {
+                        const input = chunk.usage.prompt_tokens ?? 0;
+                        const output = chunk.usage.completion_tokens ?? 0;
+                        yield {
+                            type: 'usage',
+                            usage: { inputTokens: input, outputTokens: output, totalTokens: chunk.usage.total_tokens ?? input + output },
+                        };
+                    }
+                }
+            }
+            if (started)
+                yield { type: 'block-end', index: 0, block: { type: 'text', text: '' } };
+            yield { type: 'finish', reason: { kind: 'stop' } };
+        }
+        finally {
+            reader.cancel().catch(() => { });
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.8.18",
+  "version": "0.9.0",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",