dsh-plugin-subscription-oauth 0.9.0 → 0.10.0

package/lib/auth/workbuddy-flow.d.ts

@@ -0,0 +1,95 @@
+/**
+ * WorkBuddy China's sign-in and token handling.
+ *
+ * A WorkBuddy account signs in in the browser (Tencent's page, polled for the
+ * token as WorkBuddy's desktop app does). Chats are chat completions at
+ * `<endpoint>/v2`, streamed only, and the API answers `{code, msg, data}` where a
+ * non-zero code is an error. Adapted from magpie's `workbuddy` for this plugin's
+ * typed flow/store contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/workbuddy-flow
+ */
+/** WorkBuddy China build's endpoints. */
+export declare const WORKBUDDY_ENDPOINT = "https://copilot.tencent.com";
+export declare const WORKBUDDY_PLATFORM = "workbuddy";
+/** The version the sign-in page is opened with. */
+export declare const WORKBUDDY_APP_VERSION = "2.0.0";
+/** The User-Agent version the chat API accepts; another is refused (10085). */
+export declare const WORKBUDDY_UA_VERSION = "5.5.6";
+/** A token this close to its end is refreshed before a request. */
+export declare const WORKBUDDY_EARLY_MS = 60000;
+/** A sign-in attempt is abandoned after this long. */
+export declare const WORKBUDDY_SIGN_IN_MS: number;
+/** One signed-in WorkBuddy session, as stored. */
+export interface WorkBuddySession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    accountId?: string;
+    email?: string;
+    uid?: string;
+    enterpriseId?: string;
+    domain?: string;
+    tokenType?: string;
+    refreshExpiresAt?: number;
+}
+/** Validate one stored value as a WorkBuddy session, or undefined when it is not one. */
+export declare function parseWorkBuddySession(value: unknown): WorkBuddySession | undefined;
+/** A WorkBuddy API failure, carrying the wire code and magpie's phrasing. */
+export declare class WBError extends Error {
+    readonly code: number | string | undefined;
+    readonly status: number;
+    readonly said: string;
+    constructor(message: string, code: number | string | undefined, status: number, said: string);
+}
+/** The chat completions endpoint for the China build. */
+export declare const workbuddyApi: (endpoint: string) => string;
+/**
+ * Make one request of WorkBuddy's plugin API, which answers `{code, msg, data}`.
+ * A non-zero `code`, or a non-2xx status, is an error.
+ *
+ * @param endpoint - the site base, e.g. `https://copilot.tencent.com`.
+ * @param method - HTTP method.
+ * @param path - path beneath the base.
+ * @param headers - extra headers.
+ * @param body - JSON body, when present.
+ * @param fetchFn - fetch implementation.
+ * @returns the response's `data`.
+ */
+export declare function workbuddyCall(endpoint: string, method: string, path: string, headers: Record<string, string>, body: unknown, fetchFn: typeof fetch): Promise<unknown>;
+/** The state WorkBuddy's sign-in page starts from. */
+export interface WorkBuddySignInStart {
+    state: string;
+    url: string;
+    expiresAt: number;
+}
+/** Start a browser sign-in: the page URL to open, and the state to poll for the token. */
+export declare function startWorkBuddySignIn(fetchFn: typeof fetch): Promise<WorkBuddySignInStart>;
+/** One WorkBuddy token's fields, normalised from the sign-in or refresh response. */
+export interface WorkBuddyTokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    refreshExpiresAt?: number;
+    domain?: string;
+    tokenType?: string;
+    uid?: string;
+    enterpriseId?: string;
+}
+/** Merge a token WorkBuddy gave into the stored sign-in's fields. */
+export declare function mergeWorkBuddyToken(base: WorkBuddyTokenSet, got: Record<string, unknown>): WorkBuddyTokenSet;
+/** Poll for the token a finished browser sign-in produced. */
+export declare function finishWorkBuddySignIn(start: WorkBuddySignInStart, fetchFn: typeof fetch): Promise<{
+    token: WorkBuddyTokenSet;
+    name: string;
+}>;
+/** The domain a token names, else the API host. */
+export declare function workbuddyDomain(token: Pick<WorkBuddyTokenSet, 'domain'>): string;
+/** The headers WorkBuddy's desktop app sends with a chat and its account. */
+export declare function workbuddyHeaders(token: WorkBuddyTokenSet): Record<string, string>;
+/** Whether a token is close enough to its end that a request should refresh it. */
+export declare function workbuddyStale(token: Pick<WorkBuddyTokenSet, 'expiresAt'>): boolean;
+/** Whether a token can still be refreshed. */
+export declare function workbuddyRefreshable(token: WorkBuddyTokenSet): boolean;
+/** Spend a refresh token for a new access token. */
+export declare function refreshWorkBuddyToken(token: WorkBuddyTokenSet, fetchFn: typeof fetch): Promise<WorkBuddyTokenSet>;

package/lib/auth/workbuddy-flow.js

@@ -0,0 +1,265 @@
+/**
+ * WorkBuddy China's sign-in and token handling.
+ *
+ * A WorkBuddy account signs in in the browser (Tencent's page, polled for the
+ * token as WorkBuddy's desktop app does). Chats are chat completions at
+ * `<endpoint>/v2`, streamed only, and the API answers `{code, msg, data}` where a
+ * non-zero code is an error. Adapted from magpie's `workbuddy` for this plugin's
+ * typed flow/store contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/workbuddy-flow
+ */
+/** WorkBuddy China build's endpoints. */
+export const WORKBUDDY_ENDPOINT = 'https://copilot.tencent.com';
+export const WORKBUDDY_PLATFORM = 'workbuddy';
+/** The version the sign-in page is opened with. */
+export const WORKBUDDY_APP_VERSION = '2.0.0';
+/** The User-Agent version the chat API accepts; another is refused (10085). */
+export const WORKBUDDY_UA_VERSION = '5.5.6';
+/** A token this close to its end is refreshed before a request. */
+export const WORKBUDDY_EARLY_MS = 60_000;
+/** A sign-in attempt is abandoned after this long. */
+export const WORKBUDDY_SIGN_IN_MS = 5 * 60 * 1000;
+const POLL_MS = 1000;
+/** Validate one stored value as a WorkBuddy session, or undefined when it is not one. */
+export function parseWorkBuddySession(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    if (typeof record.accessToken !== 'string' || record.accessToken.length === 0)
+        return undefined;
+    if (typeof record.expiresAt !== 'number')
+        return undefined;
+    return {
+        accessToken: record.accessToken,
+        expiresAt: record.expiresAt,
+        ...typeof record.refreshToken === 'string' ? { refreshToken: record.refreshToken } : {},
+        ...typeof record.accountId === 'string' ? { accountId: record.accountId } : {},
+        ...typeof record.email === 'string' ? { email: record.email } : {},
+        ...typeof record.uid === 'string' ? { uid: record.uid } : {},
+        ...typeof record.enterpriseId === 'string' ? { enterpriseId: record.enterpriseId } : {},
+        ...typeof record.domain === 'string' ? { domain: record.domain } : {},
+        ...typeof record.tokenType === 'string' ? { tokenType: record.tokenType } : {},
+        ...typeof record.refreshExpiresAt === 'number' ? { refreshExpiresAt: record.refreshExpiresAt } : {},
+    };
+}
+/** A WorkBuddy API failure, carrying the wire code and magpie's phrasing. */
+export class WBError extends Error {
+    code;
+    status;
+    said;
+    constructor(message, code, status, said) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.said = said;
+    }
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The chat completions endpoint for the China build. */
+export const workbuddyApi = (endpoint) => `${endpoint}/v2`;
+/**
+ * Make one request of WorkBuddy's plugin API, which answers `{code, msg, data}`.
+ * A non-zero `code`, or a non-2xx status, is an error.
+ *
+ * @param endpoint - the site base, e.g. `https://copilot.tencent.com`.
+ * @param method - HTTP method.
+ * @param path - path beneath the base.
+ * @param headers - extra headers.
+ * @param body - JSON body, when present.
+ * @param fetchFn - fetch implementation.
+ * @returns the response's `data`.
+ */
+export async function workbuddyCall(endpoint, method, path, headers, body, fetchFn) {
+    const response = await fetchFn(endpoint + path, {
+        method,
+        headers: {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+            'User-Agent': `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+            ...headers,
+        },
+        ...body === undefined ? {} : { body: JSON.stringify(body) },
+        signal: AbortSignal.timeout(30_000),
+    });
+    const text = await response.text();
+    let env = {};
+    try {
+        env = JSON.parse(text);
+    }
+    catch {
+        env = {};
+    }
+    const code = Number.parseInt(String(env.code ?? ''), 10) || 0;
+    if (!response.ok) {
+        const why = String(env.msg ?? env.message ?? (isRecord(env.error) ? env.error.message : '') ?? '').trim() ||
+            text.slice(0, 200) || response.statusText;
+        const said = code ? String(env.msg ?? `error ${code}`) : String(env.msg ?? `${response.status}`);
+        throw new WBError(`WorkBuddy: ${why} (HTTP ${response.status}${env.code ? `, code ${String(env.code)}` : ''})`, env.code, response.status, said);
+    }
+    if (code !== 0) {
+        throw new WBError(`WorkBuddy: ${String(env.msg ?? 'error')} (${String(env.code)})`, env.code, response.status, String(env.msg ?? `error ${code}`));
+    }
+    return env.data;
+}
+/** Start a browser sign-in: the page URL to open, and the state to poll for the token. */
+export async function startWorkBuddySignIn(fetchFn) {
+    const data = await workbuddyCall(WORKBUDDY_ENDPOINT, 'POST', `/v2/plugin/auth/state?platform=${encodeURIComponent(WORKBUDDY_PLATFORM)}`, {
+        'X-No-Authorization': 'true',
+        'X-No-User-Id': 'true',
+        'X-No-Enterprise-Id': 'true',
+        'X-No-Department-Info': 'true',
+    }, {}, fetchFn);
+    if (!isRecord(data) || typeof data.state !== 'string' || typeof data.authUrl !== 'string') {
+        throw new Error('WorkBuddy gave no sign-in page');
+    }
+    const url = new URL(data.authUrl);
+    if (url.protocol !== 'https:')
+        throw new Error("WorkBuddy's sign-in page isn't https");
+    url.searchParams.set('version', WORKBUDDY_APP_VERSION);
+    url.searchParams.set('loginSessionId', randomHex());
+    return { state: data.state, url: url.toString(), expiresAt: Date.now() + WORKBUDDY_SIGN_IN_MS };
+}
+const randomHex = () => {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+};
+/** Ask a path until it answers data, retrying the codes that mean "not yet". */
+async function workbuddyPoll(path, headers, retry, deadline, fetchFn) {
+    for (;;) {
+        if (Date.now() > deadline)
+            throw new Error('WorkBuddy sign-in timed out');
+        try {
+            const data = await workbuddyCall(WORKBUDDY_ENDPOINT, 'GET', path, headers, undefined, fetchFn);
+            if (isRecord(data) && Object.keys(data).length > 0)
+                return data;
+        }
+        catch (error) {
+            if (!(error instanceof WBError && (retry.includes(Number(error.code)) || error.status === 408 || error.status === 429))) {
+                throw error;
+            }
+        }
+        await sleep(POLL_MS);
+    }
+}
+/** Merge a token WorkBuddy gave into the stored sign-in's fields. */
+export function mergeWorkBuddyToken(base, got) {
+    const now = Date.now();
+    const out = { ...base, accessToken: String(got.accessToken ?? '') };
+    if (typeof got.refreshToken === 'string' && got.refreshToken !== '')
+        out.refreshToken = got.refreshToken;
+    if (typeof got.domain === 'string' && got.domain !== '')
+        out.domain = got.domain;
+    if (typeof got.tokenType === 'string' && got.tokenType !== '')
+        out.tokenType = got.tokenType;
+    const expiresAt = Number(got.expiresAt);
+    const expiresIn = Number(got.expiresIn);
+    if (expiresAt > 0)
+        out.expiresAt = expiresAt;
+    else if (expiresIn > 0)
+        out.expiresAt = now + expiresIn * 1000;
+    const refreshExpiresAt = Number(got.refreshExpiresAt);
+    const refreshExpiresIn = Number(got.refreshExpiresIn);
+    if (refreshExpiresAt > 0)
+        out.refreshExpiresAt = refreshExpiresAt;
+    else if (refreshExpiresIn > 0)
+        out.refreshExpiresAt = now + refreshExpiresIn * 1000;
+    return out;
+}
+/** Poll for the token a finished browser sign-in produced. */
+export async function finishWorkBuddySignIn(start, fetchFn) {
+    const deadline = start.expiresAt;
+    const query = encodeURIComponent(start.state);
+    const tokenData = await workbuddyPoll(`/v2/plugin/auth/token?state=${query}`, {}, [11217], deadline, fetchFn);
+    if (typeof tokenData.accessToken !== 'string' || tokenData.accessToken === '') {
+        throw new Error('WorkBuddy sent back no token');
+    }
+    const token = mergeWorkBuddyToken({ accessToken: '', expiresAt: 0 }, tokenData);
+    const who = await workbuddyPoll(`/v2/plugin/login/account?state=${query}`, {
+        'Authorization': `Bearer ${token.accessToken}`,
+        'X-Domain': workbuddyDomain(token),
+        'X-No-User-Id': 'true',
+        'X-No-Enterprise-Id': 'true',
+    }, [12151], deadline, fetchFn);
+    token.uid = typeof who.uid === 'string' ? who.uid : '';
+    token.enterpriseId = await workbuddyEnterprise(token, who, fetchFn);
+    const name = String(who.nickname ?? who.phoneNumber ?? who.uid ?? '');
+    return { token, name };
+}
+/** The domain a token names, else the API host. */
+export function workbuddyDomain(token) {
+    return token.domain || new URL(workbuddyApi(WORKBUDDY_ENDPOINT)).host;
+}
+/** The enterprise an account signed in as, when it isn't a personal account. */
+async function workbuddyEnterprise(token, who, fetchFn) {
+    const own = typeof who.enterpriseId === 'string' ? who.enterpriseId.trim() : '';
+    if (own)
+        return own;
+    const type = String(who.type ?? '').trim().toLowerCase();
+    if (type === '' || type === 'personal')
+        return '';
+    let list;
+    try {
+        list = await workbuddyCall(WORKBUDDY_ENDPOINT, 'GET', '/v2/plugin/accounts', { 'Authorization': `Bearer ${token.accessToken}`, 'X-Domain': workbuddyDomain(token) }, undefined, fetchFn);
+    }
+    catch {
+        return '';
+    }
+    const accounts = isRecord(list) && Array.isArray(list.accounts) ? list.accounts.filter(isRecord) : [];
+    const mine = accounts.filter((entry) => entry.uid === who.uid && typeof entry.enterpriseId === 'string' && entry.enterpriseId.trim() !== '');
+    const same = mine.filter((entry) => String(entry.type ?? '').trim().toLowerCase() === type);
+    const last = mine.filter((entry) => entry.lastLogin);
+    const pick = same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : undefined;
+    return pick && typeof pick.enterpriseId === 'string' ? pick.enterpriseId.trim() : '';
+}
+/** The headers WorkBuddy's desktop app sends with a chat and its account. */
+export function workbuddyHeaders(token) {
+    const headers = {
+        'Authorization': `Bearer ${token.accessToken}`,
+        'X-User-Id': token.uid ?? '',
+        'X-Domain': workbuddyDomain(token),
+        'X-Product': 'SaaS',
+        'X-IDE-Type': 'WorkBuddy',
+        'User-Agent': `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+        'X-Requested-With': 'XMLHttpRequest',
+        'X-Agent-Intent': 'craft',
+        'X-Agent-Purpose': 'conversation',
+        'X-IDE-Name': 'WorkBuddy',
+        'X-IDE-Version': WORKBUDDY_UA_VERSION,
+    };
+    const enterprise = typeof token.enterpriseId === 'string' ? token.enterpriseId.trim() : '';
+    if (enterprise !== '') {
+        headers['X-Enterprise-Id'] = enterprise;
+        headers['X-Tenant-Id'] = enterprise;
+    }
+    return headers;
+}
+/** Whether a token is close enough to its end that a request should refresh it. */
+export function workbuddyStale(token) {
+    return token.expiresAt > 0 && Date.now() >= token.expiresAt - WORKBUDDY_EARLY_MS;
+}
+/** Whether a token can still be refreshed. */
+export function workbuddyRefreshable(token) {
+    if (typeof token.refreshToken !== 'string' || token.refreshToken === '')
+        return false;
+    return !(token.refreshExpiresAt !== undefined && Date.now() >= token.refreshExpiresAt);
+}
+/** Spend a refresh token for a new access token. */
+export async function refreshWorkBuddyToken(token, fetchFn) {
+    const data = await workbuddyCall(WORKBUDDY_ENDPOINT, 'POST', '/v2/plugin/auth/token/refresh', {
+        'X-Refresh-Token': token.refreshToken ?? '',
+        'X-Auth-Refresh-Source': 'plugin',
+        'X-Domain': workbuddyDomain(token),
+        ...workbuddyEnterpriseHeaders(token),
+    }, {}, fetchFn);
+    if (!isRecord(data) || typeof data.accessToken !== 'string' || data.accessToken === '') {
+        throw new Error('WorkBuddy gave no refreshed token');
+    }
+    return mergeWorkBuddyToken(token, data);
+}
+function workbuddyEnterpriseHeaders(token) {
+    const enterprise = typeof token.enterpriseId === 'string' ? token.enterpriseId.trim() : '';
+    return enterprise === '' ? {} : { 'X-Enterprise-Id': enterprise, 'X-Tenant-Id': enterprise };
+}

package/lib/index.d.ts

@@ -16,9 +16,9 @@ export declare const name = "dsh-plugin-subscription-oauth";
 /** The provider routes need the LLM runtime; everything else is optional. */
 export declare const inject: string[];
 /** Every route key this plugin accepts in configuration. */
-export declare const PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo"];
+export declare const PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo", "workbuddy"];
 /** The routes this build can actually register. */
-export declare const IMPLEMENTED_PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo"];
+export declare const IMPLEMENTED_PROVIDER_IDS: readonly ["kimi", "grok", "antigravity", "glm", "ark", "mimo", "workbuddy"];
 /** One route key. */
 export type ProviderId = typeof PROVIDER_IDS[number];
 /** Plugin configuration, as accepted from `cordis.patch.yml`. */

package/lib/index.js

@@ -23,15 +23,16 @@ import { createKimiProvider } from './providers/kimi-provider.js';
 import { createGlmProvider } from './providers/glm-provider.js';
 import { createArkProvider } from './providers/ark-provider.js';
 import { createMimoProvider } from './providers/mimo-provider.js';
+import { createWorkBuddyProvider } from './providers/workbuddy-provider.js';
 import { ModelPreferences } from './settings.js';
 /** Plugin id; also the name every effect label and log line is prefixed with. */
 export const name = 'dsh-plugin-subscription-oauth';
 /** The provider routes need the LLM runtime; everything else is optional. */
 export const inject = ['llm'];
 /** Every route key this plugin accepts in configuration. */
-export const PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo'];
+export const PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo', 'workbuddy'];
 /** The routes this build can actually register. */
-export const IMPLEMENTED_PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo'];
+export const IMPLEMENTED_PROVIDER_IDS = ['kimi', 'grok', 'antigravity', 'glm', 'ark', 'mimo', 'workbuddy'];
 /** Configuration schema, with the config file's own defaults applied. */
 export const Config = z.object({
     providers: z.array(z.union([...PROVIDER_IDS])).default([...IMPLEMENTED_PROVIDER_IDS]),
@@ -150,6 +151,16 @@ export function apply(ctx, config = {}) {
                     fetchFn: proxiedFetch,
                 }));
                 break;
+            case 'workbuddy':
+                routes.push(createWorkBuddyProvider({
+                    credentialFile,
+                    streamIdleTimeoutMs,
+                    preferences,
+                    onCatalogChanged: () => { reannounce('workbuddy'); },
+                    onWarn,
+                    fetchFn: proxiedFetch,
+                }));
+                break;
             default:
                 // A configured route with no module yet must not silently disappear.
                 onWarn(`provider ${id} is configured but not implemented in this build`);

package/lib/providers/workbuddy-provider.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The `workbuddy` provider route's wiring (WorkBuddy China build):
+ * credential store, browser sign-in, token refresh, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy-provider
+ */
+import type { ProviderRoute } from '../auth/registry.js';
+import type { ModelPreferences } from '../settings.js';
+import type { FetchFn } from '../http.js';
+/** Everything the WorkBuddy route needs from the plugin configuration. */
+export interface WorkBuddyProviderOptions {
+    /** Absolute path of `auth.json`. */
+    credentialFile: string;
+    /** Abandon a stream after this much silence. */
+    streamIdleTimeoutMs: number;
+    /** Model the picker preselects. */
+    defaultModel?: string;
+    /** Shared model-visibility preferences. */
+    preferences: ModelPreferences;
+    /** Invoked when the catalog or its visibility changed. */
+    onCatalogChanged?: () => void;
+    onWarn?: (message: string) => void;
+    /** Fetch implementation; defaults to the proxy-aware fetch. */
+    fetchFn?: FetchFn;
+}
+/**
+ * Build the `workbuddy` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved paths and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export declare function createWorkBuddyProvider(options: WorkBuddyProviderOptions): ProviderRoute;

package/lib/providers/workbuddy-provider.js

@@ -0,0 +1,181 @@
+/**
+ * The `workbuddy` provider route's wiring (WorkBuddy China build):
+ * credential store, browser sign-in, token refresh, and its Settings card facts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy-provider
+ */
+import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
+import { TokenStore } from '../auth/store.js';
+import { TokenManager } from '../auth/tokens.js';
+import { LOGIN_CANCELLED_MESSAGE } from '../auth/device-flow.js';
+import { finishWorkBuddySignIn, parseWorkBuddySession, refreshWorkBuddyToken, startWorkBuddySignIn, workbuddyRefreshable, workbuddyStale, WORKBUDDY_EARLY_MS, } from '../auth/workbuddy-flow.js';
+import { WorkBuddyAdapter, WORKBUDDY_CODE_URL, WORKBUDDY_CATALOG, WORKBUDDY_DEFAULT_MODEL, WORKBUDDY_PROVIDER_ID, WORKBUDDY_PROVIDER_NAME, } from './workbuddy.js';
+import { ProviderController } from '../auth/provider-controller.js';
+import { proxiedFetch } from '../http.js';
+/** Wait, honouring cancellation. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(new Error(LOGIN_CANCELLED_MESSAGE));
+        }
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Build the `workbuddy` route: its adapter and its login/lifecycle controller.
+ *
+ * @param options - resolved paths and shared services.
+ * @returns the route, ready to register and to serve over RPC.
+ */
+export function createWorkBuddyProvider(options) {
+    const fetchFn = options.fetchFn ?? proxiedFetch;
+    const store = new TokenStore(options.credentialFile, WORKBUDDY_PROVIDER_ID, parseWorkBuddySession);
+    const toSession = (token, name) => ({
+        accessToken: token.accessToken,
+        expiresAt: token.expiresAt,
+        ...token.refreshToken === undefined ? {} : { refreshToken: token.refreshToken },
+        ...name === '' ? {} : { accountId: name },
+        ...token.uid === undefined ? {} : { uid: token.uid },
+        ...token.enterpriseId === undefined ? {} : { enterpriseId: token.enterpriseId },
+        ...token.domain === undefined ? {} : { domain: token.domain },
+        ...token.tokenType === undefined ? {} : { tokenType: token.tokenType },
+        ...token.refreshExpiresAt === undefined ? {} : { refreshExpiresAt: token.refreshExpiresAt },
+    });
+    /** The in-flight attempt, so `pending()` is stable across calls. */
+    let current;
+    const flow = {
+        async start() {
+            const start = await startWorkBuddySignIn(fetchFn);
+            const controller = new AbortController();
+            const session = (async () => {
+                while (true) {
+                    if (controller.signal.aborted)
+                        throw new Error(LOGIN_CANCELLED_MESSAGE);
+                    try {
+                        const { token, name } = await finishWorkBuddySignIn(start, fetchFn);
+                        return toSession(token, name);
+                    }
+                    catch (error) {
+                        if (controller.signal.aborted)
+                            throw new Error(LOGIN_CANCELLED_MESSAGE);
+                        // A "not yet" poll answer is normal; anything else fails the attempt.
+                        if (error instanceof Error && /timed out/i.test(error.message))
+                            throw error;
+                        throw error;
+                    }
+                }
+            })();
+            const attempt = {
+                prompt: {
+                    url: start.url,
+                    expiresAt: start.expiresAt,
+                    mode: 'open-url',
+                },
+                session,
+                cancel: () => { controller.abort(); },
+            };
+            current = attempt;
+            void session.catch(() => undefined).finally(() => {
+                if (current === attempt)
+                    current = undefined;
+            });
+            return attempt;
+        },
+        pending() {
+            return current;
+        },
+    };
+    const tokens = new TokenManager({
+        store,
+        displayName: WORKBUDDY_PROVIDER_NAME,
+        // Refresh a minute before the hour runs out, as the app does.
+        preemptMs: WORKBUDDY_EARLY_MS,
+        refresh: async (session) => {
+            const token = {
+                accessToken: session.accessToken,
+                expiresAt: session.expiresAt,
+                ...session.refreshToken === undefined ? {} : { refreshToken: session.refreshToken },
+                ...session.uid === undefined ? {} : { uid: session.uid },
+                ...session.enterpriseId === undefined ? {} : { enterpriseId: session.enterpriseId },
+                ...session.domain === undefined ? {} : { domain: session.domain },
+                ...session.tokenType === undefined ? {} : { tokenType: session.tokenType },
+                ...session.refreshExpiresAt === undefined ? {} : { refreshExpiresAt: session.refreshExpiresAt },
+            };
+            if (!workbuddyRefreshable(token)) {
+                throw new ProviderError(`${WORKBUDDY_PROVIDER_NAME} sign-in has expired; connect the account again`, REAUTH_REQUIRED);
+            }
+            try {
+                const renewed = await refreshWorkBuddyToken(token, fetchFn);
+                return { accessToken: renewed.accessToken, expiresAt: renewed.expiresAt };
+            }
+            catch (error) {
+                throw new ProviderError(`${WORKBUDDY_PROVIDER_NAME} token refresh failed: ${error instanceof Error ? error.message : String(error)}`, REAUTH_REQUIRED);
+            }
+        },
+    });
+    const adapter = new WorkBuddyAdapter({
+        streamIdleTimeoutMs: options.streamIdleTimeoutMs,
+        tokens,
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+        hiddenModels: () => options.preferences.hiddenIds(WORKBUDDY_PROVIDER_ID),
+        userModels: () => options.preferences.extraIds(WORKBUDDY_PROVIDER_ID),
+        fetchFn,
+    });
+    const spec = {
+        id: WORKBUDDY_PROVIDER_ID,
+        displayName: WORKBUDDY_PROVIDER_NAME,
+        codeUrl: WORKBUDDY_CODE_URL,
+        credentialFile: options.credentialFile,
+        // WorkBuddy ships a fixed catalog; there is no discovery endpoint.
+        discovery: false,
+        defaultModel: options.defaultModel ?? WORKBUDDY_DEFAULT_MODEL,
+        catalog: () => adapter.catalogEntries(),
+        catalogOwn: () => adapter.ownCatalogEntries(),
+        fallbackContextWindow: WORKBUDDY_CATALOG[0]?.contextWindow ?? 0,
+        discover: () => Promise.resolve(undefined),
+        usage: () => Promise.resolve({ windows: [] }),
+        details: () => [
+            { key: 'provider', value: WORKBUDDY_PROVIDER_NAME },
+            { key: 'endpoint', value: 'https://copilot.tencent.com' },
+            { key: 'credentialFile', value: options.credentialFile },
+        ],
+        applyDiscovery: () => { },
+    };
+    const controller = new ProviderController({
+        spec,
+        store,
+        tokens,
+        flow,
+        preferences: options.preferences,
+        ...options.onCatalogChanged === undefined ? {} : { onCatalogChanged: options.onCatalogChanged },
+        ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
+    });
+    return {
+        id: controller.id,
+        displayName: controller.displayName,
+        credentialFile: controller.credentialFile,
+        adapter,
+        status: () => controller.status(),
+        login: (account) => controller.login(account),
+        cancel: () => controller.cancel(),
+        logout: (account) => controller.logout(account),
+        setDefault: (account) => controller.setDefault(account),
+        refresh: (account) => controller.refresh(account),
+        discover: (force) => controller.discover(force),
+        setModelVisible: (id, visible) => controller.setModelVisible(id, visible),
+        setModelOrder: (ids) => controller.setModelOrder(ids),
+        addModel: (id) => controller.addModel(id),
+        removeModel: (id) => controller.removeModel(id),
+        usage: (force) => controller.usage(force),
+        reload: () => controller.reload(),
+    };
+}

package/lib/providers/workbuddy.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The WorkBuddy China wire adapter serving the `workbuddy` route.
+ *
+ * WorkBuddy chats are chat completions at `https://copilot.tencent.com/v2/chat/completions`,
+ * streamed only, and the API refuses a request whose User-Agent is not
+ * `WorkBuddy/<version>`. The route ships the China build's catalog (Hy, GLM, Kimi,
+ * DeepSeek, MiniMax). Adapted from magpie's `workbuddy` for this plugin's contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy
+ */
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmProviderInfo, type LlmResolvedModelInfo, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { type FetchFn } from '../http.js';
+import type { TokenManager } from '../auth/tokens.js';
+import type { CatalogEntry } from './catalog.js';
+import { type WorkBuddySession } from '../auth/workbuddy-flow.js';
+/** The `workbuddy` provider route key (China build). */
+export declare const WORKBUDDY_PROVIDER_ID = "workbuddy";
+/** Human name for the route and its cards. */
+export declare const WORKBUDDY_PROVIDER_NAME = "WorkBuddy";
+/** Where the Settings page sends someone to get an account. */
+export declare const WORKBUDDY_CODE_URL = "https://copilot.tencent.com";
+/** The model the picker preselects. */
+export declare const WORKBUDDY_DEFAULT_MODEL = "hy4-preview-f";
+/** One signed-in WorkBuddy session, as stored. */
+export interface WorkBuddyStored {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    accountId?: string;
+    email?: string;
+    uid?: string;
+    enterpriseId?: string;
+    domain?: string;
+    tokenType?: string;
+    refreshExpiresAt?: number;
+}
+/** The catalog the route serves. */
+export declare const WORKBUDDY_CATALOG: readonly CatalogEntry[];
+/** Constructor dependencies for {@link WorkBuddyAdapter}. */
+export interface WorkBuddyAdapterOptions {
+    streamIdleTimeoutMs: number;
+    tokens: TokenManager<WorkBuddySession>;
+    onWarn?: (message: string) => void;
+    hiddenModels?: () => Promise<ReadonlySet<string>>;
+    userModels?: () => Promise<readonly string[]>;
+    fetchFn?: FetchFn;
+}
+/** The WorkBuddy China wire adapter serving the `workbuddy` route. */
+export declare class WorkBuddyAdapter extends LlmAdapter {
+    private readonly options;
+    private readonly fetchFn;
+    constructor(options: WorkBuddyAdapterOptions);
+    providerInfo(provider: string): LlmProviderInfo;
+    listModels(_provider: string): Promise<readonly LlmModelInfo[]>;
+    private hidden;
+    /** The catalog the Settings list reads. */
+    catalogEntries(): readonly CatalogEntry[];
+    /** The entries the route itself serves, without hand-added extras. */
+    ownCatalogEntries(): readonly CatalogEntry[];
+    resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    providerRetryPolicy(): undefined;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** The stored session's fields as the token the request signs with. */
+    private tokenOf;
+    private requestBody;
+    private toChatMessage;
+    /** Turn a non-2xx into an LlmError, naming WorkBuddy's specific refusals. */
+    private errorOf;
+    private readStream;
+}

package/lib/providers/workbuddy.js

@@ -0,0 +1,269 @@
+/**
+ * The WorkBuddy China wire adapter serving the `workbuddy` route.
+ *
+ * WorkBuddy chats are chat completions at `https://copilot.tencent.com/v2/chat/completions`,
+ * streamed only, and the API refuses a request whose User-Agent is not
+ * `WorkBuddy/<version>`. The route ships the China build's catalog (Hy, GLM, Kimi,
+ * DeepSeek, MiniMax). Adapted from magpie's `workbuddy` for this plugin's contracts.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/workbuddy
+ */
+import { LlmAdapter, errorChain, ReasoningEffortId, } from '@deepseek-ai/dsh-llm';
+import { idleWatchdog, mapFetchFailure } from './common.js';
+import { proxiedFetch } from '../http.js';
+import { findEntry } from './catalog.js';
+import { WORKBUDDY_ENDPOINT, WORKBUDDY_UA_VERSION, workbuddyHeaders } from '../auth/workbuddy-flow.js';
+/** The `workbuddy` provider route key (China build). */
+export const WORKBUDDY_PROVIDER_ID = 'workbuddy';
+/** Human name for the route and its cards. */
+export const WORKBUDDY_PROVIDER_NAME = 'WorkBuddy';
+/** Where the Settings page sends someone to get an account. */
+export const WORKBUDDY_CODE_URL = 'https://copilot.tencent.com';
+/** The chat completions endpoint. */
+const WORKBUDDY_API = `${WORKBUDDY_ENDPOINT}/v2/chat/completions`;
+/** The model the picker preselects. */
+export const WORKBUDDY_DEFAULT_MODEL = 'hy4-preview-f';
+/** The China build's catalog, [id, name, context, efforts?]. */
+const CN_MODELS = [
+    ['auto', 'Auto', 168_000],
+    ['hy4-preview-f', 'Hy4 preview', 1_000_000, ['high']],
+    ['hy3', 'Hy3', 192_000, ['low', 'high']],
+    ['hy3-x', 'Hy3-X', 192_000, ['low', 'high']],
+    ['deepseek-v4.1-flash', 'Deepseek-V4.1-Flash', 1_000_000],
+    ['glm-5.3', 'GLM-5.3', 1_000_000, ['low', 'high', 'max']],
+    ['glm-5.3-flash', 'GLM-5.3-Flash', 1_000_000, ['low', 'high', 'max']],
+    ['glm-5.2', 'GLM-5.2', 1_000_000, ['high', 'xhigh']],
+    ['glm-5.1', 'GLM-5.1', 200_000],
+    ['glm-5v-turbo', 'GLM-5v-Turbo', 200_000],
+    ['minimax-m3', 'MiniMax-M3', 512_000],
+    ['kimi-k3-1', 'Kimi-K3', 1_000_000, ['low', 'high', 'xhigh']],
+    ['kimi-k2.7', 'Kimi-K2.7-Code', 256_000],
+    ['kimi-k2.6', 'Kimi-K2.6', 256_000],
+    ['deepseek-v4-pro', 'Deepseek-V4-Pro', 1_000_000, ['none', 'high', 'xhigh']],
+];
+/** The catalog the route serves. */
+export const WORKBUDDY_CATALOG = CN_MODELS.map((entry) => {
+    const [id, name, contextWindow, efforts] = entry;
+    return {
+        id,
+        name,
+        contextWindow,
+        ...efforts === undefined ? {} : { reasoningEfforts: efforts },
+    };
+});
+/** The WorkBuddy China wire adapter serving the `workbuddy` route. */
+export class WorkBuddyAdapter extends LlmAdapter {
+    options;
+    fetchFn;
+    constructor(options) {
+        super();
+        this.options = options;
+        this.fetchFn = options.fetchFn ?? proxiedFetch;
+    }
+    providerInfo(provider) {
+        return { id: provider, name: WORKBUDDY_PROVIDER_NAME };
+    }
+    async listModels(_provider) {
+        if (await this.options.tokens.session() === undefined)
+            return [];
+        const hidden = await this.hidden();
+        return WORKBUDDY_CATALOG.filter((entry) => !hidden.has(entry.id)).map((entry) => ({
+            provider: WORKBUDDY_PROVIDER_ID,
+            id: entry.id,
+            name: entry.name,
+            ...entry.description === undefined ? {} : { description: entry.description },
+            ...entry.inputModalities === undefined ? {} : { inputModalities: entry.inputModalities },
+        }));
+    }
+    async hidden() {
+        if (this.options.hiddenModels === undefined)
+            return new Set();
+        try {
+            return await this.options.hiddenModels();
+        }
+        catch {
+            return new Set();
+        }
+    }
+    /** The catalog the Settings list reads. */
+    catalogEntries() {
+        return WORKBUDDY_CATALOG;
+    }
+    /** The entries the route itself serves, without hand-added extras. */
+    ownCatalogEntries() {
+        return WORKBUDDY_CATALOG;
+    }
+    async resolveModel(_provider, model) {
+        const entry = findEntry(WORKBUDDY_CATALOG, model);
+        if (entry === undefined) {
+            return {
+                provider: WORKBUDDY_PROVIDER_ID,
+                id: model,
+                name: model,
+                context: { contextWindow: 0 },
+                inputModalities: ['text', 'image'],
+            };
+        }
+        return {
+            provider: WORKBUDDY_PROVIDER_ID,
+            id: entry.id,
+            name: entry.name,
+            ...entry.description === undefined ? {} : { description: entry.description },
+            ...entry.inputModalities === undefined ? {} : { inputModalities: entry.inputModalities },
+            context: { contextWindow: entry.contextWindow },
+            ...entry.reasoningEfforts === undefined || entry.reasoningEfforts.length === 0
+                ? {}
+                : { reasoning: { efforts: entry.reasoningEfforts.map((id) => ({ id: ReasoningEffortId(id), name: id })) } },
+        };
+    }
+    providerRetryPolicy() {
+        return undefined;
+    }
+    async *stream(options) {
+        const held = await this.options.tokens.session();
+        if (held === undefined)
+            throw new Error('WorkBuddy is not signed in');
+        const token = this.tokenOf(held.session);
+        const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+        try {
+            const response = await this.fetchFn(WORKBUDDY_API, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Accept': 'text/event-stream',
+                    ...workbuddyHeaders(token),
+                },
+                body: JSON.stringify(this.requestBody(options)),
+                signal: watchdog.signal,
+            });
+            if (!response.ok || response.body === null) {
+                throw await this.errorOf(response);
+            }
+            yield* this.readStream(response, watchdog);
+        }
+        catch (error) {
+            throw mapFetchFailure(WORKBUDDY_PROVIDER_NAME, error, watchdog, options.signal);
+        }
+        finally {
+            watchdog.stop();
+        }
+    }
+    /** The stored session's fields as the token the request signs with. */
+    tokenOf(session) {
+        return {
+            accessToken: session.accessToken,
+            expiresAt: session.expiresAt,
+            ...session.refreshToken === undefined ? {} : { refreshToken: session.refreshToken },
+            ...session.uid === undefined ? {} : { uid: session.uid },
+            ...session.enterpriseId === undefined ? {} : { enterpriseId: session.enterpriseId },
+            ...session.domain === undefined ? {} : { domain: session.domain },
+            ...session.tokenType === undefined ? {} : { tokenType: session.tokenType },
+            ...session.refreshExpiresAt === undefined ? {} : { refreshExpiresAt: session.refreshExpiresAt },
+        };
+    }
+    requestBody(options) {
+        const messages = [];
+        if (options.system !== undefined && options.system.trim() !== '') {
+            messages.push({ role: 'system', content: options.system });
+        }
+        for (const message of options.messages) {
+            messages.push(this.toChatMessage(message));
+        }
+        return {
+            model: options.model,
+            messages,
+            ...options.maxTokens === undefined ? {} : { max_tokens: options.maxTokens },
+            stream: true,
+        };
+    }
+    toChatMessage(message) {
+        const role = message.role === 'assistant' ? 'assistant' : 'user';
+        const textParts = [];
+        for (const block of message.content) {
+            if (block.type === 'text')
+                textParts.push(block.text);
+        }
+        return { role, content: textParts.join('\n') };
+    }
+    /** Turn a non-2xx into an LlmError, naming WorkBuddy's specific refusals. */
+    async errorOf(response) {
+        const text = await response.text().catch(() => '');
+        let body = {};
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            body = {};
+        }
+        const code = Number(body.code ?? body.data?.code ?? 0);
+        const message = String(body.msg ?? body.error?.message ?? body.message ?? text.slice(0, 200) ?? `HTTP ${response.status}`);
+        if (/unapproved channel|illegal api invocation/i.test(text)) {
+            return new Error(`${message} — WorkBuddy refuses chats from Codex and Claude Code; use another client or add another provider`);
+        }
+        if (code === 11140 || /account has been restricted due to unusual activity/i.test(text)) {
+            return new Error(`${message} — WorkBuddy restricted this account; it stays out until WorkBuddy lifts that`);
+        }
+        if (code === 14018 || /credits exhausted|额度已用尽/i.test(text)) {
+            return new Error(`${message} — WorkBuddy requires an active credit package even for 0-rate free models`);
+        }
+        const { LlmError } = await import('@deepseek-ai/dsh-llm');
+        return new LlmError(`${WORKBUDDY_PROVIDER_NAME} request failed (HTTP ${response.status}): ${message}`, response.status === 401 || response.status === 403 ? 'INVALID_CREDENTIAL'
+            : response.status === 429 ? 'RATE_LIMIT'
+                : response.status >= 500 ? 'SERVER' : 'HTTP_ERROR', { status: response.status });
+    }
+    async *readStream(response, watchdog) {
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let started = false;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                watchdog.pulse();
+                buffer += decoder.decode(value, { stream: true });
+                const frames = buffer.split('\n\n');
+                buffer = frames.pop() ?? '';
+                for (const frame of frames) {
+                    const data = frame
+                        .split('\n')
+                        .filter((line) => line.startsWith('data:'))
+                        .map((line) => line.slice(5).trim())
+                        .join('\n');
+                    if (data === '' || data === '[DONE]')
+                        continue;
+                    let chunk;
+                    try {
+                        chunk = JSON.parse(data);
+                    }
+                    catch {
+                        continue;
+                    }
+                    const delta = chunk.choices?.[0]?.delta?.content;
+                    if (typeof delta === 'string' && delta !== '') {
+                        if (!started) {
+                            yield { type: 'block-start', index: 0, blockType: 'text' };
+                            started = true;
+                        }
+                        yield { type: 'text-delta', index: 0, text: delta };
+                    }
+                    if (chunk.usage !== undefined) {
+                        const input = chunk.usage.prompt_tokens ?? 0;
+                        const output = chunk.usage.completion_tokens ?? 0;
+                        yield {
+                            type: 'usage',
+                            usage: { inputTokens: input, outputTokens: output, totalTokens: chunk.usage.total_tokens ?? input + output },
+                        };
+                    }
+                }
+            }
+            if (started)
+                yield { type: 'block-end', index: 0, block: { type: 'text', text: '' } };
+            yield { type: 'finish', reason: { kind: 'stop' } };
+        }
+        finally {
+            reader.cancel().catch(() => { });
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",