dsh-plugin-subscriptions 0.1.0

package/lib/providers/claude.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Claude Pro/Max subscription provider: OAuth against claude.ai /
+ * platform.claude.com with the Claude Code client id, and streaming against
+ * the Anthropic Messages API with the Claude Code identity headers.
+ */
+import { LlmAdapter } from '@deepseek-ai/dsh-llm';
+import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
+import type { FlowSpec } from '../auth/oauth-flow.js';
+import type { ClaudeSession } from '../auth/store.js';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import { TokenManager } from './common.js';
+import type { ModelEntry } from './common.js';
+export declare const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+export declare const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+export declare const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+export declare const CLAUDE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
+export declare const CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+/** Refresh when the access token has less than this much life left. */
+export declare const CLAUDE_PREEMPT_MS: number;
+/** Static claude flow facts for the OAuth flow engine. */
+export declare const claudeFlow: FlowSpec;
+/**
+ * Exchange an authorization code for a claude session (JSON grant).
+ * @param code - the authorization code from the callback.
+ * @param verifier - the PKCE verifier minted for the attempt.
+ * @param redirectUri - the attempt's redirect URI.
+ * @param state - the attempt's state (echoed to the token endpoint).
+ * @returns the session to store.
+ */
+export declare function exchangeClaudeCode(code: string, verifier: string, redirectUri: string, state: string): Promise<ClaudeSession>;
+/**
+ * Refresh a claude session (JSON grant echoing the issued scope).
+ * @param session - the stored session.
+ * @returns the fresh session to store.
+ */
+export declare function refreshClaude(session: ClaudeSession): Promise<ClaudeSession>;
+/**
+ * Whether a claude refresh failure means the login is permanently gone.
+ * @param error - the thrown refresh error.
+ * @returns true when re-login is the only fix.
+ */
+export declare function isClaudePermanentRefreshError(error: unknown): boolean;
+/** Constructor dependencies for {@link ClaudeAdapter}. */
+export interface ClaudeAdapterOptions {
+    models: readonly ModelEntry[];
+    streamIdleTimeoutMs: number;
+    tokens: TokenManager<ClaudeSession>;
+    /** Resolve the attachment service per request; absent means image requests fail loudly. */
+    resolveAttachments?: () => AttachmentStore | undefined;
+}
+/** Claude wire adapter: one instance serves the `claude` provider route. */
+export declare class ClaudeAdapter extends LlmAdapter {
+    private readonly options;
+    constructor(options: ClaudeAdapterOptions);
+    providerInfo(provider: string): LlmProviderInfo;
+    listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    private request;
+}

package/lib/providers/claude.js

@@ -0,0 +1,243 @@
+/**
+ * Claude Pro/Max subscription provider: OAuth against claude.ai /
+ * platform.claude.com with the Claude Code client id, and streaming against
+ * the Anthropic Messages API with the Claude Code identity headers.
+ */
+import { EMPTY_RESPONSE_CODE, LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
+import { resolveImages } from '../translate/resolved.js';
+import { streamAnthropic, toAnthropicMessages, toAnthropicSystem, toAnthropicTools, } from '../translate/anthropic.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+export const CLAUDE_AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
+export const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+export const CLAUDE_API_URL = 'https://api.anthropic.com/v1/messages?beta=true';
+export const CLAUDE_PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
+const CLAUDE_SCOPE = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
+const CLAUDE_CALLBACK_PATH = '/callback';
+const CLAUDE_CONTEXT_WINDOW = 200_000;
+const CLAUDE_DEFAULT_MAX_TOKENS = 32_000;
+/** Refresh when the access token has less than this much life left. */
+export const CLAUDE_PREEMPT_MS = 5 * 60_000;
+/**
+ * The subscription endpoint only serves requests presenting as Claude Code,
+ * so these headers impersonate the CLI; the harness attribution user-agent
+ * cannot be sent here (one user-agent slot, and the CLI's wins).
+ */
+const CLAUDE_CLI_USER_AGENT = 'claude-cli/2.1.97 (external, cli)';
+const CLAUDE_BETA_FLAGS = 'claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27';
+/** Static claude flow facts for the OAuth flow engine. */
+export const claudeFlow = {
+    callbackPath: CLAUDE_CALLBACK_PATH,
+    // The redirect URI embeds the port, so it must be an ephemeral one.
+    listen: { host: 'localhost', ports: [0] },
+    buildAuthorizeUrl({ redirectUri, state, pkce }) {
+        const params = new URLSearchParams({
+            code: 'true',
+            client_id: CLAUDE_CLIENT_ID,
+            response_type: 'code',
+            redirect_uri: redirectUri,
+            scope: CLAUDE_SCOPE,
+            code_challenge: pkce.challenge,
+            code_challenge_method: 'S256',
+            state,
+        });
+        return `${CLAUDE_AUTHORIZE_URL}?${params.toString()}`;
+    },
+};
+/** Best-effort account profile; login must not fail when this does. */
+async function fetchClaudeProfile(accessToken) {
+    try {
+        const response = await fetch(CLAUDE_PROFILE_URL, {
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+        if (!response.ok)
+            return {};
+        const profile = await response.json();
+        const account = typeof profile.account === 'object' && profile.account !== null
+            ? profile.account
+            : {};
+        const email = profile.emailAddress ?? profile.email ?? account.email_address ?? account.email;
+        const subscription = profile.subscriptionType ?? profile.subscription_type ?? account.subscription_type;
+        return {
+            ...typeof email === 'string' && email.length > 0 ? { emailAddress: email } : {},
+            ...typeof subscription === 'string' && subscription.length > 0 ? { subscriptionType: subscription } : {},
+        };
+    }
+    catch {
+        // Profile lookup is decorative; only the token exchange owns login success.
+        return {};
+    }
+}
+/** Build a session from a token response. */
+async function claudeSession(tokens, fallbackRefreshToken, withProfile) {
+    if (typeof tokens.access_token !== 'string' || tokens.access_token.length === 0) {
+        throw new Error('claude token endpoint returned no access token');
+    }
+    const refreshToken = tokens.refresh_token ?? fallbackRefreshToken;
+    if (refreshToken === undefined)
+        throw new Error('claude token endpoint returned no refresh token');
+    if (typeof tokens.expires_in !== 'number' || tokens.expires_in <= 0) {
+        throw new Error('claude token endpoint returned no usable expiry');
+    }
+    const profile = withProfile ? await fetchClaudeProfile(tokens.access_token) : {};
+    return {
+        accessToken: tokens.access_token,
+        refreshToken,
+        expiresAt: Date.now() + tokens.expires_in * 1000,
+        scopes: tokens.scope ?? CLAUDE_SCOPE,
+        ...profile,
+    };
+}
+/**
+ * Exchange an authorization code for a claude session (JSON grant).
+ * @param code - the authorization code from the callback.
+ * @param verifier - the PKCE verifier minted for the attempt.
+ * @param redirectUri - the attempt's redirect URI.
+ * @param state - the attempt's state (echoed to the token endpoint).
+ * @returns the session to store.
+ */
+export async function exchangeClaudeCode(code, verifier, redirectUri, state) {
+    const response = await fetch(CLAUDE_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: CLAUDE_CLIENT_ID,
+            code_verifier: verifier,
+            state,
+        }),
+    });
+    if (!response.ok)
+        throw await oauthEndpointError(response, 'claude');
+    return claudeSession(await response.json(), undefined, true);
+}
+/**
+ * Refresh a claude session (JSON grant echoing the issued scope).
+ * @param session - the stored session.
+ * @returns the fresh session to store.
+ */
+export async function refreshClaude(session) {
+    const response = await fetch(CLAUDE_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            refresh_token: session.refreshToken,
+            client_id: CLAUDE_CLIENT_ID,
+            scope: session.scopes,
+        }),
+    });
+    if (!response.ok)
+        throw await oauthEndpointError(response, 'claude');
+    const next = await claudeSession(await response.json(), session.refreshToken, false);
+    return {
+        ...next,
+        ...session.emailAddress === undefined ? {} : { emailAddress: session.emailAddress },
+        ...session.subscriptionType === undefined ? {} : { subscriptionType: session.subscriptionType },
+    };
+}
+/**
+ * Whether a claude refresh failure means the login is permanently gone.
+ * @param error - the thrown refresh error.
+ * @returns true when re-login is the only fix.
+ */
+export function isClaudePermanentRefreshError(error) {
+    return error instanceof OAuthEndpointError
+        && (error.oauthCode === 'invalid_grant' || error.oauthCode === 'invalid_token');
+}
+/** The Claude 4.5 family accepts image input. */
+const CLAUDE_MODALITIES = ['text', 'image'];
+/** Claude wire adapter: one instance serves the `claude` provider route. */
+export class ClaudeAdapter extends LlmAdapter {
+    options;
+    constructor(options) {
+        super();
+        this.options = options;
+    }
+    providerInfo(provider) {
+        return { id: provider, name: 'Claude (Subscription)' };
+    }
+    async listModels(provider) {
+        // Not logged in → empty catalog, so the web picker drops the provider.
+        // Claude has no subscription model-list endpoint, so the static catalog
+        // is the whole answer when logged in.
+        if (!await this.options.tokens.hasSession())
+            return [];
+        return this.options.models.map(model => ({
+            provider,
+            id: model.id,
+            name: model.name ?? model.id,
+            inputModalities: model.inputModalities ?? CLAUDE_MODALITIES,
+        }));
+    }
+    resolveModel(provider, model) {
+        const configured = this.options.models.find(entry => entry.id === model);
+        return Promise.resolve({
+            provider,
+            id: model,
+            name: configured?.name ?? model,
+            inputModalities: configured?.inputModalities ?? CLAUDE_MODALITIES,
+            context: { contextWindow: configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
+            defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+            // No reasoning metadata: the subscription endpoint's thinking support is
+            // not exercised, so effort requests reject as unsupported.
+        });
+    }
+    async *stream(options) {
+        const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+        try {
+            let session = await this.options.tokens.session();
+            let response = await this.request(options, session, watchdog.signal);
+            if (response.status === 401) {
+                // One forced refresh + retry on an unexpired-but-rejected token.
+                session = await this.options.tokens.session(true);
+                response = await this.request(options, session, watchdog.signal);
+            }
+            if (!response.ok)
+                throw await httpLlmError(response, 'claude API');
+            if (response.body === null) {
+                throw new LlmError('claude API returned no response body', EMPTY_RESPONSE_CODE);
+            }
+            yield* streamAnthropic(response.body, () => { watchdog.pulse(); });
+        }
+        catch (error) {
+            throw mapFetchFailure('claude API', error, watchdog, options.signal);
+        }
+        finally {
+            watchdog.stop();
+        }
+    }
+    async request(options, session, signal) {
+        const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
+        const body = {
+            model: options.model,
+            max_tokens: options.maxTokens
+                ?? this.options.models.find(entry => entry.id === options.model)?.maxTokens
+                ?? CLAUDE_DEFAULT_MAX_TOKENS,
+            system: toAnthropicSystem(options.system, messages),
+            messages: toAnthropicMessages(messages),
+            ...options.tools !== undefined && options.tools.length > 0
+                ? { tools: toAnthropicTools(options.tools) }
+                : {},
+            stream: true,
+            ...options.sessionId !== undefined ? { metadata: { user_id: String(options.sessionId) } } : {},
+        };
+        return fetch(CLAUDE_API_URL, {
+            method: 'POST',
+            headers: {
+                'authorization': `Bearer ${session.accessToken}`,
+                'anthropic-version': '2023-06-01',
+                'anthropic-beta': CLAUDE_BETA_FLAGS,
+                'user-agent': CLAUDE_CLI_USER_AGENT,
+                'x-app': 'cli',
+                'anthropic-dangerous-direct-browser-access': 'true',
+                'accept': 'text/event-stream',
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify(body),
+            signal,
+        });
+    }
+}

package/lib/providers/codex.d.ts

@@ -0,0 +1,96 @@
+/**
+ * ChatGPT/Codex subscription provider: OAuth against auth.openai.com with the
+ * Codex CLI client id, and streaming against the ChatGPT backend Responses
+ * endpoint.
+ */
+import { LlmAdapter } from '@deepseek-ai/dsh-llm';
+import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
+import type { FlowSpec } from '../auth/oauth-flow.js';
+import type { CodexSession } from '../auth/store.js';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import { TokenManager } from './common.js';
+import type { DiscoveredModel, FetchFn, ModelEntry } from './common.js';
+export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const CODEX_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+export declare const CODEX_API_URL = "https://chatgpt.com/backend-api/codex/responses";
+/** Refresh when the access token has less than this much life left. */
+export declare const CODEX_PREEMPT_MS: number;
+/** Static codex flow facts for the OAuth flow engine. */
+export declare const codexFlow: FlowSpec;
+/** User identity claims decoded from a codex id token. */
+export interface CodexProfileClaims {
+    emailAddress?: string;
+    planType?: string;
+}
+/**
+ * Decode the user-identity claims of a codex id token (pure, cheap — no
+ * verification, same trust posture as {@link accountIdOf}). Claim paths
+ * mirror codex-rs `login/src/token_data.rs`: the email is the top-level
+ * `email` claim, falling back to `https://api.openai.com/profile`.email; the
+ * plan is `https://api.openai.com/auth`.chatgpt_plan_type.
+ * @param idToken - a stored or freshly issued id token, when present.
+ * @returns whichever claims the token carried; empty when undecodable.
+ */
+export declare function codexProfileClaims(idToken: string | undefined): CodexProfileClaims;
+/**
+ * Exchange an authorization code for a codex session (form-encoded grant).
+ * @param code - the authorization code from the callback.
+ * @param verifier - the PKCE verifier minted for the attempt.
+ * @param redirectUri - the attempt's redirect URI.
+ * @returns the session to store.
+ */
+export declare function exchangeCodexCode(code: string, verifier: string, redirectUri: string): Promise<CodexSession>;
+/**
+ * Refresh a codex session (JSON grant — unlike the code exchange).
+ * @param session - the stored session.
+ * @returns the fresh session to store.
+ */
+export declare function refreshCodex(session: CodexSession): Promise<CodexSession>;
+/**
+ * Whether a codex refresh failure means the login is permanently gone.
+ * @param error - the thrown refresh error.
+ * @returns true when re-login is the only fix.
+ */
+export declare function isCodexPermanentRefreshError(error: unknown): boolean;
+export declare const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
+/**
+ * Client version sent on the /models catalog request. The backend gates the
+ * visible model list by client version: versions below ~0.101 get an empty
+ * list, while current codex CLI releases get the full catalog — keep this in
+ * the range of current codex CLI releases.
+ */
+export declare const CODEX_CLIENT_VERSION = "0.147.0";
+/**
+ * Fetch the live codex model catalog with the session's auth headers.
+ * @param session - the stored session (used as-is; never refreshed here).
+ * @param fetchFn - fetch implementation (injectable for tests).
+ * @returns discovered models: hidden entries dropped, sorted by priority.
+ */
+export declare function fetchCodexModels(session: CodexSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
+/** Constructor dependencies for {@link CodexAdapter}. */
+export interface CodexAdapterOptions {
+    models: readonly ModelEntry[];
+    streamIdleTimeoutMs: number;
+    tokens: TokenManager<CodexSession>;
+    /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
+    discovery: boolean;
+    /** Warning sink for discovery failures that fall back to the static catalog. */
+    onWarn?: (message: string) => void;
+    /** Fetch implementation for discovery (defaults to global fetch). */
+    fetchFn?: FetchFn;
+    /** Resolve the attachment service per request; absent means image requests fail loudly. */
+    resolveAttachments?: () => AttachmentStore | undefined;
+}
+/** Codex wire adapter: one instance serves the `codex` provider route. */
+export declare class CodexAdapter extends LlmAdapter {
+    private readonly options;
+    private readonly catalog;
+    constructor(options: CodexAdapterOptions);
+    providerInfo(provider: string): LlmProviderInfo;
+    private staticModels;
+    listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    private request;
+}