dsh-plugin-subscriptions 0.4.0 → 0.4.2

package/README.md

@@ -2,11 +2,11 @@
 
 English | [中文](README.zh.md)
 
-Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Login happens in the dsh web UI (Settings → Subscriptions); tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
+Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials directly from an existing Claude Code session (macOS Keychain or `~/.claude/.credentials.json`). Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
 
 ## Demo
 
-Settings → **Subscriptions**: per-provider OAuth login/logout, no API keys (account address masked in the screenshot):
+Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code; Codex and Grok use OAuth (account address masked in the screenshot):
 
 ![Subscriptions settings page](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -22,12 +22,20 @@ The `image_generate` tool renders its result inline in the conversation:
 
 ![image_generate renders the image inline](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/image-generate-inline.png)
 
+Its `provider` parameter picks the image backend — the same prompt through GPT (`gpt-image-2`, top) and Grok (`grok-imagine-image-2.0`, bottom):
+
+![image_generate with provider gpt vs grok](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/image-generate-providers.png)
+
+The `video_generate` tool plays the generated clip inline:
+
+![video_generate plays the clip inline](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/video-generate-inline.png)
+
 ## Providers
 
 | Route    | Subscription      | Models |
 |----------|-------------------|--------|
 | `codex`  | ChatGPT Plus/Pro  | live catalog from `chatgpt.com/backend-api/codex/models` |
-| `claude` | Claude Pro/Max    | claude-opus-4-5, claude-sonnet-4-5, claude-haiku-4-5 |
+| `claude` | Claude Pro/Max    | all models available in your subscription (Opus, Sonnet, Haiku, Fable — static catalog, updated with the plugin) |
 | `grok`   | X Premium (xAI)   | live catalog from `api.x.ai/v1/models` (chat models only); reasoning efforts from the Grok CLI catalog (`cli-chat-proxy.grok.com/v1/models`) |
 
 Only logged-in providers appear in the session model picker; the lists above refresh on login/logout. Vision-capable models declare `['text', 'image']` input modalities, and image content is translated to each provider's wire format.
@@ -37,7 +45,7 @@ Logged-in cards also show **subscription usage** — per rate-limit window (5-ho
 Also included, registered when the matching provider is enabled:
 
 - **`x_search`** tool (Grok) — xAI's hosted X search, returning `{ answer, citations }`.
-- **`image_generate`** tool (ChatGPT) — `gpt-image-2` via the Codex backend; PNGs are saved under `~/.dsh/plugins/subscriptions/images/` and the paths returned.
+- **`image_generate`** tool (ChatGPT or Grok) — `gpt-image-2` via the Codex backend, or `grok-imagine-image-2.0` via `api.x.ai/v1/images/generations`. The `provider` argument picks the preferred provider (`gpt`, the default, or `grok`); when the preferred one is logged out the other serves as fallback. Images are saved under `~/.dsh/plugins/subscriptions/images/` and the paths returned. The `size`/`quality` arguments map onto Grok's `aspect_ratio`/`quality` on the Grok path.
 - **`video_generate`** tool (Grok) — `grok-imagine-video-1.5` via `api.x.ai/v1/videos` (async submit + poll); MP4s are saved under `~/.dsh/plugins/subscriptions/videos/`, the path returned, and the clip plays inline in the conversation. Supports duration (1–15 s), aspect ratio, resolution, and image-to-video via `image_url`.
 
 ## Install
@@ -93,7 +101,7 @@ Either way, restart `dsh web` afterwards so the new version loads.
 ## Use
 
 1. `dsh web`, open the printed URL.
-2. Settings → **Subscriptions**: click **Log in** on a provider and authorize in the opened tab. If the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
+2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly from Claude Code (you must have run `claude` and logged in at least once). For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
 3. In any session, open the model picker (`/model`) and choose a model under **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)**.
 
 Not logged in? The provider stays out of the picker, and requests fail with `MISSING_CREDENTIAL` pointing at the Settings page; nothing else breaks.
@@ -126,7 +134,7 @@ After `pnpm build`, restart `dsh web` to pick up changes.
 ## Layout
 
 - `src/index.ts` — plugin entry: config schema, adapter registration, auth-change re-announce, RPC wiring
-- `src/auth/` — PKCE/JWT helpers, token store, OAuth flow engine (temp loopback callback server), `/subscriptions-auth` RPC channel
+- `src/auth/` — PKCE/JWT helpers, token store, OAuth flow engine (temp loopback callback server), Claude Code credential reader (Keychain/file), `/subscriptions-auth` RPC channel
 - `src/providers/` — per-provider OAuth constants/exchange/refresh + `LlmAdapter`s
 - `src/translate/` — dsh `Message[]` ⟷ OpenAI Responses / Anthropic Messages wire formats, SSE → `StreamChunk`
 - `src/tools/` — `x_search`, `image_generate`, and `video_generate`

package/README.zh.md

@@ -2,11 +2,11 @@
 
 [English](README.md) | 中文
 
-把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。登录在 dsh web 界面完成(设置 → 订阅);token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
+把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 直接从已有的 Claude Code 会话导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`)。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
 
 ## 演示
 
-设置 → **订阅**:每个 provider 的 OAuth 登录/退出,无需 API key(截图中账号已打码):
+设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 从 Claude Code 导入凭据;Codex 和 Grok 使用 OAuth(截图中账号已打码):
 
 ![订阅设置页](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -22,12 +22,20 @@
 
 ![image_generate 内联显示生成的图片](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/image-generate-inline.png)
 
+`provider` 参数可选择生图后端——同一条提示词分别走 GPT(`gpt-image-2`,上)和 Grok(`grok-imagine-image-2.0`,下):
+
+![image_generate 的 provider 参数对比 gpt 与 grok](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/image-generate-providers.png)
+
+`video_generate` 工具生成的视频直接内联播放:
+
+![video_generate 内联播放生成的视频](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/video-generate-inline.png)
+
 ## Provider 一览
 
 | 路由     | 订阅             | 模型 |
 |----------|------------------|------|
 | `codex`  | ChatGPT Plus/Pro | 从 `chatgpt.com/backend-api/codex/models` 实时获取 |
-| `claude` | Claude Pro/Max   | claude-opus-4-5、claude-sonnet-4-5、claude-haiku-4-5 |
+| `claude` | Claude Pro/Max   | 订阅内所有可用模型(Opus、Sonnet、Haiku、Fable —— 静态目录,随插件更新) |
 | `grok`   | X Premium (xAI)  | 从 `api.x.ai/v1/models` 实时获取(仅对话模型);推理等级来自 Grok CLI 目录(`cli-chat-proxy.grok.com/v1/models`) |
 
 只有已登录的 provider 才会出现在会话模型选择器里;登录/退出后列表自动刷新。支持视觉的模型会声明 `['text', 'image']` 输入模态,图片内容会被翻译成各 provider 的 wire 格式。
@@ -37,7 +45,7 @@
 随 provider 启用自动注册的工具:
 
 - **`x_search`**(Grok)—— xAI 托管的 X 搜索,返回 `{ answer, citations }`。
-- **`image_generate`**(ChatGPT)—— 经 Codex 后端调用 `gpt-image-2`;生成的 PNG 保存到 `~/.dsh/plugins/subscriptions/images/` 并返回路径。
+- **`image_generate`**(ChatGPT 或 Grok)—— 经 Codex 后端调用 `gpt-image-2`,或经 `api.x.ai/v1/images/generations` 调用 `grok-imagine-image-2.0`。`provider` 参数指定首选提供方(`gpt` 为默认值,可选 `grok`);首选方未登录时自动回退到另一方。图片保存到 `~/.dsh/plugins/subscriptions/images/` 并返回路径。Grok 路径上 `size`/`quality` 参数会映射为 Grok 的 `aspect_ratio`/`quality`。
 - **`video_generate`**(Grok)—— 经 `api.x.ai/v1/videos` 调用 `grok-imagine-video-1.5`(异步提交 + 轮询);MP4 保存到 `~/.dsh/plugins/subscriptions/videos/` 并返回路径,视频直接在对话里内联播放。支持时长(1–15 秒)、宽高比、分辨率,以及通过 `image_url` 做图生视频。
 
 ## 安装
@@ -93,7 +101,7 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 ## 使用
 
 1. `dsh web`,打开打印的 URL。
-2. **设置 → 订阅**:点对应 provider 的「登录」,在打开的标签页里授权。无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
+2. **设置 → 订阅**:点对应 provider 的「连接」。Claude 会即时从 Claude Code 导入凭据(需先运行过 `claude` 并登录)。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
 3. 在任意会话里打开模型选择器(`/model`),选择 **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)** 下的模型。
 
 未登录时:该 provider 不出现在选择器里;直接请求会报 `MISSING_CREDENTIAL` 并提示去设置页登录,不影响其他功能。
@@ -126,7 +134,7 @@ pnpm test      # 编译后跑 node --test 单测
 ## 目录结构
 
 - `src/index.ts` —— 插件入口:配置 schema、adapter 注册、登录态变更通告、RPC 接线
-- `src/auth/` —— PKCE/JWT 工具、token 存储、OAuth 流程引擎(临时本地回调服务)、`/subscriptions-auth` RPC 通道
+- `src/auth/` —— PKCE/JWT 工具、token 存储、OAuth 流程引擎(临时本地回调服务)、Claude Code 凭据读取器(Keychain/文件)、`/subscriptions-auth` RPC 通道
 - `src/providers/` —— 各 provider 的 OAuth 常量/换发/刷新 + `LlmAdapter` 实现
 - `src/translate/` —— dsh `Message[]` 与 OpenAI Responses / Anthropic Messages 格式互转,SSE → `StreamChunk`
 - `src/tools/` —— `x_search`、`image_generate` 与 `video_generate`

package/lib/auth/claude-code-creds.d.ts

@@ -0,0 +1,23 @@
+import type { ClaudeSession } from './store.js';
+/** Read the current Claude Code session from its source of truth: macOS Keychain, falling back to the credentials file. */
+export declare function readClaudeCodeCredentials(): ClaudeSession | undefined;
+/**
+ * Write a refreshed session back to Claude Code's own credential store, so
+ * the `claude` CLI and any other consumer of the same account see the token
+ * we just rotated. A stale-blob mismatch (something else rotated it first)
+ * is a no-op — the caller already has that other rotation via readClaudeCodeCredentials.
+ * @param next - the freshly refreshed session to persist.
+ * @param expectedPriorAccessToken - the access token this refresh started from.
+ * @returns whether the write-back succeeded.
+ */
+export declare function writeBackClaudeCodeCredentials(next: ClaudeSession, expectedPriorAccessToken: string): boolean;
+/**
+ * Refresh a Claude session, first checking whether Claude Code's own store
+ * already holds a fresher token (rotated by the `claude` CLI or another
+ * consumer) before hitting the OAuth endpoint ourselves — and writing our own
+ * refresh back to that store so every consumer of the account stays synced.
+ * @param session - the session TokenManager wants refreshed.
+ * @param doRefresh - the actual OAuth refresh-token grant (network call).
+ * @returns the freshest available session.
+ */
+export declare function refreshClaudeSynced(session: ClaudeSession, doRefresh: (session: ClaudeSession) => Promise<ClaudeSession>): Promise<ClaudeSession>;

package/lib/auth/claude-code-creds.js

@@ -0,0 +1,167 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const PRIMARY_SERVICE = 'Claude Code-credentials';
+const DEFAULT_SCOPES = 'user:profile user:inference user:sessions:claude_code user:mcp_servers';
+function toSession(data) {
+    if (typeof data.accessToken !== 'string' || typeof data.refreshToken !== 'string' || typeof data.expiresAt !== 'number') {
+        return undefined;
+    }
+    const scopes = Array.isArray(data.scopes) ? data.scopes.join(' ') : typeof data.scopes === 'string' ? data.scopes : DEFAULT_SCOPES;
+    return {
+        accessToken: data.accessToken,
+        refreshToken: data.refreshToken,
+        expiresAt: Math.trunc(data.expiresAt),
+        scopes,
+        ...typeof data.emailAddress === 'string' ? { emailAddress: data.emailAddress } : {},
+        ...typeof data.subscriptionType === 'string' ? { subscriptionType: data.subscriptionType } : {},
+    };
+}
+function parseBlob(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    return toSession(parsed.claudeAiOauth ?? parsed);
+}
+function credentialsFilePath() {
+    return join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), '.credentials.json');
+}
+function readKeychainRaw() {
+    try {
+        return execFileSync('/usr/bin/security', ['find-generic-password', '-s', PRIMARY_SERVICE, '-w'], {
+            timeout: 3000,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function readFileRaw() {
+    try {
+        return readFileSync(credentialsFilePath(), 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read the current Claude Code session from its source of truth: macOS Keychain, falling back to the credentials file. */
+export function readClaudeCodeCredentials() {
+    if (process.platform === 'darwin') {
+        const raw = readKeychainRaw();
+        const session = raw !== undefined ? parseBlob(raw) : undefined;
+        if (session)
+            return session;
+    }
+    const raw = readFileRaw();
+    return raw !== undefined ? parseBlob(raw) : undefined;
+}
+function blobMatches(raw, expectedAccessToken) {
+    return parseBlob(raw)?.accessToken === expectedAccessToken;
+}
+function getKeychainAccountName() {
+    try {
+        const output = execFileSync('/usr/bin/security', ['find-generic-password', '-s', PRIMARY_SERVICE], {
+            timeout: 2000,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return /"acct"<blob>="([^"]*)"/.exec(output)?.[1];
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Merge fresh tokens into an existing raw blob, preserving unrelated fields. */
+function mergeIntoBlob(existingRaw, next) {
+    let parsed;
+    try {
+        parsed = JSON.parse(existingRaw);
+    }
+    catch {
+        return undefined;
+    }
+    const target = (parsed.claudeAiOauth ?? parsed);
+    target.accessToken = next.accessToken;
+    target.refreshToken = next.refreshToken;
+    target.expiresAt = next.expiresAt;
+    return JSON.stringify(parsed);
+}
+/**
+ * Write a refreshed session back to Claude Code's own credential store, so
+ * the `claude` CLI and any other consumer of the same account see the token
+ * we just rotated. A stale-blob mismatch (something else rotated it first)
+ * is a no-op — the caller already has that other rotation via readClaudeCodeCredentials.
+ * @param next - the freshly refreshed session to persist.
+ * @param expectedPriorAccessToken - the access token this refresh started from.
+ * @returns whether the write-back succeeded.
+ */
+export function writeBackClaudeCodeCredentials(next, expectedPriorAccessToken) {
+    if (process.platform === 'darwin') {
+        const raw = readKeychainRaw();
+        if (raw === undefined || !blobMatches(raw, expectedPriorAccessToken))
+            return false;
+        const updated = mergeIntoBlob(raw, next);
+        if (updated === undefined)
+            return false;
+        const account = getKeychainAccountName() ?? PRIMARY_SERVICE;
+        try {
+            execFileSync('/usr/bin/security', ['add-generic-password', '-s', PRIMARY_SERVICE, '-a', account, '-w', updated, '-U'], {
+                timeout: 2000,
+                stdio: 'ignore',
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    const path = credentialsFilePath();
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return false;
+    }
+    if (!blobMatches(raw, expectedPriorAccessToken))
+        return false;
+    const updated = mergeIntoBlob(raw, next);
+    if (updated === undefined)
+        return false;
+    try {
+        const dir = dirname(path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        writeFileSync(path, updated, { encoding: 'utf8', mode: 0o600 });
+        chmodSync(path, 0o600);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Refresh a Claude session, first checking whether Claude Code's own store
+ * already holds a fresher token (rotated by the `claude` CLI or another
+ * consumer) before hitting the OAuth endpoint ourselves — and writing our own
+ * refresh back to that store so every consumer of the account stays synced.
+ * @param session - the session TokenManager wants refreshed.
+ * @param doRefresh - the actual OAuth refresh-token grant (network call).
+ * @returns the freshest available session.
+ */
+export async function refreshClaudeSynced(session, doRefresh) {
+    const fromSource = readClaudeCodeCredentials();
+    const base = fromSource !== undefined && fromSource.accessToken !== session.accessToken ? fromSource : session;
+    if (base.expiresAt > Date.now() + 60_000)
+        return base;
+    const next = await doRefresh(base);
+    writeBackClaudeCodeCredentials(next, base.accessToken);
+    return next;
+}

package/lib/auth/pkce.js

@@ -22,7 +22,7 @@ export function createPkce() {
  * @param bytes - entropy length.
  * @returns base64url-encoded random bytes.
  */
-export function randomToken(bytes = 16) {
+export function randomToken(bytes = 32) {
     return base64url(randomBytes(bytes));
 }
 /**

package/lib/client/SubscriptionsSection.js

@@ -323,7 +323,12 @@ export function SubscriptionsSection(props) {
         setProviderError(provider, undefined);
         try {
             const response = await callSubscriptionsAuth(rpc, 'login', { provider });
-            if (typeof response.authorizeUrl !== 'string' || response.authorizeUrl === '') {
+            if (typeof response.authorizeUrl === 'string' && response.authorizeUrl === '') {
+                // Instant login (e.g. imported from Claude Code credentials)
+                await refresh();
+                return;
+            }
+            if (typeof response.authorizeUrl !== 'string') {
                 throw new SubscriptionsAuthError(t('loginMissingUrl'));
             }
             window.open(response.authorizeUrl, '_blank', 'noopener');

package/lib/client.js

@@ -518,7 +518,11 @@ function SubscriptionsSection(props) {
 		setProviderError(provider, void 0);
 		try {
 			const response = await callSubscriptionsAuth$1(rpc, "login", { provider });
-			if (typeof response.authorizeUrl !== "string" || response.authorizeUrl === "") throw new SubscriptionsAuthError(t("loginMissingUrl"));
+			if (typeof response.authorizeUrl === "string" && response.authorizeUrl === "") {
+				await refresh();
+				return;
+			}
+			if (typeof response.authorizeUrl !== "string") throw new SubscriptionsAuthError(t("loginMissingUrl"));
 			window.open(response.authorizeUrl, "_blank", "noopener");
 			if (!mountedRef.current) return;
 			setStatuses((prev) => ({