dsh-plugin-subscriptions 0.4.0 → 0.4.2

package/lib/index.js

@@ -1,9 +1,12 @@
 import z from "@deepseek-ai/schemastery";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, isContextWindowExceededError, isQuotaExceededError } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -33,7 +36,7 @@ function createPkce() {
 * @param bytes - entropy length.
 * @returns base64url-encoded random bytes.
 */
-function randomToken(bytes = 16) {
+function randomToken(bytes = 32) {
 	return base64url(randomBytes(bytes));
 }
 /**
@@ -247,6 +250,187 @@ var OAuthFlowManager = class {
 	}
 };
 
+//#endregion
+//#region src/auth/claude-code-creds.ts
+const PRIMARY_SERVICE = "Claude Code-credentials";
+const DEFAULT_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers";
+function toSession(data) {
+	if (typeof data.accessToken !== "string" || typeof data.refreshToken !== "string" || typeof data.expiresAt !== "number") return;
+	const scopes = Array.isArray(data.scopes) ? data.scopes.join(" ") : typeof data.scopes === "string" ? data.scopes : DEFAULT_SCOPES;
+	return {
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken,
+		expiresAt: Math.trunc(data.expiresAt),
+		scopes,
+		...typeof data.emailAddress === "string" ? { emailAddress: data.emailAddress } : {},
+		...typeof data.subscriptionType === "string" ? { subscriptionType: data.subscriptionType } : {}
+	};
+}
+function parseBlob(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	return toSession(parsed.claudeAiOauth ?? parsed);
+}
+function credentialsFilePath() {
+	return join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude"), ".credentials.json");
+}
+function readKeychainRaw() {
+	try {
+		return execFileSync("/usr/bin/security", [
+			"find-generic-password",
+			"-s",
+			PRIMARY_SERVICE,
+			"-w"
+		], {
+			timeout: 3e3,
+			encoding: "utf8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+}
+function readFileRaw() {
+	try {
+		return readFileSync(credentialsFilePath(), "utf8");
+	} catch {
+		return;
+	}
+}
+/** Read the current Claude Code session from its source of truth: macOS Keychain, falling back to the credentials file. */
+function readClaudeCodeCredentials() {
+	if (process.platform === "darwin") {
+		const raw$1 = readKeychainRaw();
+		const session = raw$1 !== void 0 ? parseBlob(raw$1) : void 0;
+		if (session) return session;
+	}
+	const raw = readFileRaw();
+	return raw !== void 0 ? parseBlob(raw) : void 0;
+}
+function blobMatches(raw, expectedAccessToken) {
+	return parseBlob(raw)?.accessToken === expectedAccessToken;
+}
+function getKeychainAccountName() {
+	try {
+		const output = execFileSync("/usr/bin/security", [
+			"find-generic-password",
+			"-s",
+			PRIMARY_SERVICE
+		], {
+			timeout: 2e3,
+			encoding: "utf8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		return /"acct"<blob>="([^"]*)"/.exec(output)?.[1];
+	} catch {
+		return;
+	}
+}
+/** Merge fresh tokens into an existing raw blob, preserving unrelated fields. */
+function mergeIntoBlob(existingRaw, next) {
+	let parsed;
+	try {
+		parsed = JSON.parse(existingRaw);
+	} catch {
+		return;
+	}
+	const target = parsed.claudeAiOauth ?? parsed;
+	target.accessToken = next.accessToken;
+	target.refreshToken = next.refreshToken;
+	target.expiresAt = next.expiresAt;
+	return JSON.stringify(parsed);
+}
+/**
+* Write a refreshed session back to Claude Code's own credential store, so
+* the `claude` CLI and any other consumer of the same account see the token
+* we just rotated. A stale-blob mismatch (something else rotated it first)
+* is a no-op — the caller already has that other rotation via readClaudeCodeCredentials.
+* @param next - the freshly refreshed session to persist.
+* @param expectedPriorAccessToken - the access token this refresh started from.
+* @returns whether the write-back succeeded.
+*/
+function writeBackClaudeCodeCredentials(next, expectedPriorAccessToken) {
+	if (process.platform === "darwin") {
+		const raw$1 = readKeychainRaw();
+		if (raw$1 === void 0 || !blobMatches(raw$1, expectedPriorAccessToken)) return false;
+		const updated$1 = mergeIntoBlob(raw$1, next);
+		if (updated$1 === void 0) return false;
+		const account = getKeychainAccountName() ?? PRIMARY_SERVICE;
+		try {
+			execFileSync("/usr/bin/security", [
+				"add-generic-password",
+				"-s",
+				PRIMARY_SERVICE,
+				"-a",
+				account,
+				"-w",
+				updated$1,
+				"-U"
+			], {
+				timeout: 2e3,
+				stdio: "ignore"
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	const path = credentialsFilePath();
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch {
+		return false;
+	}
+	if (!blobMatches(raw, expectedPriorAccessToken)) return false;
+	const updated = mergeIntoBlob(raw, next);
+	if (updated === void 0) return false;
+	try {
+		const dir = dirname(path);
+		if (!existsSync(dir)) mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, updated, {
+			encoding: "utf8",
+			mode: 384
+		});
+		chmodSync(path, 384);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Refresh a Claude session, first checking whether Claude Code's own store
+* already holds a fresher token (rotated by the `claude` CLI or another
+* consumer) before hitting the OAuth endpoint ourselves — and writing our own
+* refresh back to that store so every consumer of the account stays synced.
+* @param session - the session TokenManager wants refreshed.
+* @param doRefresh - the actual OAuth refresh-token grant (network call).
+* @returns the freshest available session.
+*/
+async function refreshClaudeSynced(session, doRefresh) {
+	const fromSource = readClaudeCodeCredentials();
+	const base = fromSource !== void 0 && fromSource.accessToken !== session.accessToken ? fromSource : session;
+	if (base.expiresAt > Date.now() + 6e4) return base;
+	const next = await doRefresh(base);
+	writeBackClaudeCodeCredentials(next, base.accessToken);
+	return next;
+}
+
 //#endregion
 //#region src/auth/store.ts
 /** Every provider route, in display order. */
@@ -827,13 +1011,16 @@ function sanitizeModel(value) {
 	if (typeof raw.id !== "string" || raw.id.length === 0 || typeof raw.name !== "string" || raw.name.length === 0 || raw.description !== void 0 && typeof raw.description !== "string" || raw.contextWindow !== void 0 && (typeof raw.contextWindow !== "number" || !Number.isInteger(raw.contextWindow) || raw.contextWindow <= 0) || raw.priority !== void 0 && (typeof raw.priority !== "number" || !Number.isFinite(raw.priority))) return void 0;
 	const reasoning = raw.reasoning === void 0 ? void 0 : sanitizeReasoning(raw.reasoning);
 	if (raw.reasoning !== void 0 && reasoning === void 0) return void 0;
+	const thinkingType = raw.thinkingType;
+	if (thinkingType !== void 0 && thinkingType !== "enabled" && thinkingType !== "adaptive") return void 0;
 	return {
 		id: raw.id,
 		name: raw.name,
 		...raw.description === void 0 ? {} : { description: raw.description },
 		...raw.contextWindow === void 0 ? {} : { contextWindow: raw.contextWindow },
 		...raw.priority === void 0 ? {} : { priority: raw.priority },
-		...reasoning === void 0 ? {} : { reasoning }
+		...reasoning === void 0 ? {} : { reasoning },
+		...thinkingType === void 0 ? {} : { thinkingType }
 	};
 }
 /**
@@ -2143,12 +2330,11 @@ async function* streamAnthropic(stream, onActivity) {
 //#endregion
 //#region src/providers/claude.ts
 const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+const CLAUDE_TOKEN_URL = "https://claude.ai/v1/oauth/token";
 const CLAUDE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
 const CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const CLAUDE_MODELS_URL = "https://api.anthropic.com/v1/models?beta=true";
 const CLAUDE_SCOPE = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-const CLAUDE_CALLBACK_PATH = "/callback";
 const CLAUDE_CONTEXT_WINDOW = 2e5;
 const CLAUDE_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
@@ -2158,28 +2344,28 @@ const CLAUDE_PREEMPT_MS = 5 * 6e4;
 * so these headers impersonate the CLI; the harness attribution user-agent
 * cannot be sent here (one user-agent slot, and the CLI's wins).
 */
-const CLAUDE_CLI_USER_AGENT = "claude-cli/2.1.97 (external, cli)";
-const CLAUDE_BETA_FLAGS = "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27";
-/** Static claude flow facts for the OAuth flow engine. */
-const claudeFlow = {
-	callbackPath: CLAUDE_CALLBACK_PATH,
-	listen: {
-		host: "localhost",
-		ports: [0]
-	},
-	buildAuthorizeUrl({ redirectUri, state, pkce }) {
-		return `${CLAUDE_AUTHORIZE_URL}?${new URLSearchParams({
-			code: "true",
-			client_id: CLAUDE_CLIENT_ID,
-			response_type: "code",
-			redirect_uri: redirectUri,
-			scope: CLAUDE_SCOPE,
-			code_challenge: pkce.challenge,
-			code_challenge_method: "S256",
-			state
-		}).toString()}`;
-	}
-};
+const CLAUDE_CLI_FALLBACK_VERSION = "2.1.234";
+function detectClaudeVersion() {
+	try {
+		const match = execFileSync("claude", ["--version"], {
+			timeout: 3e3,
+			encoding: "utf8"
+		}).match(/^(\d+\.\d+\.\d+)/);
+		if (match) return match[1];
+	} catch {}
+	return CLAUDE_CLI_FALLBACK_VERSION;
+}
+const CLAUDE_CLI_USER_AGENT = `claude-cli/${detectClaudeVersion()} (external, cli)`;
+const CLAUDE_BETA_FALLBACK = [
+	"claude-code-20250219",
+	"oauth-2025-04-20",
+	"interleaved-thinking-2025-05-14",
+	"context-management-2025-06-27",
+	"effort-2025-11-24",
+	"compact-2026-01-12",
+	"files-api-2025-04-14"
+].join(",");
+const CLAUDE_BETA_FLAGS = CLAUDE_BETA_FALLBACK;
 /** Best-effort account profile; login must not fail when this does. */
 async function fetchClaudeProfile(accessToken) {
 	try {
@@ -2347,22 +2533,79 @@ async function fetchClaudeUsage(session, fetchFn = fetch, signal) {
 		windows
 	};
 }
+function claudeThinkingType(capabilities) {
+	const types = capabilities?.thinking?.types;
+	if (types?.enabled?.supported === true) return "enabled";
+	if (types?.adaptive?.supported === true) return "adaptive";
+}
+/** Effort levels in display order; a model exposes only the ones it advertises as supported. */
+const CLAUDE_EFFORT_LEVELS = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+function claudeReasoning(capabilities) {
+	const effort = capabilities?.effort;
+	if (effort?.supported !== true) return void 0;
+	const efforts = CLAUDE_EFFORT_LEVELS.filter((level) => effort[level]?.supported === true).map((level) => ({
+		id: ReasoningEffortId(level),
+		name: level[0].toUpperCase() + level.slice(1)
+	}));
+	return efforts.length > 0 ? { efforts } : void 0;
+}
+/** Fetch the live model catalog from the subscription endpoint. */
+async function fetchClaudeModels(session, fetchFn = fetch) {
+	const response = await fetchFn(CLAUDE_MODELS_URL, { headers: {
+		"authorization": `Bearer ${session.accessToken}`,
+		"anthropic-version": "2023-06-01",
+		"user-agent": CLAUDE_CLI_USER_AGENT,
+		"anthropic-dangerous-direct-browser-access": "true",
+		"accept": "application/json"
+	} });
+	if (!response.ok) throw await httpLlmError(response, "claude models API");
+	const payload = await response.json();
+	if (!Array.isArray(payload.data)) throw new Error("claude models API returned an invalid catalog");
+	const models = payload.data.filter((m) => typeof m.id === "string").map((m) => {
+		const thinkingType = claudeThinkingType(m.capabilities);
+		const reasoning = claudeReasoning(m.capabilities);
+		return {
+			id: m.id,
+			name: m.display_name ?? m.id,
+			...thinkingType === void 0 ? {} : { thinkingType },
+			...reasoning === void 0 ? {} : { reasoning }
+		};
+	});
+	if (models.length === 0) throw new Error("claude models API returned an empty catalog");
+	return models;
+}
+/**
+* Claude Code's own SDK retry shape: exponential backoff starting at 1s,
+* doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
+* count of retries after the first attempt (Claude Code defaults to 10).
+*/
+const CLAUDE_RETRY_INITIAL_DELAY_MS = 1e3;
+const CLAUDE_RETRY_MAX_DELAY_MS = 6e4;
+const CLAUDE_RETRY_JITTER_RATIO = .2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ["text", "image"];
 /** Claude wire adapter: one instance serves the `claude` provider route. */
 var ClaudeAdapter = class extends LlmAdapter {
+	catalog;
 	constructor(options) {
 		super();
 		this.options = options;
+		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
-	providerInfo(provider) {
-		return {
-			id: provider,
-			name: "Claude (Subscription)"
-		};
+	async fetchCatalog() {
+		return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
 	}
-	async listModels(provider) {
-		if (!await this.options.tokens.hasSession()) return [];
+	async discovered(model) {
+		if (!this.options.discovery) return void 0;
+		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+	}
+	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
 			id: model.id,
@@ -2370,16 +2613,54 @@ var ClaudeAdapter = class extends LlmAdapter {
 			inputModalities: model.inputModalities ?? CLAUDE_MODALITIES
 		}));
 	}
-	resolveModel(provider, model) {
+	providerInfo(provider) {
+		return {
+			id: provider,
+			name: "Claude (Subscription)"
+		};
+	}
+	providerRetryPolicy(provider) {
+		if (this.options.maxRetries === void 0) return void 0;
+		return resolveRetryPolicy({
+			mode: "normal",
+			maxRetries: this.options.maxRetries,
+			backoff: {
+				initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
+				maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
+				jitterRatio: CLAUDE_RETRY_JITTER_RATIO
+			}
+		}, `claude: provider "${provider}" retryPolicy`);
+	}
+	async listModels(provider) {
+		if (await this.options.tokens.peek() === void 0) return [];
+		if (!this.options.discovery) return this.staticModels(provider);
+		try {
+			return (await this.catalog.get(() => this.fetchCatalog())).map((model) => ({
+				provider,
+				id: model.id,
+				name: model.name,
+				inputModalities: CLAUDE_MODALITIES
+			}));
+		} catch (error) {
+			if (error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL")) return [];
+			if (error instanceof LlmError && error.code === "AUTH") this.catalog.invalidate();
+			this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
+			return this.staticModels(provider);
+		}
+	}
+	async resolveModel(provider, model) {
+		const disc = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
-		return Promise.resolve({
+		const reasoning = disc?.reasoning;
+		return {
 			provider,
 			id: model,
-			name: configured?.name ?? model,
+			name: disc?.name ?? configured?.name ?? model,
 			inputModalities: configured?.inputModalities ?? CLAUDE_MODALITIES,
-			context: { contextWindow: configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
-			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS
-		});
+			context: { contextWindow: disc?.contextWindow ?? configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
+			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			...reasoning === void 0 ? {} : { reasoning }
+		};
 	}
 	async *stream(options) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
@@ -2401,14 +2682,42 @@ var ClaudeAdapter = class extends LlmAdapter {
 			watchdog.stop();
 		}
 	}
+	/**
+	* `display: 'summarized'` is set explicitly on both shapes: `adaptive`-type
+	* models default to `display: 'omitted'`, which returns thinking blocks with
+	* an empty `thinking` field — without this override the "Think" panel would
+	* always render empty even though real reasoning (and billed thinking_tokens)
+	* ran.
+	*/
+	thinkingParam(thinkingType, maxTokens) {
+		if (thinkingType === "adaptive") return {
+			type: "adaptive",
+			display: "summarized"
+		};
+		if (thinkingType === "enabled") {
+			const budget = Math.min(Math.max(1024, Math.floor(maxTokens * .5)), maxTokens - 100);
+			if (budget < 1024) return void 0;
+			return {
+				type: "enabled",
+				budget_tokens: budget,
+				display: "summarized"
+			};
+		}
+	}
 	async request(options, session, signal) {
 		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
+		const maxTokens = options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS;
+		const disc = await this.discovered(options.model);
+		const thinking = this.thinkingParam(disc?.thinkingType, maxTokens);
+		const effort = options.reasoningEffort !== void 0 && disc?.reasoning !== void 0 ? { output_config: { effort: String(options.reasoningEffort) } } : {};
 		const body = {
 			model: options.model,
-			max_tokens: options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			max_tokens: maxTokens,
 			system: toAnthropicSystem(options.system, messages),
 			messages: toAnthropicMessages(messages),
 			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toAnthropicTools(options.tools) } : {},
+			...thinking === void 0 ? {} : { thinking },
+			...effort,
 			stream: true,
 			...options.sessionId !== void 0 ? { metadata: { user_id: String(options.sessionId) } } : {}
 		};
@@ -3078,13 +3387,17 @@ function createXSearchTool(options) {
 
 //#endregion
 //#region src/tools/image-generate.ts
-/** Endpoint the generation request is posted to. */
+/** Endpoint the codex generation request is posted to. */
 const IMAGE_GENERATE_URL = "https://chatgpt.com/backend-api/codex/images/generations";
 /** The image model the codex subscription endpoint serves. */
 const IMAGE_GENERATE_MODEL = "gpt-image-2";
+/** Endpoint the grok generation request is posted to. */
+const GROK_IMAGE_GENERATE_URL = "https://api.x.ai/v1/images/generations";
+/** The image model the grok subscription endpoint serves. */
+const GROK_IMAGE_GENERATE_MODEL = "grok-imagine-image-2.0";
 /**
-* Assemble the request body from tool arguments (hand-checks the non-empty
-* prompt the schema DSL cannot express).
+* Assemble the codex request body from tool arguments (hand-checks the
+* non-empty prompt the schema DSL cannot express).
 */
 function buildImageGenerateBody(args) {
 	const prompt = args.prompt.trim();
@@ -3096,6 +3409,30 @@ function buildImageGenerateBody(args) {
 		...args.quality === void 0 ? {} : { quality: args.quality }
 	};
 }
+/** The codex `size` values mapped onto grok aspect ratios. */
+const GROK_ASPECT_RATIOS = {
+	"1024x1024": "1:1",
+	"1024x1536": "2:3",
+	"1536x1024": "3:2",
+	"auto": "auto"
+};
+/**
+* Assemble the grok request body from the same tool arguments: `size` maps
+* onto the nearest `aspect_ratio`, and `quality` folds into grok's low/medium
+* pair (`high` → `medium`, `auto` → provider default).
+*/
+function buildGrokImageGenerateBody(args) {
+	const prompt = args.prompt.trim();
+	if (prompt.length === 0) throw new Error("image_generate: prompt must be a non-empty string");
+	const quality = args.quality === "low" ? "low" : args.quality === "medium" || args.quality === "high" ? "medium" : void 0;
+	return {
+		prompt,
+		model: GROK_IMAGE_GENERATE_MODEL,
+		response_format: "b64_json",
+		...args.size === void 0 ? {} : { aspect_ratio: GROK_ASPECT_RATIOS[args.size] },
+		...quality === void 0 ? {} : { quality }
+	};
+}
 /**
 * Parse the generations response into decodable images. Throws when the
 * payload carries no usable `b64_json` entries.
@@ -3116,13 +3453,29 @@ function parseImageGenerateResponse(payload) {
 	if (images.length === 0) throw new Error("image_generate: the response carried no image data");
 	return images;
 }
-/** Directory the generated PNG files are written to. */
+/** Directory the generated image files are written to. */
 function imagesDirectory() {
 	return dshHomePath("plugins", "subscriptions", "images");
 }
+/**
+* Sniff a generated image's media type from its magic bytes (codex serves
+* PNG; grok's format is undocumented, so trust the bytes). Unrecognized data
+* defaults to PNG, matching the historical behavior.
+*/
+function sniffImageMediaType(data) {
+	if (data.length >= 3 && data[0] === 255 && data[1] === 216 && data[2] === 255) return "image/jpeg";
+	if (data.length >= 12 && data.toString("latin1", 0, 4) === "RIFF" && data.toString("latin1", 8, 12) === "WEBP") return "image/webp";
+	return "image/png";
+}
+/** File extension for one sniffed media type. */
+const MEDIA_TYPE_EXTENSIONS = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/webp": "webp"
+};
 /** Timestamped, collision-safe file name for one generated image. */
-function imageFileName(index) {
-	return `image-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}-${index}.png`;
+function imageFileName(index, mediaType) {
+	return `image-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}-${index}.${MEDIA_TYPE_EXTENSIONS[mediaType]}`;
 }
 /** Bound a call-card title's prompt. */
 function truncate$1(text, max = 60) {
@@ -3180,7 +3533,7 @@ function imageGenerateText(value) {
 function createImageGenerateTool(options) {
 	return defineTool({
 		name: "image_generate",
-		description: "Generate an image with the ChatGPT subscription (gpt-image-2) and save it as a PNG file. Returns the saved file paths; on image-capable models the image itself is attached.",
+		description: "Generate an image with the ChatGPT subscription (gpt-image-2) or the Grok subscription (grok-imagine-image-2.0) and save it as an image file. The `provider` parameter picks the preferred provider (default gpt); when the preferred one is logged out the other serves as fallback. Returns the saved file paths; on image-capable models the image itself is attached.",
 		parameters: {
 			prompt: {
 				type: "string",
@@ -3206,6 +3559,11 @@ function createImageGenerateTool(options) {
 					"auto"
 				],
 				description: "Rendering quality; omit for the provider default."
+			},
+			provider: {
+				type: "string",
+				enum: ["gpt", "grok"],
+				description: "Preferred provider (default gpt); the other one serves as fallback when the preferred is logged out."
 			}
 		},
 		output: {
@@ -3268,29 +3626,57 @@ function createImageGenerateTool(options) {
 			content: result.content.filter((block) => block.type === "text")
 		}),
 		async execute(args, exec) {
-			const body = buildImageGenerateBody(args);
-			const session = await options.tokens.session();
-			const response = await (options.fetchFn ?? fetch)(IMAGE_GENERATE_URL, {
-				method: "POST",
-				headers: {
-					"authorization": `Bearer ${session.accessToken}`,
-					"chatgpt-account-id": session.accountId,
-					"originator": "codex_cli_rs",
-					"content-type": "application/json",
-					"accept": "application/json"
-				},
-				body: JSON.stringify(body),
-				signal: exec.signal
-			});
+			const fetchFn = options.fetchFn ?? fetch;
+			const preferGrok = args.provider === "grok";
+			const codexReady = options.codexTokens !== void 0 && await options.codexTokens.hasSession();
+			const grokReady = options.grokTokens !== void 0 && await options.grokTokens.hasSession();
+			const useGrok = preferGrok ? grokReady : grokReady && !codexReady;
+			const useCodex = !useGrok && codexReady;
+			let response;
+			if (useCodex && options.codexTokens !== void 0) {
+				const session = await options.codexTokens.session();
+				response = await fetchFn(IMAGE_GENERATE_URL, {
+					method: "POST",
+					headers: {
+						"authorization": `Bearer ${session.accessToken}`,
+						"chatgpt-account-id": session.accountId,
+						"originator": "codex_cli_rs",
+						"content-type": "application/json",
+						"accept": "application/json"
+					},
+					body: JSON.stringify(buildImageGenerateBody(args)),
+					signal: exec.signal
+				});
+			} else if (useGrok && options.grokTokens !== void 0) {
+				const session = await options.grokTokens.session();
+				response = await fetchFn(GROK_IMAGE_GENERATE_URL, {
+					method: "POST",
+					headers: {
+						"authorization": `Bearer ${session.accessToken}`,
+						"content-type": "application/json",
+						"accept": "application/json"
+					},
+					body: JSON.stringify(buildGrokImageGenerateBody(args)),
+					signal: exec.signal
+				});
+			} else {
+				const manager = preferGrok ? options.grokTokens ?? options.codexTokens : options.codexTokens ?? options.grokTokens;
+				if (manager === void 0) throw new Error("image_generate: no image provider is configured");
+				await manager.session();
+				throw new Error("image_generate: no image provider is logged in");
+			}
 			if (!response.ok) throw await httpLlmError(response, "image_generate");
 			const images = parseImageGenerateResponse(await response.json());
 			const directory = options.imagesDir ?? imagesDirectory();
 			await mkdir(directory, { recursive: true });
 			const paths = [];
+			const mediaTypes = [];
 			for (const [index, image] of images.entries()) {
-				const path = join(directory, imageFileName(index));
+				const mediaType = sniffImageMediaType(image.data);
+				const path = join(directory, imageFileName(index, mediaType));
 				await writeFile(path, image.data);
 				paths.push(path);
+				mediaTypes.push(mediaType);
 			}
 			const attachments = options.resolveAttachments?.();
 			const imageCapable = attachments !== void 0 && await routeDeclaresImageInput(options.resolveLlm, exec);
@@ -3298,7 +3684,7 @@ function createImageGenerateTool(options) {
 			if (attachments !== void 0 && imageCapable) for (const [index, image] of images.entries()) {
 				const ref = await attachments.saveImage({
 					data: image.data,
-					mediaType: "image/png",
+					mediaType: mediaTypes[index],
 					name: basename(paths[index])
 				});
 				refs.push({
@@ -3620,17 +4006,27 @@ const DEFAULT_MODELS = {
 	],
 	claude: [
 		{
-			id: "claude-opus-4-5",
-			name: "Claude Opus 4.5",
-			maxTokens: 64e3
+			id: "claude-opus-5",
+			name: "Claude Opus 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
 		},
 		{
-			id: "claude-sonnet-4-5",
-			name: "Claude Sonnet 4.5"
+			id: "claude-sonnet-5",
+			name: "Claude Sonnet 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
 		},
 		{
-			id: "claude-haiku-4-5",
-			name: "Claude Haiku 4.5"
+			id: "claude-fable-5",
+			name: "Claude Fable 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
+		},
+		{
+			id: "claude-haiku-4-5-20251001",
+			name: "Claude Haiku 4.5",
+			maxTokens: 64e3
 		}
 	],
 	grok: [
@@ -3719,7 +4115,17 @@ var SubscriptionsAuthController = class {
 		};
 	}
 	async login(provider) {
-		const spec = provider === "grok" ? await grokFlow() : provider === "claude" ? claudeFlow : codexFlow;
+		if (provider === "claude") {
+			const session = readClaudeCodeCredentials();
+			if (session) {
+				await this.persist("claude", session);
+				this.lastError.delete("claude");
+				this.onAuthChanged("claude");
+				return { authorizeUrl: "" };
+			}
+			throw new Error("Claude Code credentials not found. Run \"claude\" first to log in.");
+		}
+		const spec = provider === "grok" ? await grokFlow() : codexFlow;
 		const attempt = await this.flows.start(provider, spec);
 		this.complete(provider, attempt);
 		return { authorizeUrl: attempt.authorizeUrl };
@@ -3783,6 +4189,7 @@ function apply(ctx, config) {
 		handles.get(provider)?.replace([provider]);
 	};
 	let codexTokens;
+	let claudeTokens;
 	let grokTokens;
 	const usageFetchers = {};
 	for (const provider of providers) switch (provider) {
@@ -3819,18 +4226,23 @@ function apply(ctx, config) {
 				load: () => getSession("claude"),
 				save: (session) => saveSession("claude", session),
 				remove: () => deleteSession("claude"),
-				refresh: refreshClaude,
+				refresh: (session) => refreshClaudeSynced(session, refreshClaude),
 				isPermanent: isClaudePermanentRefreshError,
 				onRemoved: () => {
 					authChanged("claude");
 				}
 			});
+			claudeTokens = tokens;
 			usageFetchers.claude = async (signal) => fetchClaudeUsage(await tokens.session(), fetch, signal);
 			handles.set("claude", ctx.llm.registerAdapter(["claude"], new ClaudeAdapter({
 				models: catalog.claude,
 				streamIdleTimeoutMs,
 				tokens,
-				resolveAttachments
+				discovery: !overridden.has("claude"),
+				onWarn,
+				maxRetries: 10,
+				resolveAttachments,
+				catalogStore: catalogStore("claude")
 			})));
 			break;
 		}
@@ -3862,13 +4274,22 @@ function apply(ctx, config) {
 		}
 	}
 	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged, resolveAttachments, usageFetchers));
+	if (claudeTokens !== void 0) {
+		const syncTimer = setInterval(() => {
+			claudeTokens?.session().catch(() => {});
+		}, 5 * 6e4);
+		ctx.effect(() => () => {
+			clearInterval(syncTimer);
+		}, "dsh-plugin-subscriptions: claude background sync timer");
+	}
 	ctx.inject(["tools"], (toolsCtx) => {
 		if (grokTokens !== void 0) {
 			toolsCtx.tools.register(createXSearchTool({ tokens: grokTokens }));
 			toolsCtx.tools.register(createVideoGenerateTool({ tokens: grokTokens }));
 		}
-		if (codexTokens !== void 0) toolsCtx.tools.register(createImageGenerateTool({
-			tokens: codexTokens,
+		if (codexTokens !== void 0 || grokTokens !== void 0) toolsCtx.tools.register(createImageGenerateTool({
+			...codexTokens === void 0 ? {} : { codexTokens },
+			...grokTokens === void 0 ? {} : { grokTokens },
 			resolveAttachments,
 			resolveLlm: () => ctx.get("llm")
 		}));