dsh-plugin-subscriptions 0.4.1 → 0.4.2

package/lib/index.js

@@ -1,9 +1,12 @@
 import z from "@deepseek-ai/schemastery";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, isContextWindowExceededError, isQuotaExceededError } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -33,7 +36,7 @@ function createPkce() {
 * @param bytes - entropy length.
 * @returns base64url-encoded random bytes.
 */
-function randomToken(bytes = 16) {
+function randomToken(bytes = 32) {
 	return base64url(randomBytes(bytes));
 }
 /**
@@ -247,6 +250,187 @@ var OAuthFlowManager = class {
 	}
 };
 
+//#endregion
+//#region src/auth/claude-code-creds.ts
+const PRIMARY_SERVICE = "Claude Code-credentials";
+const DEFAULT_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers";
+function toSession(data) {
+	if (typeof data.accessToken !== "string" || typeof data.refreshToken !== "string" || typeof data.expiresAt !== "number") return;
+	const scopes = Array.isArray(data.scopes) ? data.scopes.join(" ") : typeof data.scopes === "string" ? data.scopes : DEFAULT_SCOPES;
+	return {
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken,
+		expiresAt: Math.trunc(data.expiresAt),
+		scopes,
+		...typeof data.emailAddress === "string" ? { emailAddress: data.emailAddress } : {},
+		...typeof data.subscriptionType === "string" ? { subscriptionType: data.subscriptionType } : {}
+	};
+}
+function parseBlob(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	return toSession(parsed.claudeAiOauth ?? parsed);
+}
+function credentialsFilePath() {
+	return join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude"), ".credentials.json");
+}
+function readKeychainRaw() {
+	try {
+		return execFileSync("/usr/bin/security", [
+			"find-generic-password",
+			"-s",
+			PRIMARY_SERVICE,
+			"-w"
+		], {
+			timeout: 3e3,
+			encoding: "utf8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+}
+function readFileRaw() {
+	try {
+		return readFileSync(credentialsFilePath(), "utf8");
+	} catch {
+		return;
+	}
+}
+/** Read the current Claude Code session from its source of truth: macOS Keychain, falling back to the credentials file. */
+function readClaudeCodeCredentials() {
+	if (process.platform === "darwin") {
+		const raw$1 = readKeychainRaw();
+		const session = raw$1 !== void 0 ? parseBlob(raw$1) : void 0;
+		if (session) return session;
+	}
+	const raw = readFileRaw();
+	return raw !== void 0 ? parseBlob(raw) : void 0;
+}
+function blobMatches(raw, expectedAccessToken) {
+	return parseBlob(raw)?.accessToken === expectedAccessToken;
+}
+function getKeychainAccountName() {
+	try {
+		const output = execFileSync("/usr/bin/security", [
+			"find-generic-password",
+			"-s",
+			PRIMARY_SERVICE
+		], {
+			timeout: 2e3,
+			encoding: "utf8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		return /"acct"<blob>="([^"]*)"/.exec(output)?.[1];
+	} catch {
+		return;
+	}
+}
+/** Merge fresh tokens into an existing raw blob, preserving unrelated fields. */
+function mergeIntoBlob(existingRaw, next) {
+	let parsed;
+	try {
+		parsed = JSON.parse(existingRaw);
+	} catch {
+		return;
+	}
+	const target = parsed.claudeAiOauth ?? parsed;
+	target.accessToken = next.accessToken;
+	target.refreshToken = next.refreshToken;
+	target.expiresAt = next.expiresAt;
+	return JSON.stringify(parsed);
+}
+/**
+* Write a refreshed session back to Claude Code's own credential store, so
+* the `claude` CLI and any other consumer of the same account see the token
+* we just rotated. A stale-blob mismatch (something else rotated it first)
+* is a no-op — the caller already has that other rotation via readClaudeCodeCredentials.
+* @param next - the freshly refreshed session to persist.
+* @param expectedPriorAccessToken - the access token this refresh started from.
+* @returns whether the write-back succeeded.
+*/
+function writeBackClaudeCodeCredentials(next, expectedPriorAccessToken) {
+	if (process.platform === "darwin") {
+		const raw$1 = readKeychainRaw();
+		if (raw$1 === void 0 || !blobMatches(raw$1, expectedPriorAccessToken)) return false;
+		const updated$1 = mergeIntoBlob(raw$1, next);
+		if (updated$1 === void 0) return false;
+		const account = getKeychainAccountName() ?? PRIMARY_SERVICE;
+		try {
+			execFileSync("/usr/bin/security", [
+				"add-generic-password",
+				"-s",
+				PRIMARY_SERVICE,
+				"-a",
+				account,
+				"-w",
+				updated$1,
+				"-U"
+			], {
+				timeout: 2e3,
+				stdio: "ignore"
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	const path = credentialsFilePath();
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch {
+		return false;
+	}
+	if (!blobMatches(raw, expectedPriorAccessToken)) return false;
+	const updated = mergeIntoBlob(raw, next);
+	if (updated === void 0) return false;
+	try {
+		const dir = dirname(path);
+		if (!existsSync(dir)) mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, updated, {
+			encoding: "utf8",
+			mode: 384
+		});
+		chmodSync(path, 384);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Refresh a Claude session, first checking whether Claude Code's own store
+* already holds a fresher token (rotated by the `claude` CLI or another
+* consumer) before hitting the OAuth endpoint ourselves — and writing our own
+* refresh back to that store so every consumer of the account stays synced.
+* @param session - the session TokenManager wants refreshed.
+* @param doRefresh - the actual OAuth refresh-token grant (network call).
+* @returns the freshest available session.
+*/
+async function refreshClaudeSynced(session, doRefresh) {
+	const fromSource = readClaudeCodeCredentials();
+	const base = fromSource !== void 0 && fromSource.accessToken !== session.accessToken ? fromSource : session;
+	if (base.expiresAt > Date.now() + 6e4) return base;
+	const next = await doRefresh(base);
+	writeBackClaudeCodeCredentials(next, base.accessToken);
+	return next;
+}
+
 //#endregion
 //#region src/auth/store.ts
 /** Every provider route, in display order. */
@@ -827,13 +1011,16 @@ function sanitizeModel(value) {
 	if (typeof raw.id !== "string" || raw.id.length === 0 || typeof raw.name !== "string" || raw.name.length === 0 || raw.description !== void 0 && typeof raw.description !== "string" || raw.contextWindow !== void 0 && (typeof raw.contextWindow !== "number" || !Number.isInteger(raw.contextWindow) || raw.contextWindow <= 0) || raw.priority !== void 0 && (typeof raw.priority !== "number" || !Number.isFinite(raw.priority))) return void 0;
 	const reasoning = raw.reasoning === void 0 ? void 0 : sanitizeReasoning(raw.reasoning);
 	if (raw.reasoning !== void 0 && reasoning === void 0) return void 0;
+	const thinkingType = raw.thinkingType;
+	if (thinkingType !== void 0 && thinkingType !== "enabled" && thinkingType !== "adaptive") return void 0;
 	return {
 		id: raw.id,
 		name: raw.name,
 		...raw.description === void 0 ? {} : { description: raw.description },
 		...raw.contextWindow === void 0 ? {} : { contextWindow: raw.contextWindow },
 		...raw.priority === void 0 ? {} : { priority: raw.priority },
-		...reasoning === void 0 ? {} : { reasoning }
+		...reasoning === void 0 ? {} : { reasoning },
+		...thinkingType === void 0 ? {} : { thinkingType }
 	};
 }
 /**
@@ -2143,12 +2330,11 @@ async function* streamAnthropic(stream, onActivity) {
 //#endregion
 //#region src/providers/claude.ts
 const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+const CLAUDE_TOKEN_URL = "https://claude.ai/v1/oauth/token";
 const CLAUDE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
 const CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const CLAUDE_MODELS_URL = "https://api.anthropic.com/v1/models?beta=true";
 const CLAUDE_SCOPE = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-const CLAUDE_CALLBACK_PATH = "/callback";
 const CLAUDE_CONTEXT_WINDOW = 2e5;
 const CLAUDE_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
@@ -2158,28 +2344,28 @@ const CLAUDE_PREEMPT_MS = 5 * 6e4;
 * so these headers impersonate the CLI; the harness attribution user-agent
 * cannot be sent here (one user-agent slot, and the CLI's wins).
 */
-const CLAUDE_CLI_USER_AGENT = "claude-cli/2.1.97 (external, cli)";
-const CLAUDE_BETA_FLAGS = "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27";
-/** Static claude flow facts for the OAuth flow engine. */
-const claudeFlow = {
-	callbackPath: CLAUDE_CALLBACK_PATH,
-	listen: {
-		host: "localhost",
-		ports: [0]
-	},
-	buildAuthorizeUrl({ redirectUri, state, pkce }) {
-		return `${CLAUDE_AUTHORIZE_URL}?${new URLSearchParams({
-			code: "true",
-			client_id: CLAUDE_CLIENT_ID,
-			response_type: "code",
-			redirect_uri: redirectUri,
-			scope: CLAUDE_SCOPE,
-			code_challenge: pkce.challenge,
-			code_challenge_method: "S256",
-			state
-		}).toString()}`;
-	}
-};
+const CLAUDE_CLI_FALLBACK_VERSION = "2.1.234";
+function detectClaudeVersion() {
+	try {
+		const match = execFileSync("claude", ["--version"], {
+			timeout: 3e3,
+			encoding: "utf8"
+		}).match(/^(\d+\.\d+\.\d+)/);
+		if (match) return match[1];
+	} catch {}
+	return CLAUDE_CLI_FALLBACK_VERSION;
+}
+const CLAUDE_CLI_USER_AGENT = `claude-cli/${detectClaudeVersion()} (external, cli)`;
+const CLAUDE_BETA_FALLBACK = [
+	"claude-code-20250219",
+	"oauth-2025-04-20",
+	"interleaved-thinking-2025-05-14",
+	"context-management-2025-06-27",
+	"effort-2025-11-24",
+	"compact-2026-01-12",
+	"files-api-2025-04-14"
+].join(",");
+const CLAUDE_BETA_FLAGS = CLAUDE_BETA_FALLBACK;
 /** Best-effort account profile; login must not fail when this does. */
 async function fetchClaudeProfile(accessToken) {
 	try {
@@ -2347,22 +2533,79 @@ async function fetchClaudeUsage(session, fetchFn = fetch, signal) {
 		windows
 	};
 }
+function claudeThinkingType(capabilities) {
+	const types = capabilities?.thinking?.types;
+	if (types?.enabled?.supported === true) return "enabled";
+	if (types?.adaptive?.supported === true) return "adaptive";
+}
+/** Effort levels in display order; a model exposes only the ones it advertises as supported. */
+const CLAUDE_EFFORT_LEVELS = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+function claudeReasoning(capabilities) {
+	const effort = capabilities?.effort;
+	if (effort?.supported !== true) return void 0;
+	const efforts = CLAUDE_EFFORT_LEVELS.filter((level) => effort[level]?.supported === true).map((level) => ({
+		id: ReasoningEffortId(level),
+		name: level[0].toUpperCase() + level.slice(1)
+	}));
+	return efforts.length > 0 ? { efforts } : void 0;
+}
+/** Fetch the live model catalog from the subscription endpoint. */
+async function fetchClaudeModels(session, fetchFn = fetch) {
+	const response = await fetchFn(CLAUDE_MODELS_URL, { headers: {
+		"authorization": `Bearer ${session.accessToken}`,
+		"anthropic-version": "2023-06-01",
+		"user-agent": CLAUDE_CLI_USER_AGENT,
+		"anthropic-dangerous-direct-browser-access": "true",
+		"accept": "application/json"
+	} });
+	if (!response.ok) throw await httpLlmError(response, "claude models API");
+	const payload = await response.json();
+	if (!Array.isArray(payload.data)) throw new Error("claude models API returned an invalid catalog");
+	const models = payload.data.filter((m) => typeof m.id === "string").map((m) => {
+		const thinkingType = claudeThinkingType(m.capabilities);
+		const reasoning = claudeReasoning(m.capabilities);
+		return {
+			id: m.id,
+			name: m.display_name ?? m.id,
+			...thinkingType === void 0 ? {} : { thinkingType },
+			...reasoning === void 0 ? {} : { reasoning }
+		};
+	});
+	if (models.length === 0) throw new Error("claude models API returned an empty catalog");
+	return models;
+}
+/**
+* Claude Code's own SDK retry shape: exponential backoff starting at 1s,
+* doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
+* count of retries after the first attempt (Claude Code defaults to 10).
+*/
+const CLAUDE_RETRY_INITIAL_DELAY_MS = 1e3;
+const CLAUDE_RETRY_MAX_DELAY_MS = 6e4;
+const CLAUDE_RETRY_JITTER_RATIO = .2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ["text", "image"];
 /** Claude wire adapter: one instance serves the `claude` provider route. */
 var ClaudeAdapter = class extends LlmAdapter {
+	catalog;
 	constructor(options) {
 		super();
 		this.options = options;
+		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
-	providerInfo(provider) {
-		return {
-			id: provider,
-			name: "Claude (Subscription)"
-		};
+	async fetchCatalog() {
+		return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
 	}
-	async listModels(provider) {
-		if (!await this.options.tokens.hasSession()) return [];
+	async discovered(model) {
+		if (!this.options.discovery) return void 0;
+		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+	}
+	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
 			id: model.id,
@@ -2370,16 +2613,54 @@ var ClaudeAdapter = class extends LlmAdapter {
 			inputModalities: model.inputModalities ?? CLAUDE_MODALITIES
 		}));
 	}
-	resolveModel(provider, model) {
+	providerInfo(provider) {
+		return {
+			id: provider,
+			name: "Claude (Subscription)"
+		};
+	}
+	providerRetryPolicy(provider) {
+		if (this.options.maxRetries === void 0) return void 0;
+		return resolveRetryPolicy({
+			mode: "normal",
+			maxRetries: this.options.maxRetries,
+			backoff: {
+				initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
+				maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
+				jitterRatio: CLAUDE_RETRY_JITTER_RATIO
+			}
+		}, `claude: provider "${provider}" retryPolicy`);
+	}
+	async listModels(provider) {
+		if (await this.options.tokens.peek() === void 0) return [];
+		if (!this.options.discovery) return this.staticModels(provider);
+		try {
+			return (await this.catalog.get(() => this.fetchCatalog())).map((model) => ({
+				provider,
+				id: model.id,
+				name: model.name,
+				inputModalities: CLAUDE_MODALITIES
+			}));
+		} catch (error) {
+			if (error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL")) return [];
+			if (error instanceof LlmError && error.code === "AUTH") this.catalog.invalidate();
+			this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
+			return this.staticModels(provider);
+		}
+	}
+	async resolveModel(provider, model) {
+		const disc = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
-		return Promise.resolve({
+		const reasoning = disc?.reasoning;
+		return {
 			provider,
 			id: model,
-			name: configured?.name ?? model,
+			name: disc?.name ?? configured?.name ?? model,
 			inputModalities: configured?.inputModalities ?? CLAUDE_MODALITIES,
-			context: { contextWindow: configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
-			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS
-		});
+			context: { contextWindow: disc?.contextWindow ?? configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
+			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			...reasoning === void 0 ? {} : { reasoning }
+		};
 	}
 	async *stream(options) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
@@ -2401,14 +2682,42 @@ var ClaudeAdapter = class extends LlmAdapter {
 			watchdog.stop();
 		}
 	}
+	/**
+	* `display: 'summarized'` is set explicitly on both shapes: `adaptive`-type
+	* models default to `display: 'omitted'`, which returns thinking blocks with
+	* an empty `thinking` field — without this override the "Think" panel would
+	* always render empty even though real reasoning (and billed thinking_tokens)
+	* ran.
+	*/
+	thinkingParam(thinkingType, maxTokens) {
+		if (thinkingType === "adaptive") return {
+			type: "adaptive",
+			display: "summarized"
+		};
+		if (thinkingType === "enabled") {
+			const budget = Math.min(Math.max(1024, Math.floor(maxTokens * .5)), maxTokens - 100);
+			if (budget < 1024) return void 0;
+			return {
+				type: "enabled",
+				budget_tokens: budget,
+				display: "summarized"
+			};
+		}
+	}
 	async request(options, session, signal) {
 		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
+		const maxTokens = options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS;
+		const disc = await this.discovered(options.model);
+		const thinking = this.thinkingParam(disc?.thinkingType, maxTokens);
+		const effort = options.reasoningEffort !== void 0 && disc?.reasoning !== void 0 ? { output_config: { effort: String(options.reasoningEffort) } } : {};
 		const body = {
 			model: options.model,
-			max_tokens: options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			max_tokens: maxTokens,
 			system: toAnthropicSystem(options.system, messages),
 			messages: toAnthropicMessages(messages),
 			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toAnthropicTools(options.tools) } : {},
+			...thinking === void 0 ? {} : { thinking },
+			...effort,
 			stream: true,
 			...options.sessionId !== void 0 ? { metadata: { user_id: String(options.sessionId) } } : {}
 		};
@@ -3697,17 +4006,27 @@ const DEFAULT_MODELS = {
 	],
 	claude: [
 		{
-			id: "claude-opus-4-5",
-			name: "Claude Opus 4.5",
-			maxTokens: 64e3
+			id: "claude-opus-5",
+			name: "Claude Opus 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
+		},
+		{
+			id: "claude-sonnet-5",
+			name: "Claude Sonnet 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
 		},
 		{
-			id: "claude-sonnet-4-5",
-			name: "Claude Sonnet 4.5"
+			id: "claude-fable-5",
+			name: "Claude Fable 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
 		},
 		{
-			id: "claude-haiku-4-5",
-			name: "Claude Haiku 4.5"
+			id: "claude-haiku-4-5-20251001",
+			name: "Claude Haiku 4.5",
+			maxTokens: 64e3
 		}
 	],
 	grok: [
@@ -3796,7 +4115,17 @@ var SubscriptionsAuthController = class {
 		};
 	}
 	async login(provider) {
-		const spec = provider === "grok" ? await grokFlow() : provider === "claude" ? claudeFlow : codexFlow;
+		if (provider === "claude") {
+			const session = readClaudeCodeCredentials();
+			if (session) {
+				await this.persist("claude", session);
+				this.lastError.delete("claude");
+				this.onAuthChanged("claude");
+				return { authorizeUrl: "" };
+			}
+			throw new Error("Claude Code credentials not found. Run \"claude\" first to log in.");
+		}
+		const spec = provider === "grok" ? await grokFlow() : codexFlow;
 		const attempt = await this.flows.start(provider, spec);
 		this.complete(provider, attempt);
 		return { authorizeUrl: attempt.authorizeUrl };
@@ -3860,6 +4189,7 @@ function apply(ctx, config) {
 		handles.get(provider)?.replace([provider]);
 	};
 	let codexTokens;
+	let claudeTokens;
 	let grokTokens;
 	const usageFetchers = {};
 	for (const provider of providers) switch (provider) {
@@ -3896,18 +4226,23 @@ function apply(ctx, config) {
 				load: () => getSession("claude"),
 				save: (session) => saveSession("claude", session),
 				remove: () => deleteSession("claude"),
-				refresh: refreshClaude,
+				refresh: (session) => refreshClaudeSynced(session, refreshClaude),
 				isPermanent: isClaudePermanentRefreshError,
 				onRemoved: () => {
 					authChanged("claude");
 				}
 			});
+			claudeTokens = tokens;
 			usageFetchers.claude = async (signal) => fetchClaudeUsage(await tokens.session(), fetch, signal);
 			handles.set("claude", ctx.llm.registerAdapter(["claude"], new ClaudeAdapter({
 				models: catalog.claude,
 				streamIdleTimeoutMs,
 				tokens,
-				resolveAttachments
+				discovery: !overridden.has("claude"),
+				onWarn,
+				maxRetries: 10,
+				resolveAttachments,
+				catalogStore: catalogStore("claude")
 			})));
 			break;
 		}
@@ -3939,6 +4274,14 @@ function apply(ctx, config) {
 		}
 	}
 	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged, resolveAttachments, usageFetchers));
+	if (claudeTokens !== void 0) {
+		const syncTimer = setInterval(() => {
+			claudeTokens?.session().catch(() => {});
+		}, 5 * 6e4);
+		ctx.effect(() => () => {
+			clearInterval(syncTimer);
+		}, "dsh-plugin-subscriptions: claude background sync timer");
+	}
 	ctx.inject(["tools"], (toolsCtx) => {
 		if (grokTokens !== void 0) {
 			toolsCtx.tools.register(createXSearchTool({ tokens: grokTokens }));

package/lib/providers/catalog-store.js

@@ -71,6 +71,9 @@ function sanitizeModel(value) {
     const reasoning = raw.reasoning === undefined ? undefined : sanitizeReasoning(raw.reasoning);
     if (raw.reasoning !== undefined && reasoning === undefined)
         return undefined;
+    const thinkingType = raw.thinkingType;
+    if (thinkingType !== undefined && thinkingType !== 'enabled' && thinkingType !== 'adaptive')
+        return undefined;
     return {
         id: raw.id,
         name: raw.name,
@@ -78,6 +81,7 @@ function sanitizeModel(value) {
         ...raw.contextWindow === undefined ? {} : { contextWindow: raw.contextWindow },
         ...raw.priority === undefined ? {} : { priority: raw.priority },
         ...reasoning === undefined ? {} : { reasoning },
+        ...thinkingType === undefined ? {} : { thinkingType: thinkingType },
     };
 }
 /**

package/lib/providers/claude.d.ts

@@ -9,14 +9,23 @@ import type { FlowSpec } from '../auth/oauth-flow.js';
 import type { ClaudeSession } from '../auth/store.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import { TokenManager } from './common.js';
-import type { FetchFn, ModelEntry, ProviderUsage } from './common.js';
+import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
 export declare const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-export declare const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-export declare const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+export declare const CLAUDE_AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
+export declare const CLAUDE_TOKEN_URL = "https://claude.ai/v1/oauth/token";
 export declare const CLAUDE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
 export declare const CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+export declare const CLAUDE_MODELS_URL = "https://api.anthropic.com/v1/models?beta=true";
 /** Refresh when the access token has less than this much life left. */
 export declare const CLAUDE_PREEMPT_MS: number;
+/**
+ * The subscription endpoint only serves requests presenting as Claude Code,
+ * so these headers impersonate the CLI; the harness attribution user-agent
+ * cannot be sent here (one user-agent slot, and the CLI's wins).
+ */
+export declare const CLAUDE_CLI_FALLBACK_VERSION = "2.1.234";
+export declare function detectClaudeVersion(): string;
+export declare const CLAUDE_BETA_FALLBACK: string;
 /** Static claude flow facts for the OAuth flow engine. */
 export declare const claudeFlow: FlowSpec;
 /**
@@ -52,21 +61,44 @@ export declare const CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usa
  * @returns the mapped usage snapshot.
  */
 export declare function fetchClaudeUsage(session: ClaudeSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<ProviderUsage>;
+/** Fetch the live model catalog from the subscription endpoint. */
+export declare function fetchClaudeModels(session: ClaudeSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
 /** Constructor dependencies for {@link ClaudeAdapter}. */
 export interface ClaudeAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
     tokens: TokenManager<ClaudeSession>;
+    /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
+    discovery: boolean;
+    fetchFn?: FetchFn;
+    onWarn?: (message: string) => void;
+    /** Max retries on a retryable failure before giving up; matches Claude Code's own client-side retry count. Defaults to the dsh-llm default (2) when unset. */
+    maxRetries?: number;
     /** Resolve the attachment service per request; absent means image requests fail loudly. */
     resolveAttachments?: () => AttachmentStore | undefined;
+    /** Durable catalog store seeding capability metadata across restarts. */
+    catalogStore?: CatalogPersistence;
 }
 /** Claude wire adapter: one instance serves the `claude` provider route. */
 export declare class ClaudeAdapter extends LlmAdapter {
     private readonly options;
+    private readonly catalog;
     constructor(options: ClaudeAdapterOptions);
+    private fetchCatalog;
+    private discovered;
+    private staticModels;
     providerInfo(provider: string): LlmProviderInfo;
+    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy | undefined;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /**
+     * `display: 'summarized'` is set explicitly on both shapes: `adaptive`-type
+     * models default to `display: 'omitted'`, which returns thinking blocks with
+     * an empty `thinking` field — without this override the "Think" panel would
+     * always render empty even though real reasoning (and billed thinking_tokens)
+     * ran.
+     */
+    private thinkingParam;
     private request;
 }