dsh-plugin-subscriptions 0.4.1 → 0.5.0

package/lib/index.js

@@ -1,9 +1,12 @@
 import z from "@deepseek-ai/schemastery";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, isContextWindowExceededError, isQuotaExceededError } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -33,7 +36,7 @@ function createPkce() {
 * @param bytes - entropy length.
 * @returns base64url-encoded random bytes.
 */
-function randomToken(bytes = 16) {
+function randomToken(bytes = 32) {
 	return base64url(randomBytes(bytes));
 }
 /**
@@ -247,6 +250,187 @@ var OAuthFlowManager = class {
 	}
 };
 
+//#endregion
+//#region src/auth/claude-code-creds.ts
+const PRIMARY_SERVICE = "Claude Code-credentials";
+const DEFAULT_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers";
+function toSession(data) {
+	if (typeof data.accessToken !== "string" || typeof data.refreshToken !== "string" || typeof data.expiresAt !== "number") return;
+	const scopes = Array.isArray(data.scopes) ? data.scopes.join(" ") : typeof data.scopes === "string" ? data.scopes : DEFAULT_SCOPES;
+	return {
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken,
+		expiresAt: Math.trunc(data.expiresAt),
+		scopes,
+		...typeof data.emailAddress === "string" ? { emailAddress: data.emailAddress } : {},
+		...typeof data.subscriptionType === "string" ? { subscriptionType: data.subscriptionType } : {}
+	};
+}
+function parseBlob(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	return toSession(parsed.claudeAiOauth ?? parsed);
+}
+function credentialsFilePath() {
+	return join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude"), ".credentials.json");
+}
+function readKeychainRaw() {
+	try {
+		return execFileSync("/usr/bin/security", [
+			"find-generic-password",
+			"-s",
+			PRIMARY_SERVICE,
+			"-w"
+		], {
+			timeout: 3e3,
+			encoding: "utf8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+}
+function readFileRaw() {
+	try {
+		return readFileSync(credentialsFilePath(), "utf8");
+	} catch {
+		return;
+	}
+}
+/** Read the current Claude Code session from its source of truth: macOS Keychain, falling back to the credentials file. */
+function readClaudeCodeCredentials() {
+	if (process.platform === "darwin") {
+		const raw$1 = readKeychainRaw();
+		const session = raw$1 !== void 0 ? parseBlob(raw$1) : void 0;
+		if (session) return session;
+	}
+	const raw = readFileRaw();
+	return raw !== void 0 ? parseBlob(raw) : void 0;
+}
+function blobMatches(raw, expectedAccessToken) {
+	return parseBlob(raw)?.accessToken === expectedAccessToken;
+}
+function getKeychainAccountName() {
+	try {
+		const output = execFileSync("/usr/bin/security", [
+			"find-generic-password",
+			"-s",
+			PRIMARY_SERVICE
+		], {
+			timeout: 2e3,
+			encoding: "utf8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		return /"acct"<blob>="([^"]*)"/.exec(output)?.[1];
+	} catch {
+		return;
+	}
+}
+/** Merge fresh tokens into an existing raw blob, preserving unrelated fields. */
+function mergeIntoBlob(existingRaw, next) {
+	let parsed;
+	try {
+		parsed = JSON.parse(existingRaw);
+	} catch {
+		return;
+	}
+	const target = parsed.claudeAiOauth ?? parsed;
+	target.accessToken = next.accessToken;
+	target.refreshToken = next.refreshToken;
+	target.expiresAt = next.expiresAt;
+	return JSON.stringify(parsed);
+}
+/**
+* Write a refreshed session back to Claude Code's own credential store, so
+* the `claude` CLI and any other consumer of the same account see the token
+* we just rotated. A stale-blob mismatch (something else rotated it first)
+* is a no-op — the caller already has that other rotation via readClaudeCodeCredentials.
+* @param next - the freshly refreshed session to persist.
+* @param expectedPriorAccessToken - the access token this refresh started from.
+* @returns whether the write-back succeeded.
+*/
+function writeBackClaudeCodeCredentials(next, expectedPriorAccessToken) {
+	if (process.platform === "darwin") {
+		const raw$1 = readKeychainRaw();
+		if (raw$1 === void 0 || !blobMatches(raw$1, expectedPriorAccessToken)) return false;
+		const updated$1 = mergeIntoBlob(raw$1, next);
+		if (updated$1 === void 0) return false;
+		const account = getKeychainAccountName() ?? PRIMARY_SERVICE;
+		try {
+			execFileSync("/usr/bin/security", [
+				"add-generic-password",
+				"-s",
+				PRIMARY_SERVICE,
+				"-a",
+				account,
+				"-w",
+				updated$1,
+				"-U"
+			], {
+				timeout: 2e3,
+				stdio: "ignore"
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	const path = credentialsFilePath();
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch {
+		return false;
+	}
+	if (!blobMatches(raw, expectedPriorAccessToken)) return false;
+	const updated = mergeIntoBlob(raw, next);
+	if (updated === void 0) return false;
+	try {
+		const dir = dirname(path);
+		if (!existsSync(dir)) mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, updated, {
+			encoding: "utf8",
+			mode: 384
+		});
+		chmodSync(path, 384);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Refresh a Claude session, first checking whether Claude Code's own store
+* already holds a fresher token (rotated by the `claude` CLI or another
+* consumer) before hitting the OAuth endpoint ourselves — and writing our own
+* refresh back to that store so every consumer of the account stays synced.
+* @param session - the session TokenManager wants refreshed.
+* @param doRefresh - the actual OAuth refresh-token grant (network call).
+* @returns the freshest available session.
+*/
+async function refreshClaudeSynced(session, doRefresh) {
+	const fromSource = readClaudeCodeCredentials();
+	const base = fromSource !== void 0 && fromSource.accessToken !== session.accessToken ? fromSource : session;
+	if (base.expiresAt > Date.now() + 6e4) return base;
+	const next = await doRefresh(base);
+	writeBackClaudeCodeCredentials(next, base.accessToken);
+	return next;
+}
+
 //#endregion
 //#region src/auth/store.ts
 /** Every provider route, in display order. */
@@ -411,6 +595,12 @@ function readString(payload, field) {
 	if (typeof value !== "string" || value.length === 0) throw new BadRequest(`payload.${field} must be a non-empty string`);
 	return value;
 }
+/** Validate the `setSpeed` endpoint's tier. */
+function readSpeedTier(payload) {
+	const tier = payload.tier;
+	if (tier !== "standard" && tier !== "fast") throw new BadRequest("payload.tier must be \"standard\" or \"fast\"");
+	return tier;
+}
 /** Validate the `image` endpoint's payload into a full attachment reference. */
 function readImageRef(payload) {
 	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
@@ -449,7 +639,12 @@ function readVideoName(payload) {
 	if (typeof name$1 !== "string" || !VIDEO_NAME_PATTERN.test(name$1)) throw new BadRequest("payload.name must be a bare .mp4 file name");
 	return name$1;
 }
-async function dispatch(controller, endpoint, payload, signal) {
+/** Validate the session id both speed endpoints carry. */
+function readSessionId(payload) {
+	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
+	return readString(payload, "sessionId");
+}
+async function dispatch(controller, speed, endpoint, payload, signal) {
 	switch (endpoint) {
 		case "status": {
 			const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
@@ -470,6 +665,10 @@ async function dispatch(controller, endpoint, payload, signal) {
 		case "usage": return ok(await controller.usage(readProvider(payload), signal));
 		case "image": return ok(await controller.readImage(readImageRef(payload), signal));
 		case "video": return ok(await controller.readVideo(readVideoName(payload), signal));
+		case "speed": return ok(await speed.speed(readSessionId(payload)));
+		case "setSpeed":
+			await speed.setSpeed(readSessionId(payload), readSpeedTier(payload));
+			return ok({ ok: true });
 		default: throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
 	}
 }
@@ -477,13 +676,14 @@ async function dispatch(controller, endpoint, payload, signal) {
 * Register the `/subscriptions-auth` RPC channel when a host connection exists.
 * @param ctx - the plugin context (headless profiles have no `connection`).
 * @param controller - the auth operations backing the endpoints.
+* @param speed - the per-session speed-tier state backing the Speed toggle.
 */
-function registerAuthRpc(ctx, controller) {
+function registerAuthRpc(ctx, controller, speed) {
 	ctx.inject(["connection"], (ctx$1) => {
 		const connection = ctx$1.get("connection");
 		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
 			try {
-				return await dispatch(controller, endpoint, payload, signal);
+				return await dispatch(controller, speed, endpoint, payload, signal);
 			} catch (error) {
 				return failure(error);
 			}
@@ -827,13 +1027,19 @@ function sanitizeModel(value) {
 	if (typeof raw.id !== "string" || raw.id.length === 0 || typeof raw.name !== "string" || raw.name.length === 0 || raw.description !== void 0 && typeof raw.description !== "string" || raw.contextWindow !== void 0 && (typeof raw.contextWindow !== "number" || !Number.isInteger(raw.contextWindow) || raw.contextWindow <= 0) || raw.priority !== void 0 && (typeof raw.priority !== "number" || !Number.isFinite(raw.priority))) return void 0;
 	const reasoning = raw.reasoning === void 0 ? void 0 : sanitizeReasoning(raw.reasoning);
 	if (raw.reasoning !== void 0 && reasoning === void 0) return void 0;
+	const thinkingType = raw.thinkingType;
+	if (thinkingType !== void 0 && thinkingType !== "enabled" && thinkingType !== "adaptive") return void 0;
+	const fastTier = raw.fastTier;
+	if (fastTier !== void 0 && typeof fastTier !== "boolean") return void 0;
 	return {
 		id: raw.id,
 		name: raw.name,
 		...raw.description === void 0 ? {} : { description: raw.description },
 		...raw.contextWindow === void 0 ? {} : { contextWindow: raw.contextWindow },
 		...raw.priority === void 0 ? {} : { priority: raw.priority },
-		...reasoning === void 0 ? {} : { reasoning }
+		...reasoning === void 0 ? {} : { reasoning },
+		...thinkingType === void 0 ? {} : { thinkingType },
+		...fastTier === void 0 ? {} : { fastTier }
 	};
 }
 /**
@@ -1397,6 +1603,14 @@ const CODEX_EFFORTS = [
 const CODEX_DEFAULT_EFFORT = ReasoningEffortId("high");
 /** Every gpt-5.x codex model accepts image input. */
 const CODEX_MODALITIES = ["text", "image"];
+/**
+* Fast tier (the codex CLI's "fast mode"): the Responses `service_tier` wire
+* value for priority processing, mirroring codex-rs
+* `ServiceTier::Fast.request_value()`. The legacy catalog spelling is the
+* `additional_speed_tiers` entry "fast".
+*/
+const CODEX_FAST_SERVICE_TIER = "priority";
+const CODEX_FAST_SPEED_TIER = "fast";
 /** Static codex flow facts for the OAuth flow engine. */
 const codexFlow = {
 	callbackPath: CODEX_CALLBACK_PATH,
@@ -1608,6 +1822,14 @@ function effortName(effort) {
 	return effort === "xhigh" ? "Extra High" : effort.charAt(0).toUpperCase() + effort.slice(1);
 }
 /**
+* Whether a catalog entry advertises the fast tier. Mirrors codex-rs
+* `ModelPreset::supports_fast_mode`: a `service_tiers` id matching the fast
+* wire value, or the legacy `additional_speed_tiers` "fast" entry.
+*/
+function supportsFastTier(entry) {
+	return (entry.service_tiers ?? []).some((tier) => tier.id === CODEX_FAST_SERVICE_TIER) || (entry.additional_speed_tiers ?? []).includes(CODEX_FAST_SPEED_TIER);
+}
+/**
 * Fetch the live codex model catalog with the session's auth headers.
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
@@ -1634,7 +1856,7 @@ async function fetchCodexModels(session, fetchFn = fetch) {
 			...level.description === void 0 ? {} : { description: level.description }
 		}));
 		const defaultEffort = typeof entry.default_reasoning_level === "string" && entry.default_reasoning_level.length > 0 && efforts.some((effort) => effort.id === ReasoningEffortId(entry.default_reasoning_level)) ? ReasoningEffortId(entry.default_reasoning_level) : void 0;
-		discovered.push({
+		const model = {
 			id: entry.slug,
 			name: typeof entry.display_name === "string" && entry.display_name.length > 0 ? entry.display_name : entry.slug,
 			...typeof entry.description === "string" && entry.description.length > 0 ? { description: entry.description } : {},
@@ -1643,13 +1865,40 @@ async function fetchCodexModels(session, fetchFn = fetch) {
 			...efforts.length > 0 ? { reasoning: {
 				efforts,
 				...defaultEffort === void 0 ? {} : { defaultEffort }
-			} } : {}
-		});
+			} } : {},
+			...supportsFastTier(entry) ? { fastTier: true } : {}
+		};
+		discovered.push(model);
 	}
 	discovered.sort((a, b) => (a.priority ?? Number.MAX_SAFE_INTEGER) - (b.priority ?? Number.MAX_SAFE_INTEGER));
 	if (discovered.length === 0) throw new Error(`codex models endpoint returned an empty catalog (client_version ${CODEX_CLIENT_VERSION})`);
 	return discovered;
 }
+/**
+* The Responses request body for one generation. A fast-tier request (the
+* composer Speed toggle, the codex CLI's fast mode) carries
+* `service_tier: priority`; the tier field is omitted entirely otherwise,
+* matching the CLI (it never sends an explicit standard tier).
+*/
+function codexRequestBody(options, resolved, fast) {
+	return {
+		model: options.model,
+		instructions: resolved.instructions ?? DEFAULT_CODEX_INSTRUCTIONS,
+		input: resolved.input,
+		...options.tools !== void 0 && options.tools.length > 0 ? { tools: toResponsesTools(options.tools) } : {},
+		tool_choice: "auto",
+		parallel_tool_calls: true,
+		...options.reasoningEffort !== void 0 ? { reasoning: {
+			effort: String(options.reasoningEffort),
+			summary: "auto"
+		} } : {},
+		store: false,
+		stream: true,
+		include: ["reasoning.encrypted_content"],
+		...options.sessionId !== void 0 ? { prompt_cache_key: String(options.sessionId) } : {},
+		...fast ? { service_tier: CODEX_FAST_SERVICE_TIER } : {}
+	};
+}
 /** Codex wire adapter: one instance serves the `codex` provider route. */
 var CodexAdapter = class extends LlmAdapter {
 	catalog;
@@ -1705,6 +1954,16 @@ var CodexAdapter = class extends LlmAdapter {
 		if (!this.options.discovery) return void 0;
 		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
 	}
+	/** Whether the discovered catalog advertises a fast tier for this model. */
+	async supportsFastTier(model) {
+		return (await this.discovered(model))?.fastTier === true;
+	}
+	/** Ids of every discovered model with a fast tier (the Speed toggle's visibility list). */
+	async fastCapableModels() {
+		if (!this.options.discovery) return [];
+		if (await this.options.tokens.peek() === void 0) return [];
+		return (await this.catalog.resolve(() => this.fetchCatalog()) ?? []).filter((model) => model.fastTier === true).map((model) => model.id);
+	}
 	async resolveModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
@@ -1743,23 +2002,9 @@ var CodexAdapter = class extends LlmAdapter {
 		}
 	}
 	async request(options, session, signal) {
-		const { instructions, input } = toResponsesInput(await resolveImages(options.messages, this.options.resolveAttachments?.(), signal), options.system);
-		const body = {
-			model: options.model,
-			instructions: instructions ?? DEFAULT_CODEX_INSTRUCTIONS,
-			input,
-			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toResponsesTools(options.tools) } : {},
-			tool_choice: "auto",
-			parallel_tool_calls: true,
-			...options.reasoningEffort !== void 0 ? { reasoning: {
-				effort: String(options.reasoningEffort),
-				summary: "auto"
-			} } : {},
-			store: false,
-			stream: true,
-			include: ["reasoning.encrypted_content"],
-			...options.sessionId !== void 0 ? { prompt_cache_key: String(options.sessionId) } : {}
-		};
+		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
+		const fast = this.options.speedFor !== void 0 && await this.options.speedFor(options.sessionId, options.model);
+		const body = codexRequestBody(options, toResponsesInput(messages, options.system), fast);
 		return fetch(CODEX_API_URL, {
 			method: "POST",
 			headers: {
@@ -2143,12 +2388,11 @@ async function* streamAnthropic(stream, onActivity) {
 //#endregion
 //#region src/providers/claude.ts
 const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+const CLAUDE_TOKEN_URL = "https://claude.ai/v1/oauth/token";
 const CLAUDE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
 const CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const CLAUDE_MODELS_URL = "https://api.anthropic.com/v1/models?beta=true";
 const CLAUDE_SCOPE = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-const CLAUDE_CALLBACK_PATH = "/callback";
 const CLAUDE_CONTEXT_WINDOW = 2e5;
 const CLAUDE_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
@@ -2158,28 +2402,32 @@ const CLAUDE_PREEMPT_MS = 5 * 6e4;
 * so these headers impersonate the CLI; the harness attribution user-agent
 * cannot be sent here (one user-agent slot, and the CLI's wins).
 */
-const CLAUDE_CLI_USER_AGENT = "claude-cli/2.1.97 (external, cli)";
-const CLAUDE_BETA_FLAGS = "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27";
-/** Static claude flow facts for the OAuth flow engine. */
-const claudeFlow = {
-	callbackPath: CLAUDE_CALLBACK_PATH,
-	listen: {
-		host: "localhost",
-		ports: [0]
-	},
-	buildAuthorizeUrl({ redirectUri, state, pkce }) {
-		return `${CLAUDE_AUTHORIZE_URL}?${new URLSearchParams({
-			code: "true",
-			client_id: CLAUDE_CLIENT_ID,
-			response_type: "code",
-			redirect_uri: redirectUri,
-			scope: CLAUDE_SCOPE,
-			code_challenge: pkce.challenge,
-			code_challenge_method: "S256",
-			state
-		}).toString()}`;
-	}
-};
+const CLAUDE_CLI_FALLBACK_VERSION = "2.1.234";
+function detectClaudeVersion() {
+	try {
+		const match = execFileSync("claude", ["--version"], {
+			timeout: 3e3,
+			encoding: "utf8"
+		}).match(/^(\d+\.\d+\.\d+)/);
+		if (match) return match[1];
+	} catch {}
+	return CLAUDE_CLI_FALLBACK_VERSION;
+}
+let claudeCliUserAgent;
+function getClaudeCliUserAgent() {
+	if (claudeCliUserAgent === void 0) claudeCliUserAgent = `claude-cli/${detectClaudeVersion()} (external, cli)`;
+	return claudeCliUserAgent;
+}
+const CLAUDE_BETA_FALLBACK = [
+	"claude-code-20250219",
+	"oauth-2025-04-20",
+	"interleaved-thinking-2025-05-14",
+	"context-management-2025-06-27",
+	"effort-2025-11-24",
+	"compact-2026-01-12",
+	"files-api-2025-04-14"
+].join(",");
+const CLAUDE_BETA_FLAGS = CLAUDE_BETA_FALLBACK;
 /** Best-effort account profile; login must not fail when this does. */
 async function fetchClaudeProfile(accessToken) {
 	try {
@@ -2322,7 +2570,7 @@ async function fetchClaudeUsage(session, fetchFn = fetch, signal) {
 		headers: {
 			"authorization": `Bearer ${session.accessToken}`,
 			"anthropic-beta": "oauth-2025-04-20",
-			"user-agent": CLAUDE_CLI_USER_AGENT,
+			"user-agent": getClaudeCliUserAgent(),
 			"accept": "application/json"
 		},
 		...signal === void 0 ? {} : { signal }
@@ -2347,22 +2595,79 @@ async function fetchClaudeUsage(session, fetchFn = fetch, signal) {
 		windows
 	};
 }
+function claudeThinkingType(capabilities) {
+	const types = capabilities?.thinking?.types;
+	if (types?.enabled?.supported === true) return "enabled";
+	if (types?.adaptive?.supported === true) return "adaptive";
+}
+/** Effort levels in display order; a model exposes only the ones it advertises as supported. */
+const CLAUDE_EFFORT_LEVELS = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+function claudeReasoning(capabilities) {
+	const effort = capabilities?.effort;
+	if (effort?.supported !== true) return void 0;
+	const efforts = CLAUDE_EFFORT_LEVELS.filter((level) => effort[level]?.supported === true).map((level) => ({
+		id: ReasoningEffortId(level),
+		name: level[0].toUpperCase() + level.slice(1)
+	}));
+	return efforts.length > 0 ? { efforts } : void 0;
+}
+/** Fetch the live model catalog from the subscription endpoint. */
+async function fetchClaudeModels(session, fetchFn = fetch) {
+	const response = await fetchFn(CLAUDE_MODELS_URL, { headers: {
+		"authorization": `Bearer ${session.accessToken}`,
+		"anthropic-version": "2023-06-01",
+		"user-agent": getClaudeCliUserAgent(),
+		"anthropic-dangerous-direct-browser-access": "true",
+		"accept": "application/json"
+	} });
+	if (!response.ok) throw await httpLlmError(response, "claude models API");
+	const payload = await response.json();
+	if (!Array.isArray(payload.data)) throw new Error("claude models API returned an invalid catalog");
+	const models = payload.data.filter((m) => typeof m.id === "string").map((m) => {
+		const thinkingType = claudeThinkingType(m.capabilities);
+		const reasoning = claudeReasoning(m.capabilities);
+		return {
+			id: m.id,
+			name: m.display_name ?? m.id,
+			...thinkingType === void 0 ? {} : { thinkingType },
+			...reasoning === void 0 ? {} : { reasoning }
+		};
+	});
+	if (models.length === 0) throw new Error("claude models API returned an empty catalog");
+	return models;
+}
+/**
+* Claude Code's own SDK retry shape: exponential backoff starting at 1s,
+* doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
+* count of retries after the first attempt (Claude Code defaults to 10).
+*/
+const CLAUDE_RETRY_INITIAL_DELAY_MS = 1e3;
+const CLAUDE_RETRY_MAX_DELAY_MS = 6e4;
+const CLAUDE_RETRY_JITTER_RATIO = .2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ["text", "image"];
 /** Claude wire adapter: one instance serves the `claude` provider route. */
 var ClaudeAdapter = class extends LlmAdapter {
+	catalog;
 	constructor(options) {
 		super();
 		this.options = options;
+		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
-	providerInfo(provider) {
-		return {
-			id: provider,
-			name: "Claude (Subscription)"
-		};
+	async fetchCatalog() {
+		return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
 	}
-	async listModels(provider) {
-		if (!await this.options.tokens.hasSession()) return [];
+	async discovered(model) {
+		if (!this.options.discovery) return void 0;
+		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+	}
+	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
 			id: model.id,
@@ -2370,16 +2675,54 @@ var ClaudeAdapter = class extends LlmAdapter {
 			inputModalities: model.inputModalities ?? CLAUDE_MODALITIES
 		}));
 	}
-	resolveModel(provider, model) {
+	providerInfo(provider) {
+		return {
+			id: provider,
+			name: "Claude (Subscription)"
+		};
+	}
+	providerRetryPolicy(provider) {
+		if (this.options.maxRetries === void 0) return void 0;
+		return resolveRetryPolicy({
+			mode: "normal",
+			maxRetries: this.options.maxRetries,
+			backoff: {
+				initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
+				maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
+				jitterRatio: CLAUDE_RETRY_JITTER_RATIO
+			}
+		}, `claude: provider "${provider}" retryPolicy`);
+	}
+	async listModels(provider) {
+		if (await this.options.tokens.peek() === void 0) return [];
+		if (!this.options.discovery) return this.staticModels(provider);
+		try {
+			return (await this.catalog.get(() => this.fetchCatalog())).map((model) => ({
+				provider,
+				id: model.id,
+				name: model.name,
+				inputModalities: CLAUDE_MODALITIES
+			}));
+		} catch (error) {
+			if (error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL")) return [];
+			if (error instanceof LlmError && error.code === "AUTH") this.catalog.invalidate();
+			this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
+			return this.staticModels(provider);
+		}
+	}
+	async resolveModel(provider, model) {
+		const disc = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
-		return Promise.resolve({
+		const reasoning = disc?.reasoning;
+		return {
 			provider,
 			id: model,
-			name: configured?.name ?? model,
+			name: disc?.name ?? configured?.name ?? model,
 			inputModalities: configured?.inputModalities ?? CLAUDE_MODALITIES,
-			context: { contextWindow: configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
-			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS
-		});
+			context: { contextWindow: disc?.contextWindow ?? configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
+			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			...reasoning === void 0 ? {} : { reasoning }
+		};
 	}
 	async *stream(options) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
@@ -2401,14 +2744,42 @@ var ClaudeAdapter = class extends LlmAdapter {
 			watchdog.stop();
 		}
 	}
+	/**
+	* `display: 'summarized'` is set explicitly on both shapes: `adaptive`-type
+	* models default to `display: 'omitted'`, which returns thinking blocks with
+	* an empty `thinking` field — without this override the "Think" panel would
+	* always render empty even though real reasoning (and billed thinking_tokens)
+	* ran.
+	*/
+	thinkingParam(thinkingType, maxTokens) {
+		if (thinkingType === "adaptive") return {
+			type: "adaptive",
+			display: "summarized"
+		};
+		if (thinkingType === "enabled") {
+			const budget = Math.min(Math.max(1024, Math.floor(maxTokens * .5)), maxTokens - 100);
+			if (budget < 1024) return void 0;
+			return {
+				type: "enabled",
+				budget_tokens: budget,
+				display: "summarized"
+			};
+		}
+	}
 	async request(options, session, signal) {
 		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
+		const maxTokens = options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS;
+		const disc = await this.discovered(options.model);
+		const thinking = this.thinkingParam(disc?.thinkingType, maxTokens);
+		const effort = options.reasoningEffort !== void 0 && disc?.reasoning !== void 0 ? { output_config: { effort: String(options.reasoningEffort) } } : {};
 		const body = {
 			model: options.model,
-			max_tokens: options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			max_tokens: maxTokens,
 			system: toAnthropicSystem(options.system, messages),
 			messages: toAnthropicMessages(messages),
 			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toAnthropicTools(options.tools) } : {},
+			...thinking === void 0 ? {} : { thinking },
+			...effort,
 			stream: true,
 			...options.sessionId !== void 0 ? { metadata: { user_id: String(options.sessionId) } } : {}
 		};
@@ -2418,7 +2789,7 @@ var ClaudeAdapter = class extends LlmAdapter {
 				"authorization": `Bearer ${session.accessToken}`,
 				"anthropic-version": "2023-06-01",
 				"anthropic-beta": CLAUDE_BETA_FLAGS,
-				"user-agent": CLAUDE_CLI_USER_AGENT,
+				"user-agent": getClaudeCliUserAgent(),
 				"x-app": "cli",
 				"anthropic-dangerous-direct-browser-access": "true",
 				"accept": "text/event-stream",
@@ -3388,19 +3759,11 @@ function createImageGenerateTool(options) {
 				});
 			}
 			const revisedPrompt = images.find((image) => image.revisedPrompt !== void 0)?.revisedPrompt;
-			const value = {
+			return {
 				paths,
 				...refs.length > 0 ? { images: refs } : {},
 				...revisedPrompt === void 0 ? {} : { revisedPrompt }
 			};
-			if (exec.parent !== void 0 && refs.length > 0) exec.deferContext(createUserMessage({
-				content: imageGenerateContent(value),
-				source: {
-					kind: "plugin",
-					plugin: "dsh-plugin-subscriptions"
-				}
-			}));
-			return value;
 		}
 	});
 }
@@ -3697,17 +4060,27 @@ const DEFAULT_MODELS = {
 	],
 	claude: [
 		{
-			id: "claude-opus-4-5",
-			name: "Claude Opus 4.5",
-			maxTokens: 64e3
+			id: "claude-opus-5",
+			name: "Claude Opus 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
+		},
+		{
+			id: "claude-sonnet-5",
+			name: "Claude Sonnet 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
 		},
 		{
-			id: "claude-sonnet-4-5",
-			name: "Claude Sonnet 4.5"
+			id: "claude-fable-5",
+			name: "Claude Fable 5",
+			maxTokens: 128e3,
+			contextWindow: 1e6
 		},
 		{
-			id: "claude-haiku-4-5",
-			name: "Claude Haiku 4.5"
+			id: "claude-haiku-4-5-20251001",
+			name: "Claude Haiku 4.5",
+			maxTokens: 64e3
 		}
 	],
 	grok: [
@@ -3796,7 +4169,17 @@ var SubscriptionsAuthController = class {
 		};
 	}
 	async login(provider) {
-		const spec = provider === "grok" ? await grokFlow() : provider === "claude" ? claudeFlow : codexFlow;
+		if (provider === "claude") {
+			const session = readClaudeCodeCredentials();
+			if (session) {
+				await this.persist("claude", session);
+				this.lastError.delete("claude");
+				this.onAuthChanged("claude");
+				return { authorizeUrl: "" };
+			}
+			throw new Error("Claude Code credentials not found. Run \"claude\" first to log in.");
+		}
+		const spec = provider === "grok" ? await grokFlow() : codexFlow;
 		const attempt = await this.flows.start(provider, spec);
 		this.complete(provider, attempt);
 		return { authorizeUrl: attempt.authorizeUrl };
@@ -3860,8 +4243,11 @@ function apply(ctx, config) {
 		handles.get(provider)?.replace([provider]);
 	};
 	let codexTokens;
+	let claudeTokens;
 	let grokTokens;
 	const usageFetchers = {};
+	const speedBySession = /* @__PURE__ */ new Map();
+	let codexAdapter;
 	for (const provider of providers) switch (provider) {
 		case "codex": {
 			const tokens = new TokenManager({
@@ -3878,15 +4264,19 @@ function apply(ctx, config) {
 			});
 			codexTokens = tokens;
 			usageFetchers.codex = async (signal) => fetchCodexUsage(await tokens.session(), fetch, signal);
-			handles.set("codex", ctx.llm.registerAdapter(["codex"], new CodexAdapter({
+			let adapter;
+			adapter = new CodexAdapter({
 				models: catalog.codex,
 				streamIdleTimeoutMs,
 				tokens,
 				discovery: !overridden.has("codex"),
 				onWarn,
 				resolveAttachments,
-				catalogStore: catalogStore("codex")
-			})));
+				catalogStore: catalogStore("codex"),
+				speedFor: (sessionId, model) => sessionId !== void 0 && speedBySession.get(sessionId) === "fast" && adapter.supportsFastTier(model)
+			});
+			codexAdapter = adapter;
+			handles.set("codex", ctx.llm.registerAdapter(["codex"], adapter));
 			break;
 		}
 		case "claude": {
@@ -3896,18 +4286,23 @@ function apply(ctx, config) {
 				load: () => getSession("claude"),
 				save: (session) => saveSession("claude", session),
 				remove: () => deleteSession("claude"),
-				refresh: refreshClaude,
+				refresh: (session) => refreshClaudeSynced(session, refreshClaude),
 				isPermanent: isClaudePermanentRefreshError,
 				onRemoved: () => {
 					authChanged("claude");
 				}
 			});
+			claudeTokens = tokens;
 			usageFetchers.claude = async (signal) => fetchClaudeUsage(await tokens.session(), fetch, signal);
 			handles.set("claude", ctx.llm.registerAdapter(["claude"], new ClaudeAdapter({
 				models: catalog.claude,
 				streamIdleTimeoutMs,
 				tokens,
-				resolveAttachments
+				discovery: !overridden.has("claude"),
+				onWarn,
+				maxRetries: 10,
+				resolveAttachments,
+				catalogStore: catalogStore("claude")
 			})));
 			break;
 		}
@@ -3938,7 +4333,26 @@ function apply(ctx, config) {
 			break;
 		}
 	}
-	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged, resolveAttachments, usageFetchers));
+	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged, resolveAttachments, usageFetchers), {
+		async speed(sessionId) {
+			return {
+				tier: speedBySession.get(sessionId) ?? "standard",
+				fastModels: await codexAdapter?.fastCapableModels() ?? []
+			};
+		},
+		async setSpeed(sessionId, tier) {
+			if (tier === "standard") speedBySession.delete(sessionId);
+			else speedBySession.set(sessionId, tier);
+		}
+	});
+	if (claudeTokens !== void 0) {
+		const syncTimer = setInterval(() => {
+			claudeTokens?.session().catch(() => {});
+		}, 5 * 6e4);
+		ctx.effect(() => () => {
+			clearInterval(syncTimer);
+		}, "dsh-plugin-subscriptions: claude background sync timer");
+	}
 	ctx.inject(["tools"], (toolsCtx) => {
 		if (grokTokens !== void 0) {
 			toolsCtx.tools.register(createXSearchTool({ tokens: grokTokens }));