dsh-plugin-subscriptions 0.4.2 → 0.5.1

package/README.md

@@ -1,12 +1,12 @@
-# dsh-plugin-subscriptions
+# dsh-plugin-subscriptions [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 English | [中文](README.zh.md)
 
-Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials directly from an existing Claude Code session (macOS Keychain or `~/.claude/.credentials.json`). Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
+Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials from an existing Claude Code session when there is one (macOS Keychain or `~/.claude/.credentials.json`) and otherwise falls back to the same browser OAuth flow, so the Claude Code CLI is not required. Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
 
 ## Demo
 
-Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code; Codex and Grok use OAuth (account address masked in the screenshot):
+Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code when available and otherwise uses OAuth, as Codex and Grok always do (account address masked in the screenshot):
 
 ![Subscriptions settings page](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -14,10 +14,14 @@ Logged-in providers join the session model picker with their live model catalogs
 
 ![Model picker with subscription models](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-picker.png)
 
-Models that advertise reasoning levels get an **Effort** selector in the same menu — Codex models, and Grok 4.6 / 4.5 (levels and defaults come from each provider's live catalog, not a hardcoded list):
+Models that advertise reasoning levels get an **Effort** selector in the same menu — Codex models, Grok 4.6 / 4.5, and Copilot's reasoning models (levels and defaults come from each provider's live catalog, not a hardcoded list; Copilot's `capabilities.supports.reasoning_effort` array is sent as `reasoning_effort` on chat completions and `reasoning.effort` on the Responses wire). Models listing both Copilot endpoints (gpt-5.4, gpt-5-mini) normally speak chat completions but reroute to `/responses` when a request combines function tools with an effort — Copilot rejects that combination on the chat wire:
 
 ![Reasoning effort selector](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-effort.png)
 
+Codex models whose catalog advertises the fast tier (the codex CLI's fast mode) get a **Speed** toggle in the composer's tool row, next to the model selector — Standard or Fast (`service_tier: priority`), per session. The `/fast` slash command offers the same choice as a popup; it errors with an explanation when the current model has no fast tier.
+
+![Speed toggle with the Standard/Fast menu open](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/speed-toggle.png)
+
 The `image_generate` tool renders its result inline in the conversation:
 
 ![image_generate renders the image inline](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/image-generate-inline.png)
@@ -37,10 +41,11 @@ The `video_generate` tool plays the generated clip inline:
 | `codex`  | ChatGPT Plus/Pro  | live catalog from `chatgpt.com/backend-api/codex/models` |
 | `claude` | Claude Pro/Max    | all models available in your subscription (Opus, Sonnet, Haiku, Fable — static catalog, updated with the plugin) |
 | `grok`   | X Premium (xAI)   | live catalog from `api.x.ai/v1/models` (chat models only); reasoning efforts from the Grok CLI catalog (`cli-chat-proxy.grok.com/v1/models`) |
+| `copilot` | GitHub Copilot   | live catalog from `api.githubcopilot.com/models` (chat models on both wires, with per-model vision flags and reasoning efforts); login uses the OAuth device flow (enter the shown code at `github.com/login/device`) |
 
 Only logged-in providers appear in the session model picker; the lists above refresh on login/logout. Vision-capable models declare `['text', 'image']` input modalities, and image content is translated to each provider's wire format.
 
-Logged-in cards also show **subscription usage** — per rate-limit window (5-hour session, weekly, and per-model weekly where the plan has one) with the used percentage, a progress bar, and the reset time, plus a Refresh button. Codex usage comes from `chatgpt.com/backend-api/wham/usage` (also reports the plan), Claude usage from `api.anthropic.com/api/oauth/usage`, and Grok usage from the Grok Build CLI proxy's `cli-chat-proxy.grok.com/v1/billing` (the source of the CLI's `/usage` panel; reports the shared weekly pool and the subscription tier).
+Logged-in cards also show **subscription usage** — per rate-limit window (5-hour session, weekly, and per-model weekly where the plan has one) with the used percentage, a progress bar, and the reset time, plus a Refresh button. Codex usage comes from `chatgpt.com/backend-api/wham/usage` (also reports the plan), Claude usage from `api.anthropic.com/api/oauth/usage`, and Grok usage from the Grok Build CLI proxy's `cli-chat-proxy.grok.com/v1/billing` (the source of the CLI's `/usage` panel; reports the shared weekly pool and the subscription tier). Copilot exposes no usage endpoint, so its card shows no usage section.
 
 Also included, registered when the matching provider is enabled:
 
@@ -101,7 +106,7 @@ Either way, restart `dsh web` afterwards so the new version loads.
 ## Use
 
 1. `dsh web`, open the printed URL.
-2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly from Claude Code (you must have run `claude` and logged in at least once). For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
+2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly if you have run `claude` and logged in at least once; without them, Claude authorizes in the browser like the others. For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
 3. In any session, open the model picker (`/model`) and choose a model under **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)**.
 
 Not logged in? The provider stays out of the picker, and requests fail with `MISSING_CREDENTIAL` pointing at the Settings page; nothing else breaks.
@@ -117,8 +122,16 @@ Not logged in? The provider stays out of the picker, and requests fail with `MIS
     models:                            # override the discovered/built-in catalogs
       codex:
         - { id: gpt-5.6-sol, name: GPT-5.6 Sol, contextWindow: 272000, inputModalities: [text, image] }
+      copilot:                         # manual entries disable Copilot catalog discovery
+        - { id: gpt-5.6-sol, wire: responses }   # copilot only: force the upstream protocol
 ```
 
+`wire` (copilot entries only) pins a model to `chat-completions` or `responses`. Manual
+entries keep working without it — the field exists because a configured model the live
+catalog does not know would otherwise default to `/chat/completions`, which
+responses-only families (gpt-5.5/5.6, …) reject. Pinning `chat-completions` also opts
+out of the tools+effort auto-reroute described above.
+
 ## Develop
 
 ```sh

package/README.zh.md

@@ -1,12 +1,12 @@
-# dsh-plugin-subscriptions
+# dsh-plugin-subscriptions [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 [English](README.md) | 中文
 
-把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 直接从已有的 Claude Code 会话导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`)。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
+把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 在存在 Claude Code 会话时直接导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`),否则回退到同样的浏览器 OAuth 流程,因此不要求安装 Claude Code CLI。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
 
 ## 演示
 
-设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 从 Claude Code 导入凭据;Codex 和 Grok 使用 OAuth(截图中账号已打码):
+设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 有 Claude Code 会话时导入凭据,否则和 Codex、Grok 一样走 OAuth(截图中账号已打码):
 
 ![订阅设置页](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -14,10 +14,14 @@
 
 ![模型选择器中的订阅模型](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-picker.png)
 
-声明了推理等级的模型会在同一菜单里多出**推理等级**选择 —— Codex 系列模型,以及 Grok 4.6 / 4.5(档位和默认值来自各 provider 的实时目录,不是硬编码列表):
+声明了推理等级的模型会在同一菜单里多出**推理等级**选择 —— Codex 系列模型、Grok 4.6 / 4.5,以及 Copilot 的推理模型(档位和默认值来自各 provider 的实时目录,不是硬编码列表;Copilot 的 `capabilities.supports.reasoning_effort` 数组会按协议映射为 chat completions 的 `reasoning_effort` 或 Responses 的 `reasoning.effort`)。同时声明两个 Copilot 端点的模型(gpt-5.4、gpt-5-mini)默认走 chat completions,但请求同时携带函数工具和推理等级时会自动改走 `/responses` —— Copilot 在 chat 线路上拒绝这种组合:
 
 ![推理等级选择器](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-effort.png)
 
+目录声明了 fast tier(即 codex CLI 的 fast 模式)的 Codex 模型,会在输入框工具行(模型选择器旁)多出一个**速度**开关 —— 标准 / 快速(`service_tier: priority`),按会话生效。`/fast` 斜杠命令提供同样的弹窗选择;当前模型不支持快速档时会提示原因。
+
+![速度开关及其标准/快速菜单](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/speed-toggle.png)
+
 `image_generate` 工具生成的图片直接内联显示在对话里:
 
 ![image_generate 内联显示生成的图片](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/image-generate-inline.png)
@@ -37,10 +41,11 @@
 | `codex`  | ChatGPT Plus/Pro | 从 `chatgpt.com/backend-api/codex/models` 实时获取 |
 | `claude` | Claude Pro/Max   | 订阅内所有可用模型(Opus、Sonnet、Haiku、Fable —— 静态目录,随插件更新) |
 | `grok`   | X Premium (xAI)  | 从 `api.x.ai/v1/models` 实时获取(仅对话模型);推理等级来自 Grok CLI 目录(`cli-chat-proxy.grok.com/v1/models`) |
+| `copilot` | GitHub Copilot  | 从 `api.githubcopilot.com/models` 实时获取(两种 wire 的对话模型,含按模型的视觉标记与推理等级);登录使用 OAuth 设备码流程(在 `github.com/login/device` 输入页面显示的验证码) |
 
 只有已登录的 provider 才会出现在会话模型选择器里;登录/退出后列表自动刷新。支持视觉的模型会声明 `['text', 'image']` 输入模态,图片内容会被翻译成各 provider 的 wire 格式。
 
-已登录的卡片还会显示**订阅用量**——按限额窗口(5 小时会话窗、每周窗,以及计划包含的按模型每周窗)展示已用百分比、进度条和重置时间,并带刷新按钮。Codex 用量来自 `chatgpt.com/backend-api/wham/usage`(同时报告计划类型),Claude 用量来自 `api.anthropic.com/api/oauth/usage`,Grok 用量来自 Grok Build CLI 代理的 `cli-chat-proxy.grok.com/v1/billing`(即 CLI `/usage` 面板的数据源,报告共享每周额度和订阅档位)。
+已登录的卡片还会显示**订阅用量**——按限额窗口(5 小时会话窗、每周窗,以及计划包含的按模型每周窗)展示已用百分比、进度条和重置时间,并带刷新按钮。Codex 用量来自 `chatgpt.com/backend-api/wham/usage`(同时报告计划类型),Claude 用量来自 `api.anthropic.com/api/oauth/usage`,Grok 用量来自 Grok Build CLI 代理的 `cli-chat-proxy.grok.com/v1/billing`(即 CLI `/usage` 面板的数据源,报告共享每周额度和订阅档位)。Copilot 没有用量接口,其卡片不显示用量区块。
 
 随 provider 启用自动注册的工具:
 
@@ -101,7 +106,7 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 ## 使用
 
 1. `dsh web`,打开打印的 URL。
-2. **设置 → 订阅**:点对应 provider 的「连接」。Claude 会即时从 Claude Code 导入凭据(需先运行过 `claude` 并登录)。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
+2. **设置 → 订阅**:点对应 provider 的「连接」。若先运行过 `claude` 并登录,Claude 会即时导入凭据;没有凭据时,Claude 也和其他 provider 一样在浏览器里授权。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
 3. 在任意会话里打开模型选择器(`/model`),选择 **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)** 下的模型。
 
 未登录时:该 provider 不出现在选择器里;直接请求会报 `MISSING_CREDENTIAL` 并提示去设置页登录,不影响其他功能。
@@ -117,8 +122,15 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
     models:                            # 覆盖实时发现/内置目录
       codex:
         - { id: gpt-5.6-sol, name: GPT-5.6 Sol, contextWindow: 272000, inputModalities: [text, image] }
+      copilot:                         # 手工条目会关闭 Copilot 目录发现
+        - { id: gpt-5.6-sol, wire: responses }   # 仅 copilot:强制指定上游协议
 ```
 
+`wire`（仅 copilot 条目）把模型固定到 `chat-completions` 或 `responses`。不加该字段手工条目照常
+工作——它存在的原因是:实时目录不认识的手工模型否则会默认走 `/chat/completions`，而
+responses-only 系列（gpt-5.5/5.6 等）会拒绝该端点。固定为 `chat-completions` 也会退出上文所述
+tools+effort 的自动改道。
+
 ## 开发
 
 ```sh

package/lib/auth/device-flow.d.ts

@@ -0,0 +1,64 @@
+/**
+ * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
+ * use the loopback redirect engine: no redirect URI, no PKCE, no client
+ * secret. The user opens a verification URL and types a short code while the
+ * plugin polls the token endpoint until GitHub releases the access token.
+ * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
+ * mirrors {@link OAuthFlowManager} so the auth controller can treat both
+ * engines uniformly.
+ */
+/** Static per-provider device-flow facts. */
+export interface DeviceFlowSpec {
+    /** OAuth App / GitHub App client id the device code is requested for. */
+    clientId: string;
+    /** Scope string requested at device-code time. */
+    scope: string;
+    /** Device-code endpoint (e.g. `https://github.com/login/device/code`). */
+    deviceCodeUrl: string;
+    /** Token polling endpoint (e.g. `https://github.com/login/oauth/access_token`). */
+    tokenUrl: string;
+    /** Fetch implementation (injectable for tests). */
+    fetchFn?: typeof fetch;
+}
+/** One in-flight device-flow login attempt. */
+export interface DeviceAttempt {
+    /** URL the user opens to authorize (e.g. `https://github.com/login/device`). */
+    readonly verificationUrl: string;
+    /** Short code the user types at the verification URL. */
+    readonly userCode: string;
+    /**
+     * Poll until GitHub releases the access token.
+     * @returns the GitHub OAuth access token; rejects on timeout, denial, or cancel.
+     */
+    waitToken(): Promise<string>;
+    /** Abort the attempt; `waitToken` rejects with a cancellation error. */
+    cancel(): void;
+}
+/**
+ * Own the set of in-flight device-flow attempts, keyed by provider. One
+ * attempt per provider at a time; an attempt removes itself when it settles.
+ */
+export declare class DeviceFlowManager {
+    private attempts;
+    /**
+     * Whether a device-flow attempt is running for one provider.
+     * @param provider - the provider route.
+     * @returns true while an attempt is polling.
+     */
+    isBusy(provider: string): boolean;
+    /**
+     * The pending attempt for one provider, when any.
+     * @param provider - the provider route.
+     * @returns the in-flight attempt, or `undefined`.
+     */
+    pending(provider: string): DeviceAttempt | undefined;
+    /**
+     * Start a device-flow attempt: request a device code, then poll the token
+     * endpoint in the background of `waitToken`.
+     * @param provider - the provider route (one attempt at a time).
+     * @param spec - static flow facts for this provider.
+     * @returns the live attempt; its `waitToken()` settles the login.
+     * @throws when an attempt is already running or the device-code request fails.
+     */
+    start(provider: string, spec: DeviceFlowSpec): Promise<DeviceAttempt>;
+}

package/lib/auth/device-flow.js

@@ -0,0 +1,176 @@
+/**
+ * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
+ * use the loopback redirect engine: no redirect URI, no PKCE, no client
+ * secret. The user opens a verification URL and types a short code while the
+ * plugin polls the token endpoint until GitHub releases the access token.
+ * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
+ * mirrors {@link OAuthFlowManager} so the auth controller can treat both
+ * engines uniformly.
+ */
+/** Default poll interval when the device-code response omits one. */
+const DEFAULT_INTERVAL_SEC = 5;
+/** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
+const DEFAULT_EXPIRES_IN_SEC = 900;
+/** Sleep for `ms`, rejecting early when the signal aborts. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        timer.unref();
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Own the set of in-flight device-flow attempts, keyed by provider. One
+ * attempt per provider at a time; an attempt removes itself when it settles.
+ */
+export class DeviceFlowManager {
+    attempts = new Map();
+    /**
+     * Whether a device-flow attempt is running for one provider.
+     * @param provider - the provider route.
+     * @returns true while an attempt is polling.
+     */
+    isBusy(provider) {
+        return this.attempts.has(provider);
+    }
+    /**
+     * The pending attempt for one provider, when any.
+     * @param provider - the provider route.
+     * @returns the in-flight attempt, or `undefined`.
+     */
+    pending(provider) {
+        return this.attempts.get(provider);
+    }
+    /**
+     * Start a device-flow attempt: request a device code, then poll the token
+     * endpoint in the background of `waitToken`.
+     * @param provider - the provider route (one attempt at a time).
+     * @param spec - static flow facts for this provider.
+     * @returns the live attempt; its `waitToken()` settles the login.
+     * @throws when an attempt is already running or the device-code request fails.
+     */
+    async start(provider, spec) {
+        if (this.attempts.has(provider)) {
+            throw new Error(`a ${provider} login attempt is already in progress`);
+        }
+        const fetchFn = spec.fetchFn ?? fetch;
+        const response = await fetchFn(spec.deviceCodeUrl, {
+            method: 'POST',
+            headers: {
+                'accept': 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({ client_id: spec.clientId, scope: spec.scope }).toString(),
+        });
+        if (!response.ok) {
+            throw new Error(`${provider} device-code request failed (HTTP ${String(response.status)})`);
+        }
+        const wire = await response.json();
+        if (typeof wire.device_code !== 'string' || wire.device_code.length === 0
+            || typeof wire.user_code !== 'string' || wire.user_code.length === 0
+            || typeof wire.verification_uri !== 'string' || wire.verification_uri.length === 0) {
+            throw new Error(`${provider} device-code response is missing device_code/user_code/verification_uri`);
+        }
+        const intervalSec = typeof wire.interval === 'number' && wire.interval > 0
+            ? wire.interval
+            : DEFAULT_INTERVAL_SEC;
+        const expiresInSec = typeof wire.expires_in === 'number' && wire.expires_in > 0
+            ? wire.expires_in
+            : DEFAULT_EXPIRES_IN_SEC;
+        const controller = new AbortController();
+        let resolveToken;
+        let rejectToken;
+        const tokenPromise = new Promise((resolve, reject) => {
+            resolveToken = resolve;
+            rejectToken = reject;
+        });
+        // The promise settles exactly once, from the poll loop below; an unhandled
+        // rejection must not surface if nobody awaited waitToken after a cancel.
+        tokenPromise.catch(() => undefined);
+        const settle = (error, token) => {
+            // Identity check: a late settle from a stale attempt (its poll loop or a
+            // cancel arriving after it already settled) must not kill a NEW attempt
+            // the user started for the same provider.
+            if (this.attempts.get(provider) !== attempt)
+                return;
+            this.attempts.delete(provider);
+            if (error !== undefined)
+                rejectToken(error);
+            else if (token !== undefined)
+                resolveToken(token);
+        };
+        const poll = async () => {
+            let intervalMs = intervalSec * 1000;
+            const deadline = Date.now() + expiresInSec * 1000;
+            while (true) {
+                await sleep(intervalMs, controller.signal);
+                if (Date.now() >= deadline) {
+                    settle(new Error(`login timed out after ${String(Math.round(expiresInSec))}s`));
+                    return;
+                }
+                const pollResponse = await fetchFn(spec.tokenUrl, {
+                    method: 'POST',
+                    headers: {
+                        'accept': 'application/json',
+                        'content-type': 'application/x-www-form-urlencoded',
+                    },
+                    body: new URLSearchParams({
+                        client_id: spec.clientId,
+                        device_code: wire.device_code,
+                        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    }).toString(),
+                    signal: controller.signal,
+                });
+                const result = await pollResponse.json();
+                if (typeof result.access_token === 'string' && result.access_token.length > 0) {
+                    settle(undefined, result.access_token);
+                    return;
+                }
+                switch (result.error) {
+                    case 'authorization_pending':
+                        break;
+                    case 'slow_down':
+                        // RFC 8628 §3.5: add five seconds to the poll interval.
+                        intervalMs += 5000;
+                        break;
+                    case 'access_denied':
+                        settle(new Error('login declined on the GitHub authorization page'));
+                        return;
+                    case 'expired_token':
+                        settle(new Error('the device code expired before authorization completed'));
+                        return;
+                    default:
+                        settle(new Error(`${provider} device-flow polling failed: ${result.error_description ?? result.error ?? `HTTP ${String(pollResponse.status)}`}`));
+                        return;
+                }
+            }
+        };
+        const attempt = {
+            verificationUrl: wire.verification_uri,
+            userCode: wire.user_code,
+            waitToken: () => tokenPromise,
+            cancel: () => {
+                controller.abort(new Error('login cancelled'));
+                settle(new Error('login cancelled'));
+            },
+        };
+        this.attempts.set(provider, attempt);
+        void poll().catch((error) => {
+            // Aborts land here from sleep/fetch; everything else is a transport or
+            // parse failure worth surfacing as the login failure.
+            settle(error instanceof Error ? error : new Error(String(error)));
+        });
+        return attempt;
+    }
+}

package/lib/auth/oauth-flow.js

@@ -117,7 +117,7 @@ export class OAuthFlowManager {
         }
         const input = {
             redirectUri: '',
-            state: randomToken(16),
+            state: randomToken(32),
             pkce: createPkce(),
             nonce: randomHex(8),
         };

package/lib/auth/rpc.d.ts

@@ -20,6 +20,22 @@ export interface VideoBytesResult {
     mediaType: string;
     dataBase64: string;
 }
+/** One session's speed choice: standard routing or the fast (priority) tier. */
+export type SpeedTier = 'standard' | 'fast';
+/** `speed` endpoint value: the session's choice plus the visibility list. */
+export interface SpeedState {
+    /** The session's current speed tier (default `standard`). */
+    tier: SpeedTier;
+    /** Codex model ids whose catalog advertises a fast tier. */
+    fastModels: string[];
+}
+/** Speed state the RPC handler delegates to (in-memory, per session). */
+export interface SpeedController {
+    /** Current speed state: the session's tier and the fast-capable codex models. */
+    speed(sessionId: string): Promise<SpeedState>;
+    /** Set one session's speed tier. */
+    setSpeed(sessionId: string, tier: SpeedTier): Promise<void>;
+}
 /** Login state of one provider, as rendered by the Settings page. */
 export interface ProviderStatus {
     /** Whether a session exists in the store. */
@@ -39,11 +55,13 @@ export interface AuthController {
     status(provider: ProviderId): Promise<ProviderStatus>;
     /**
      * Start a background login attempt.
-     * @returns the authorize URL for the user's browser.
+     * @returns the authorize URL for the user's browser; device-flow providers
+     *   (copilot) also return the `userCode` the user types at that URL.
      * @throws when an attempt is already running for this provider.
      */
     login(provider: ProviderId): Promise<{
         authorizeUrl: string;
+        userCode?: string;
     }>;
     /**
      * Feed a pasted callback URL or bare code into the pending attempt.
@@ -83,5 +101,6 @@ export interface AuthController {
  * Register the `/subscriptions-auth` RPC channel when a host connection exists.
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
+ * @param speed - the per-session speed-tier state backing the Speed toggle.
  */
-export declare function registerAuthRpc(ctx: Context, controller: AuthController): void;
+export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController): void;

package/lib/auth/rpc.js

@@ -42,6 +42,14 @@ function readString(payload, field) {
     }
     return value;
 }
+/** Validate the `setSpeed` endpoint's tier. */
+function readSpeedTier(payload) {
+    const tier = payload.tier;
+    if (tier !== 'standard' && tier !== 'fast') {
+        throw new BadRequest('payload.tier must be "standard" or "fast"');
+    }
+    return tier;
+}
 /** Validate the `image` endpoint's payload into a full attachment reference. */
 function readImageRef(payload) {
     if (typeof payload !== 'object' || payload === null)
@@ -88,7 +96,13 @@ function readVideoName(payload) {
     }
     return name;
 }
-async function dispatch(controller, endpoint, payload, signal) {
+/** Validate the session id both speed endpoints carry. */
+function readSessionId(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        throw new BadRequest('payload must be an object');
+    return readString(payload, 'sessionId');
+}
+async function dispatch(controller, speed, endpoint, payload, signal) {
     switch (endpoint) {
         case 'status': {
             const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
@@ -113,6 +127,11 @@ async function dispatch(controller, endpoint, payload, signal) {
             return ok(await controller.readImage(readImageRef(payload), signal));
         case 'video':
             return ok(await controller.readVideo(readVideoName(payload), signal));
+        case 'speed':
+            return ok(await speed.speed(readSessionId(payload)));
+        case 'setSpeed':
+            await speed.setSpeed(readSessionId(payload), readSpeedTier(payload));
+            return ok({ ok: true });
         default:
             throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
     }
@@ -121,8 +140,9 @@ async function dispatch(controller, endpoint, payload, signal) {
  * Register the `/subscriptions-auth` RPC channel when a host connection exists.
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
+ * @param speed - the per-session speed-tier state backing the Speed toggle.
  */
-export function registerAuthRpc(ctx, controller) {
+export function registerAuthRpc(ctx, controller, speed) {
     // `connection` is not in this plugin's inject list (headless compositions
     // lack it), so its startup order is unconstrained: defer registration until
     // the service exists instead of probing once at apply time.
@@ -130,7 +150,7 @@ export function registerAuthRpc(ctx, controller) {
         const connection = ctx.get('connection');
         ctx.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
             try {
-                return await dispatch(controller, endpoint, payload, signal);
+                return await dispatch(controller, speed, endpoint, payload, signal);
             }
             catch (error) {
                 return failure(error);

package/lib/auth/store.d.ts

@@ -7,7 +7,7 @@
  * owns the durable format.
  */
 /** Provider routes this plugin can serve. */
-export type ProviderId = 'codex' | 'claude' | 'grok';
+export type ProviderId = 'codex' | 'claude' | 'grok' | 'copilot';
 /** Every provider route, in display order. */
 export declare const PROVIDER_IDS: readonly ProviderId[];
 /** Stored ChatGPT/Codex subscription session. */
@@ -47,14 +47,32 @@ export interface GrokSession {
     /** Display account: email, username, or subject claim from the id token. */
     account?: string;
 }
+/**
+ * Stored GitHub Copilot subscription session. Two token generations are at
+ * play: the long-lived GitHub OAuth token from the device flow is kept in
+ * `refreshToken`, and `accessToken` carries the short-lived (~30 minutes)
+ * Copilot API token exchanged from it. A "refresh" is therefore a fresh
+ * exchange against `copilot_internal/v2/token`, not an OAuth grant.
+ */
+export interface CopilotSession {
+    /** Copilot API token; sent as the bearer on api.githubcopilot.com. */
+    accessToken: string;
+    /** Long-lived GitHub OAuth token from the device flow. */
+    refreshToken: string;
+    /** Epoch milliseconds at which the Copilot API token expires. */
+    expiresAt: number;
+    /** GitHub login name, for the status display. */
+    account?: string;
+}
 /** The durable store shape: one optional session per provider. */
 export interface SessionMap {
     codex?: CodexSession;
     claude?: ClaudeSession;
     grok?: GrokSession;
+    copilot?: CopilotSession;
 }
 /** Any stored session, for provider-agnostic plumbing. */
-export type StoredSession = CodexSession | ClaudeSession | GrokSession;
+export type StoredSession = CodexSession | ClaudeSession | GrokSession | CopilotSession;
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.

package/lib/auth/store.js

@@ -10,7 +10,7 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 /** Every provider route, in display order. */
-export const PROVIDER_IDS = ['codex', 'claude', 'grok'];
+export const PROVIDER_IDS = ['codex', 'claude', 'grok', 'copilot'];
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
@@ -103,6 +103,38 @@ async function writeStore(store, path) {
         throw error;
     }
 }
+/**
+ * One write chain per store path. Every mutation is a read-modify-write of a
+ * single JSON file, and the plugin has several independent writers — a login,
+ * a logout, and one token refresh per provider adapter, each on its own
+ * schedule. Overlapping them unserialized costs whichever provider read the
+ * store first its entry.
+ *
+ * A chain is dropped once nothing is queued behind it, so the map holds an
+ * entry only while writes are in flight.
+ */
+const writeChains = new Map();
+/**
+ * Run one read-modify-write of a store path after every write already queued
+ * for it. Callers join the chain synchronously, so call order is write order.
+ * @param path - the store file being mutated.
+ * @param action - the read-modify-write to run.
+ * @returns whatever `action` returns.
+ */
+async function serialize(path, action) {
+    const previous = writeChains.get(path) ?? Promise.resolve();
+    // Both handlers: a failed write must not strand everything queued behind it.
+    const next = previous.then(action, action);
+    const tail = next.then(() => undefined, () => undefined);
+    writeChains.set(path, tail);
+    try {
+        return await next;
+    }
+    finally {
+        if (writeChains.get(path) === tail)
+            writeChains.delete(path);
+    }
+}
 /**
  * Read one provider's session.
  * @param provider - the provider route.
@@ -119,9 +151,11 @@ export async function getSession(provider, path = authFilePath()) {
  * @param path - store file path; defaults to {@link authFilePath}.
  */
 export async function saveSession(provider, session, path = authFilePath()) {
-    const store = await loadStore(path);
-    store[provider] = session;
-    await writeStore(store, path);
+    return serialize(path, async () => {
+        const store = await loadStore(path);
+        store[provider] = session;
+        await writeStore(store, path);
+    });
 }
 /**
  * Delete one provider's session (logout).
@@ -129,9 +163,11 @@ export async function saveSession(provider, session, path = authFilePath()) {
  * @param path - store file path; defaults to {@link authFilePath}.
  */
 export async function deleteSession(provider, path = authFilePath()) {
-    const store = await loadStore(path);
-    if (store[provider] === undefined)
-        return;
-    delete store[provider];
-    await writeStore(store, path);
+    return serialize(path, async () => {
+        const store = await loadStore(path);
+        if (store[provider] === undefined)
+            return;
+        delete store[provider];
+        await writeStore(store, path);
+    });
 }