dsh-plugin-subscriptions 0.5.0 → 0.5.1

package/README.md

@@ -1,12 +1,12 @@
-# dsh-plugin-subscriptions
+# dsh-plugin-subscriptions [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 English | [中文](README.zh.md)
 
-Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials directly from an existing Claude Code session (macOS Keychain or `~/.claude/.credentials.json`). Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
+Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials from an existing Claude Code session when there is one (macOS Keychain or `~/.claude/.credentials.json`) and otherwise falls back to the same browser OAuth flow, so the Claude Code CLI is not required. Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
 
 ## Demo
 
-Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code; Codex and Grok use OAuth (account address masked in the screenshot):
+Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code when available and otherwise uses OAuth, as Codex and Grok always do (account address masked in the screenshot):
 
 ![Subscriptions settings page](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -14,7 +14,7 @@ Logged-in providers join the session model picker with their live model catalogs
 
 ![Model picker with subscription models](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-picker.png)
 
-Models that advertise reasoning levels get an **Effort** selector in the same menu — Codex models, and Grok 4.6 / 4.5 (levels and defaults come from each provider's live catalog, not a hardcoded list):
+Models that advertise reasoning levels get an **Effort** selector in the same menu — Codex models, Grok 4.6 / 4.5, and Copilot's reasoning models (levels and defaults come from each provider's live catalog, not a hardcoded list; Copilot's `capabilities.supports.reasoning_effort` array is sent as `reasoning_effort` on chat completions and `reasoning.effort` on the Responses wire). Models listing both Copilot endpoints (gpt-5.4, gpt-5-mini) normally speak chat completions but reroute to `/responses` when a request combines function tools with an effort — Copilot rejects that combination on the chat wire:
 
 ![Reasoning effort selector](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-effort.png)
 
@@ -41,10 +41,11 @@ The `video_generate` tool plays the generated clip inline:
 | `codex`  | ChatGPT Plus/Pro  | live catalog from `chatgpt.com/backend-api/codex/models` |
 | `claude` | Claude Pro/Max    | all models available in your subscription (Opus, Sonnet, Haiku, Fable — static catalog, updated with the plugin) |
 | `grok`   | X Premium (xAI)   | live catalog from `api.x.ai/v1/models` (chat models only); reasoning efforts from the Grok CLI catalog (`cli-chat-proxy.grok.com/v1/models`) |
+| `copilot` | GitHub Copilot   | live catalog from `api.githubcopilot.com/models` (chat models on both wires, with per-model vision flags and reasoning efforts); login uses the OAuth device flow (enter the shown code at `github.com/login/device`) |
 
 Only logged-in providers appear in the session model picker; the lists above refresh on login/logout. Vision-capable models declare `['text', 'image']` input modalities, and image content is translated to each provider's wire format.
 
-Logged-in cards also show **subscription usage** — per rate-limit window (5-hour session, weekly, and per-model weekly where the plan has one) with the used percentage, a progress bar, and the reset time, plus a Refresh button. Codex usage comes from `chatgpt.com/backend-api/wham/usage` (also reports the plan), Claude usage from `api.anthropic.com/api/oauth/usage`, and Grok usage from the Grok Build CLI proxy's `cli-chat-proxy.grok.com/v1/billing` (the source of the CLI's `/usage` panel; reports the shared weekly pool and the subscription tier).
+Logged-in cards also show **subscription usage** — per rate-limit window (5-hour session, weekly, and per-model weekly where the plan has one) with the used percentage, a progress bar, and the reset time, plus a Refresh button. Codex usage comes from `chatgpt.com/backend-api/wham/usage` (also reports the plan), Claude usage from `api.anthropic.com/api/oauth/usage`, and Grok usage from the Grok Build CLI proxy's `cli-chat-proxy.grok.com/v1/billing` (the source of the CLI's `/usage` panel; reports the shared weekly pool and the subscription tier). Copilot exposes no usage endpoint, so its card shows no usage section.
 
 Also included, registered when the matching provider is enabled:
 
@@ -105,7 +106,7 @@ Either way, restart `dsh web` afterwards so the new version loads.
 ## Use
 
 1. `dsh web`, open the printed URL.
-2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly from Claude Code (you must have run `claude` and logged in at least once). For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
+2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly if you have run `claude` and logged in at least once; without them, Claude authorizes in the browser like the others. For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
 3. In any session, open the model picker (`/model`) and choose a model under **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)**.
 
 Not logged in? The provider stays out of the picker, and requests fail with `MISSING_CREDENTIAL` pointing at the Settings page; nothing else breaks.
@@ -121,8 +122,16 @@ Not logged in? The provider stays out of the picker, and requests fail with `MIS
     models:                            # override the discovered/built-in catalogs
       codex:
         - { id: gpt-5.6-sol, name: GPT-5.6 Sol, contextWindow: 272000, inputModalities: [text, image] }
+      copilot:                         # manual entries disable Copilot catalog discovery
+        - { id: gpt-5.6-sol, wire: responses }   # copilot only: force the upstream protocol
 ```
 
+`wire` (copilot entries only) pins a model to `chat-completions` or `responses`. Manual
+entries keep working without it — the field exists because a configured model the live
+catalog does not know would otherwise default to `/chat/completions`, which
+responses-only families (gpt-5.5/5.6, …) reject. Pinning `chat-completions` also opts
+out of the tools+effort auto-reroute described above.
+
 ## Develop
 
 ```sh

package/README.zh.md

@@ -1,12 +1,12 @@
-# dsh-plugin-subscriptions
+# dsh-plugin-subscriptions [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 [English](README.md) | 中文
 
-把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 直接从已有的 Claude Code 会话导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`)。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
+把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 在存在 Claude Code 会话时直接导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`),否则回退到同样的浏览器 OAuth 流程,因此不要求安装 Claude Code CLI。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
 
 ## 演示
 
-设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 从 Claude Code 导入凭据;Codex 和 Grok 使用 OAuth(截图中账号已打码):
+设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 有 Claude Code 会话时导入凭据,否则和 Codex、Grok 一样走 OAuth(截图中账号已打码):
 
 ![订阅设置页](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -14,7 +14,7 @@
 
 ![模型选择器中的订阅模型](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-picker.png)
 
-声明了推理等级的模型会在同一菜单里多出**推理等级**选择 —— Codex 系列模型,以及 Grok 4.6 / 4.5(档位和默认值来自各 provider 的实时目录,不是硬编码列表):
+声明了推理等级的模型会在同一菜单里多出**推理等级**选择 —— Codex 系列模型、Grok 4.6 / 4.5,以及 Copilot 的推理模型(档位和默认值来自各 provider 的实时目录,不是硬编码列表;Copilot 的 `capabilities.supports.reasoning_effort` 数组会按协议映射为 chat completions 的 `reasoning_effort` 或 Responses 的 `reasoning.effort`)。同时声明两个 Copilot 端点的模型(gpt-5.4、gpt-5-mini)默认走 chat completions,但请求同时携带函数工具和推理等级时会自动改走 `/responses` —— Copilot 在 chat 线路上拒绝这种组合:
 
 ![推理等级选择器](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-effort.png)
 
@@ -41,10 +41,11 @@
 | `codex`  | ChatGPT Plus/Pro | 从 `chatgpt.com/backend-api/codex/models` 实时获取 |
 | `claude` | Claude Pro/Max   | 订阅内所有可用模型(Opus、Sonnet、Haiku、Fable —— 静态目录,随插件更新) |
 | `grok`   | X Premium (xAI)  | 从 `api.x.ai/v1/models` 实时获取(仅对话模型);推理等级来自 Grok CLI 目录(`cli-chat-proxy.grok.com/v1/models`) |
+| `copilot` | GitHub Copilot  | 从 `api.githubcopilot.com/models` 实时获取(两种 wire 的对话模型,含按模型的视觉标记与推理等级);登录使用 OAuth 设备码流程(在 `github.com/login/device` 输入页面显示的验证码) |
 
 只有已登录的 provider 才会出现在会话模型选择器里;登录/退出后列表自动刷新。支持视觉的模型会声明 `['text', 'image']` 输入模态,图片内容会被翻译成各 provider 的 wire 格式。
 
-已登录的卡片还会显示**订阅用量**——按限额窗口(5 小时会话窗、每周窗,以及计划包含的按模型每周窗)展示已用百分比、进度条和重置时间,并带刷新按钮。Codex 用量来自 `chatgpt.com/backend-api/wham/usage`(同时报告计划类型),Claude 用量来自 `api.anthropic.com/api/oauth/usage`,Grok 用量来自 Grok Build CLI 代理的 `cli-chat-proxy.grok.com/v1/billing`(即 CLI `/usage` 面板的数据源,报告共享每周额度和订阅档位)。
+已登录的卡片还会显示**订阅用量**——按限额窗口(5 小时会话窗、每周窗,以及计划包含的按模型每周窗)展示已用百分比、进度条和重置时间,并带刷新按钮。Codex 用量来自 `chatgpt.com/backend-api/wham/usage`(同时报告计划类型),Claude 用量来自 `api.anthropic.com/api/oauth/usage`,Grok 用量来自 Grok Build CLI 代理的 `cli-chat-proxy.grok.com/v1/billing`(即 CLI `/usage` 面板的数据源,报告共享每周额度和订阅档位)。Copilot 没有用量接口,其卡片不显示用量区块。
 
 随 provider 启用自动注册的工具:
 
@@ -105,7 +106,7 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 ## 使用
 
 1. `dsh web`,打开打印的 URL。
-2. **设置 → 订阅**:点对应 provider 的「连接」。Claude 会即时从 Claude Code 导入凭据(需先运行过 `claude` 并登录)。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
+2. **设置 → 订阅**:点对应 provider 的「连接」。若先运行过 `claude` 并登录,Claude 会即时导入凭据;没有凭据时,Claude 也和其他 provider 一样在浏览器里授权。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
 3. 在任意会话里打开模型选择器(`/model`),选择 **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)** 下的模型。
 
 未登录时:该 provider 不出现在选择器里;直接请求会报 `MISSING_CREDENTIAL` 并提示去设置页登录,不影响其他功能。
@@ -121,8 +122,15 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
     models:                            # 覆盖实时发现/内置目录
       codex:
         - { id: gpt-5.6-sol, name: GPT-5.6 Sol, contextWindow: 272000, inputModalities: [text, image] }
+      copilot:                         # 手工条目会关闭 Copilot 目录发现
+        - { id: gpt-5.6-sol, wire: responses }   # 仅 copilot:强制指定上游协议
 ```
 
+`wire`（仅 copilot 条目）把模型固定到 `chat-completions` 或 `responses`。不加该字段手工条目照常
+工作——它存在的原因是:实时目录不认识的手工模型否则会默认走 `/chat/completions`，而
+responses-only 系列（gpt-5.5/5.6 等）会拒绝该端点。固定为 `chat-completions` 也会退出上文所述
+tools+effort 的自动改道。
+
 ## 开发
 
 ```sh

package/lib/auth/device-flow.d.ts

@@ -0,0 +1,64 @@
+/**
+ * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
+ * use the loopback redirect engine: no redirect URI, no PKCE, no client
+ * secret. The user opens a verification URL and types a short code while the
+ * plugin polls the token endpoint until GitHub releases the access token.
+ * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
+ * mirrors {@link OAuthFlowManager} so the auth controller can treat both
+ * engines uniformly.
+ */
+/** Static per-provider device-flow facts. */
+export interface DeviceFlowSpec {
+    /** OAuth App / GitHub App client id the device code is requested for. */
+    clientId: string;
+    /** Scope string requested at device-code time. */
+    scope: string;
+    /** Device-code endpoint (e.g. `https://github.com/login/device/code`). */
+    deviceCodeUrl: string;
+    /** Token polling endpoint (e.g. `https://github.com/login/oauth/access_token`). */
+    tokenUrl: string;
+    /** Fetch implementation (injectable for tests). */
+    fetchFn?: typeof fetch;
+}
+/** One in-flight device-flow login attempt. */
+export interface DeviceAttempt {
+    /** URL the user opens to authorize (e.g. `https://github.com/login/device`). */
+    readonly verificationUrl: string;
+    /** Short code the user types at the verification URL. */
+    readonly userCode: string;
+    /**
+     * Poll until GitHub releases the access token.
+     * @returns the GitHub OAuth access token; rejects on timeout, denial, or cancel.
+     */
+    waitToken(): Promise<string>;
+    /** Abort the attempt; `waitToken` rejects with a cancellation error. */
+    cancel(): void;
+}
+/**
+ * Own the set of in-flight device-flow attempts, keyed by provider. One
+ * attempt per provider at a time; an attempt removes itself when it settles.
+ */
+export declare class DeviceFlowManager {
+    private attempts;
+    /**
+     * Whether a device-flow attempt is running for one provider.
+     * @param provider - the provider route.
+     * @returns true while an attempt is polling.
+     */
+    isBusy(provider: string): boolean;
+    /**
+     * The pending attempt for one provider, when any.
+     * @param provider - the provider route.
+     * @returns the in-flight attempt, or `undefined`.
+     */
+    pending(provider: string): DeviceAttempt | undefined;
+    /**
+     * Start a device-flow attempt: request a device code, then poll the token
+     * endpoint in the background of `waitToken`.
+     * @param provider - the provider route (one attempt at a time).
+     * @param spec - static flow facts for this provider.
+     * @returns the live attempt; its `waitToken()` settles the login.
+     * @throws when an attempt is already running or the device-code request fails.
+     */
+    start(provider: string, spec: DeviceFlowSpec): Promise<DeviceAttempt>;
+}

package/lib/auth/device-flow.js

@@ -0,0 +1,176 @@
+/**
+ * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
+ * use the loopback redirect engine: no redirect URI, no PKCE, no client
+ * secret. The user opens a verification URL and types a short code while the
+ * plugin polls the token endpoint until GitHub releases the access token.
+ * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
+ * mirrors {@link OAuthFlowManager} so the auth controller can treat both
+ * engines uniformly.
+ */
+/** Default poll interval when the device-code response omits one. */
+const DEFAULT_INTERVAL_SEC = 5;
+/** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
+const DEFAULT_EXPIRES_IN_SEC = 900;
+/** Sleep for `ms`, rejecting early when the signal aborts. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        timer.unref();
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Own the set of in-flight device-flow attempts, keyed by provider. One
+ * attempt per provider at a time; an attempt removes itself when it settles.
+ */
+export class DeviceFlowManager {
+    attempts = new Map();
+    /**
+     * Whether a device-flow attempt is running for one provider.
+     * @param provider - the provider route.
+     * @returns true while an attempt is polling.
+     */
+    isBusy(provider) {
+        return this.attempts.has(provider);
+    }
+    /**
+     * The pending attempt for one provider, when any.
+     * @param provider - the provider route.
+     * @returns the in-flight attempt, or `undefined`.
+     */
+    pending(provider) {
+        return this.attempts.get(provider);
+    }
+    /**
+     * Start a device-flow attempt: request a device code, then poll the token
+     * endpoint in the background of `waitToken`.
+     * @param provider - the provider route (one attempt at a time).
+     * @param spec - static flow facts for this provider.
+     * @returns the live attempt; its `waitToken()` settles the login.
+     * @throws when an attempt is already running or the device-code request fails.
+     */
+    async start(provider, spec) {
+        if (this.attempts.has(provider)) {
+            throw new Error(`a ${provider} login attempt is already in progress`);
+        }
+        const fetchFn = spec.fetchFn ?? fetch;
+        const response = await fetchFn(spec.deviceCodeUrl, {
+            method: 'POST',
+            headers: {
+                'accept': 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({ client_id: spec.clientId, scope: spec.scope }).toString(),
+        });
+        if (!response.ok) {
+            throw new Error(`${provider} device-code request failed (HTTP ${String(response.status)})`);
+        }
+        const wire = await response.json();
+        if (typeof wire.device_code !== 'string' || wire.device_code.length === 0
+            || typeof wire.user_code !== 'string' || wire.user_code.length === 0
+            || typeof wire.verification_uri !== 'string' || wire.verification_uri.length === 0) {
+            throw new Error(`${provider} device-code response is missing device_code/user_code/verification_uri`);
+        }
+        const intervalSec = typeof wire.interval === 'number' && wire.interval > 0
+            ? wire.interval
+            : DEFAULT_INTERVAL_SEC;
+        const expiresInSec = typeof wire.expires_in === 'number' && wire.expires_in > 0
+            ? wire.expires_in
+            : DEFAULT_EXPIRES_IN_SEC;
+        const controller = new AbortController();
+        let resolveToken;
+        let rejectToken;
+        const tokenPromise = new Promise((resolve, reject) => {
+            resolveToken = resolve;
+            rejectToken = reject;
+        });
+        // The promise settles exactly once, from the poll loop below; an unhandled
+        // rejection must not surface if nobody awaited waitToken after a cancel.
+        tokenPromise.catch(() => undefined);
+        const settle = (error, token) => {
+            // Identity check: a late settle from a stale attempt (its poll loop or a
+            // cancel arriving after it already settled) must not kill a NEW attempt
+            // the user started for the same provider.
+            if (this.attempts.get(provider) !== attempt)
+                return;
+            this.attempts.delete(provider);
+            if (error !== undefined)
+                rejectToken(error);
+            else if (token !== undefined)
+                resolveToken(token);
+        };
+        const poll = async () => {
+            let intervalMs = intervalSec * 1000;
+            const deadline = Date.now() + expiresInSec * 1000;
+            while (true) {
+                await sleep(intervalMs, controller.signal);
+                if (Date.now() >= deadline) {
+                    settle(new Error(`login timed out after ${String(Math.round(expiresInSec))}s`));
+                    return;
+                }
+                const pollResponse = await fetchFn(spec.tokenUrl, {
+                    method: 'POST',
+                    headers: {
+                        'accept': 'application/json',
+                        'content-type': 'application/x-www-form-urlencoded',
+                    },
+                    body: new URLSearchParams({
+                        client_id: spec.clientId,
+                        device_code: wire.device_code,
+                        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    }).toString(),
+                    signal: controller.signal,
+                });
+                const result = await pollResponse.json();
+                if (typeof result.access_token === 'string' && result.access_token.length > 0) {
+                    settle(undefined, result.access_token);
+                    return;
+                }
+                switch (result.error) {
+                    case 'authorization_pending':
+                        break;
+                    case 'slow_down':
+                        // RFC 8628 §3.5: add five seconds to the poll interval.
+                        intervalMs += 5000;
+                        break;
+                    case 'access_denied':
+                        settle(new Error('login declined on the GitHub authorization page'));
+                        return;
+                    case 'expired_token':
+                        settle(new Error('the device code expired before authorization completed'));
+                        return;
+                    default:
+                        settle(new Error(`${provider} device-flow polling failed: ${result.error_description ?? result.error ?? `HTTP ${String(pollResponse.status)}`}`));
+                        return;
+                }
+            }
+        };
+        const attempt = {
+            verificationUrl: wire.verification_uri,
+            userCode: wire.user_code,
+            waitToken: () => tokenPromise,
+            cancel: () => {
+                controller.abort(new Error('login cancelled'));
+                settle(new Error('login cancelled'));
+            },
+        };
+        this.attempts.set(provider, attempt);
+        void poll().catch((error) => {
+            // Aborts land here from sleep/fetch; everything else is a transport or
+            // parse failure worth surfacing as the login failure.
+            settle(error instanceof Error ? error : new Error(String(error)));
+        });
+        return attempt;
+    }
+}

package/lib/auth/oauth-flow.js

@@ -117,7 +117,7 @@ export class OAuthFlowManager {
         }
         const input = {
             redirectUri: '',
-            state: randomToken(16),
+            state: randomToken(32),
             pkce: createPkce(),
             nonce: randomHex(8),
         };

package/lib/auth/rpc.d.ts

@@ -55,11 +55,13 @@ export interface AuthController {
     status(provider: ProviderId): Promise<ProviderStatus>;
     /**
      * Start a background login attempt.
-     * @returns the authorize URL for the user's browser.
+     * @returns the authorize URL for the user's browser; device-flow providers
+     *   (copilot) also return the `userCode` the user types at that URL.
      * @throws when an attempt is already running for this provider.
      */
     login(provider: ProviderId): Promise<{
         authorizeUrl: string;
+        userCode?: string;
     }>;
     /**
      * Feed a pasted callback URL or bare code into the pending attempt.

package/lib/auth/store.d.ts

@@ -7,7 +7,7 @@
  * owns the durable format.
  */
 /** Provider routes this plugin can serve. */
-export type ProviderId = 'codex' | 'claude' | 'grok';
+export type ProviderId = 'codex' | 'claude' | 'grok' | 'copilot';
 /** Every provider route, in display order. */
 export declare const PROVIDER_IDS: readonly ProviderId[];
 /** Stored ChatGPT/Codex subscription session. */
@@ -47,14 +47,32 @@ export interface GrokSession {
     /** Display account: email, username, or subject claim from the id token. */
     account?: string;
 }
+/**
+ * Stored GitHub Copilot subscription session. Two token generations are at
+ * play: the long-lived GitHub OAuth token from the device flow is kept in
+ * `refreshToken`, and `accessToken` carries the short-lived (~30 minutes)
+ * Copilot API token exchanged from it. A "refresh" is therefore a fresh
+ * exchange against `copilot_internal/v2/token`, not an OAuth grant.
+ */
+export interface CopilotSession {
+    /** Copilot API token; sent as the bearer on api.githubcopilot.com. */
+    accessToken: string;
+    /** Long-lived GitHub OAuth token from the device flow. */
+    refreshToken: string;
+    /** Epoch milliseconds at which the Copilot API token expires. */
+    expiresAt: number;
+    /** GitHub login name, for the status display. */
+    account?: string;
+}
 /** The durable store shape: one optional session per provider. */
 export interface SessionMap {
     codex?: CodexSession;
     claude?: ClaudeSession;
     grok?: GrokSession;
+    copilot?: CopilotSession;
 }
 /** Any stored session, for provider-agnostic plumbing. */
-export type StoredSession = CodexSession | ClaudeSession | GrokSession;
+export type StoredSession = CodexSession | ClaudeSession | GrokSession | CopilotSession;
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.

package/lib/auth/store.js

@@ -10,7 +10,7 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 /** Every provider route, in display order. */
-export const PROVIDER_IDS = ['codex', 'claude', 'grok'];
+export const PROVIDER_IDS = ['codex', 'claude', 'grok', 'copilot'];
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
@@ -103,6 +103,38 @@ async function writeStore(store, path) {
         throw error;
     }
 }
+/**
+ * One write chain per store path. Every mutation is a read-modify-write of a
+ * single JSON file, and the plugin has several independent writers — a login,
+ * a logout, and one token refresh per provider adapter, each on its own
+ * schedule. Overlapping them unserialized costs whichever provider read the
+ * store first its entry.
+ *
+ * A chain is dropped once nothing is queued behind it, so the map holds an
+ * entry only while writes are in flight.
+ */
+const writeChains = new Map();
+/**
+ * Run one read-modify-write of a store path after every write already queued
+ * for it. Callers join the chain synchronously, so call order is write order.
+ * @param path - the store file being mutated.
+ * @param action - the read-modify-write to run.
+ * @returns whatever `action` returns.
+ */
+async function serialize(path, action) {
+    const previous = writeChains.get(path) ?? Promise.resolve();
+    // Both handlers: a failed write must not strand everything queued behind it.
+    const next = previous.then(action, action);
+    const tail = next.then(() => undefined, () => undefined);
+    writeChains.set(path, tail);
+    try {
+        return await next;
+    }
+    finally {
+        if (writeChains.get(path) === tail)
+            writeChains.delete(path);
+    }
+}
 /**
  * Read one provider's session.
  * @param provider - the provider route.
@@ -119,9 +151,11 @@ export async function getSession(provider, path = authFilePath()) {
  * @param path - store file path; defaults to {@link authFilePath}.
  */
 export async function saveSession(provider, session, path = authFilePath()) {
-    const store = await loadStore(path);
-    store[provider] = session;
-    await writeStore(store, path);
+    return serialize(path, async () => {
+        const store = await loadStore(path);
+        store[provider] = session;
+        await writeStore(store, path);
+    });
 }
 /**
  * Delete one provider's session (logout).
@@ -129,9 +163,11 @@ export async function saveSession(provider, session, path = authFilePath()) {
  * @param path - store file path; defaults to {@link authFilePath}.
  */
 export async function deleteSession(provider, path = authFilePath()) {
-    const store = await loadStore(path);
-    if (store[provider] === undefined)
-        return;
-    delete store[provider];
-    await writeStore(store, path);
+    return serialize(path, async () => {
+        const store = await loadStore(path);
+        if (store[provider] === undefined)
+            return;
+        delete store[provider];
+        await writeStore(store, path);
+    });
 }

package/lib/client/SubscriptionsSection.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectionHandle } from '@deepseek-ai/dsh-api-remotes/client';
 import type { SubscriptionsKey } from './locales.js';
 /** Subscription provider ids, fixed by the node half's OAuth adapters. */
-export type SubscriptionProvider = 'codex' | 'claude' | 'grok';
+export type SubscriptionProvider = 'codex' | 'claude' | 'grok' | 'copilot';
 /** One provider's login state as answered by the `status` endpoint. */
 export interface ProviderStatus {
     loggedIn: boolean;

package/lib/client/SubscriptionsSection.js

@@ -24,6 +24,7 @@ const PROVIDERS = [
     { id: 'codex', name: 'Codex (ChatGPT)' },
     { id: 'claude', name: 'Claude' },
     { id: 'grok', name: 'Grok (X Premium)' },
+    { id: 'copilot', name: 'GitHub Copilot' },
 ];
 /** Business error returned by the `/subscriptions-auth` channel (error branch message). */
 class SubscriptionsAuthError extends Error {
@@ -122,6 +123,15 @@ const styles = {
         padding: '0 10px', font: 'inherit', fontSize: 14, lineHeight: '22px',
         background: 'var(--dsw-alias-bg-layer-1)', color: 'var(--dsw-alias-label-primary)',
     },
+    deviceCode: {
+        marginTop: 4, display: 'flex', flexDirection: 'column', gap: 6,
+        border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8,
+        padding: '10px 12px', background: 'var(--dsw-alias-bg-layer-1)',
+    },
+    deviceCodeText: {
+        fontFamily: 'monospace', fontSize: 18, lineHeight: '24px', letterSpacing: 2,
+        color: 'var(--dsw-alias-label-primary)', userSelect: 'all',
+    },
 };
 /** Status dot color for one provider state. */
 function dotColor(status) {
@@ -189,8 +199,11 @@ export function SubscriptionsSection(props) {
     const [statuses, setStatuses] = useState({});
     const [errors, setErrors] = useState({});
     const [manualDrafts, setManualDrafts] = useState({
-        codex: '', claude: '', grok: '',
+        codex: '', claude: '', grok: '', copilot: '',
     });
+    /** Pending device-flow codes (copilot), shown while the attempt polls. */
+    const [deviceCodes, setDeviceCodes] = useState({});
+    const [copiedCode, setCopiedCode] = useState(undefined);
     const [usages, setUsages] = useState({});
     const [usageErrors, setUsageErrors] = useState({});
     const [usageLoading, setUsageLoading] = useState({});
@@ -235,8 +248,17 @@ export function SubscriptionsSection(props) {
         setStatuses(response.providers);
         for (const { id } of PROVIDERS) {
             const status = response.providers[id];
-            if (status.loggedIn || !status.busy)
+            if (status.loggedIn || !status.busy) {
                 stopPolling(id);
+                // The attempt settled (success, timeout, or cancel): drop the code card.
+                setDeviceCodes((prev) => {
+                    if (prev[id] === undefined)
+                        return prev;
+                    const next = { ...prev };
+                    delete next[id];
+                    return next;
+                });
+            }
         }
     }, [rpc, stopPolling]);
     const startPolling = useCallback((provider) => {
@@ -332,11 +354,18 @@ export function SubscriptionsSection(props) {
             if (typeof response.authorizeUrl !== 'string') {
                 throw new SubscriptionsAuthError(t('loginMissingUrl'));
             }
-            window.open(response.authorizeUrl, '_blank', 'noopener');
             if (!mountedRef.current)
                 return;
             // Optimistic busy so Cancel and the manual fallback appear before the first poll tick.
             setStatuses(prev => ({ ...prev, [provider]: { ...prev[provider], busy: true, loggedIn: false } }));
+            if (typeof response.userCode === 'string' && response.userCode.length > 0) {
+                // Device flow: show the code card instead of opening the page blind —
+                // the user copies the code first, then opens the verification page.
+                setDeviceCodes(prev => ({ ...prev, [provider]: { userCode: response.userCode, verificationUrl: response.authorizeUrl } }));
+            }
+            else {
+                window.open(response.authorizeUrl, '_blank', 'noopener');
+            }
             startPolling(provider);
         }
         catch (error) {
@@ -386,12 +415,25 @@ export function SubscriptionsSection(props) {
         }
         await refresh();
     }, [rpc, t, setProviderError, refresh]);
+    const copyDeviceCode = useCallback((provider, userCode) => {
+        void navigator.clipboard?.writeText(userCode).then(() => {
+            if (!mountedRef.current)
+                return;
+            setCopiedCode(provider);
+            setTimeout(() => {
+                if (mountedRef.current) {
+                    setCopiedCode(current => current === provider ? undefined : current);
+                }
+            }, 1500);
+        }).catch(() => undefined);
+    }, []);
     if (rpc === undefined) {
         return _jsx("p", { style: styles.intro, children: t('unavailable') });
     }
     return (_jsxs("div", { style: styles.section, children: [_jsx("p", { style: styles.intro, children: t('intro') }), PROVIDERS.map(({ id, name }) => {
                 const status = statuses[id];
                 const busy = status?.busy === true;
+                const deviceCode = deviceCodes[id];
                 const usage = usages[id];
                 const usageError = usageErrors[id];
                 // Providers without a usage endpoint answer supported:false — no block.
@@ -401,6 +443,6 @@ export function SubscriptionsSection(props) {
                                     const percent = Math.min(100, Math.max(0, window.usedPercent));
                                     return (_jsxs("div", { style: styles.usageRow, children: [_jsxs("div", { style: styles.usageMeta, children: [_jsx("span", { children: usageWindowLabel(t, window) }), _jsxs("span", { children: [`${String(Math.round(percent))}%`, window.resetsAt !== undefined
                                                                 && ` · ${t('usageResets', { date: new Date(window.resetsAt).toLocaleString() })}`] })] }), _jsx("div", { style: styles.usageTrack, children: _jsx("div", { style: { ...styles.usageFill, width: `${String(percent)}%`, background: usageBarColor(percent) } }) })] }, index));
-                                })] })), busy && (_jsxs("details", { style: styles.manual, children: [_jsx("summary", { children: t('manualSummary') }), _jsxs("div", { style: styles.manualRow, children: [_jsx("input", { style: styles.manualInput, value: manualDrafts[id], placeholder: t('manualPlaceholder'), onChange: event => setManualDrafts(prev => ({ ...prev, [id]: event.target.value })) }), _jsx("button", { type: "button", style: styles.button, onClick: () => { void submitManual(id); }, children: t('submit') })] })] }))] }, id));
+                                })] })), busy && deviceCode !== undefined && (_jsxs("div", { style: styles.deviceCode, children: [_jsx("span", { style: styles.statusLine, children: t('deviceCodePrompt') }), _jsx("span", { style: styles.deviceCodeText, children: deviceCode.userCode }), _jsxs("div", { style: styles.actions, children: [_jsx("button", { type: "button", style: styles.button, onClick: () => { copyDeviceCode(id, deviceCode.userCode); }, children: copiedCode === id ? t('deviceCodeCopied') : t('deviceCodeCopy') }), _jsx("button", { type: "button", style: styles.button, onClick: () => { window.open(deviceCode.verificationUrl, '_blank', 'noopener'); }, children: t('deviceCodeOpenPage') })] })] })), busy && deviceCode === undefined && (_jsxs("details", { style: styles.manual, children: [_jsx("summary", { children: t('manualSummary') }), _jsxs("div", { style: styles.manualRow, children: [_jsx("input", { style: styles.manualInput, value: manualDrafts[id], placeholder: t('manualPlaceholder'), onChange: event => setManualDrafts(prev => ({ ...prev, [id]: event.target.value })) }), _jsx("button", { type: "button", style: styles.button, onClick: () => { void submitManual(id); }, children: t('submit') })] })] }))] }, id));
             })] }));
 }