dsh-plugin-subscriptions 0.5.0 → 0.5.2

package/README.md

@@ -1,12 +1,12 @@
-# dsh-plugin-subscriptions
+# dsh-plugin-subscriptions [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 English | [中文](README.zh.md)
 
-Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials directly from an existing Claude Code session (macOS Keychain or `~/.claude/.credentials.json`). Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
+Use your **ChatGPT (Codex)**, **Claude**, and **Grok (X Premium)** subscriptions as LLM providers in [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — no API keys. Codex and Grok log in via OAuth in the dsh web UI (Settings → Subscriptions); Claude imports credentials from an existing Claude Code session when there is one (macOS Keychain or `~/.claude/.credentials.json`) and otherwise falls back to the same browser OAuth flow, so the Claude Code CLI is not required. Tokens live at `~/.dsh/plugins/subscriptions/auth.json` (mode 0600) and refresh automatically.
 
 ## Demo
 
-Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code; Codex and Grok use OAuth (account address masked in the screenshot):
+Settings → **Subscriptions**: per-provider login/logout, no API keys. Claude imports credentials from Claude Code when available and otherwise uses OAuth, as Codex and Grok always do (account address masked in the screenshot):
 
 ![Subscriptions settings page](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -14,7 +14,7 @@ Logged-in providers join the session model picker with their live model catalogs
 
 ![Model picker with subscription models](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-picker.png)
 
-Models that advertise reasoning levels get an **Effort** selector in the same menu — Codex models, and Grok 4.6 / 4.5 (levels and defaults come from each provider's live catalog, not a hardcoded list):
+Models that advertise reasoning levels get an **Effort** selector in the same menu — Codex models, Grok 4.6 / 4.5, and Copilot's reasoning models (levels and defaults come from each provider's live catalog, not a hardcoded list; Copilot's `capabilities.supports.reasoning_effort` array is sent as `reasoning_effort` on chat completions and `reasoning.effort` on the Responses wire). Models listing both Copilot endpoints (gpt-5.4, gpt-5-mini) normally speak chat completions but reroute to `/responses` when a request combines function tools with an effort — Copilot rejects that combination on the chat wire:
 
 ![Reasoning effort selector](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-effort.png)
 
@@ -41,10 +41,11 @@ The `video_generate` tool plays the generated clip inline:
 | `codex`  | ChatGPT Plus/Pro  | live catalog from `chatgpt.com/backend-api/codex/models` |
 | `claude` | Claude Pro/Max    | all models available in your subscription (Opus, Sonnet, Haiku, Fable — static catalog, updated with the plugin) |
 | `grok`   | X Premium (xAI)   | live catalog from `api.x.ai/v1/models` (chat models only); reasoning efforts from the Grok CLI catalog (`cli-chat-proxy.grok.com/v1/models`) |
+| `copilot` | GitHub Copilot   | live catalog from `api.githubcopilot.com/models` (chat models on both wires, with per-model vision flags and reasoning efforts); login uses the OAuth device flow (enter the shown code at `github.com/login/device`) |
 
 Only logged-in providers appear in the session model picker; the lists above refresh on login/logout. Vision-capable models declare `['text', 'image']` input modalities, and image content is translated to each provider's wire format.
 
-Logged-in cards also show **subscription usage** — per rate-limit window (5-hour session, weekly, and per-model weekly where the plan has one) with the used percentage, a progress bar, and the reset time, plus a Refresh button. Codex usage comes from `chatgpt.com/backend-api/wham/usage` (also reports the plan), Claude usage from `api.anthropic.com/api/oauth/usage`, and Grok usage from the Grok Build CLI proxy's `cli-chat-proxy.grok.com/v1/billing` (the source of the CLI's `/usage` panel; reports the shared weekly pool and the subscription tier).
+Logged-in cards also show **subscription usage** — per rate-limit window (5-hour session, weekly, and per-model weekly where the plan has one) with the used percentage, a progress bar, and the reset time, plus a Refresh button. Codex usage comes from `chatgpt.com/backend-api/wham/usage` (also reports the plan), Claude usage from `api.anthropic.com/api/oauth/usage`, and Grok usage from the Grok Build CLI proxy's `cli-chat-proxy.grok.com/v1/billing` (the source of the CLI's `/usage` panel; reports the shared weekly pool and the subscription tier). Copilot exposes no usage endpoint, so its card shows no usage section.
 
 Also included, registered when the matching provider is enabled:
 
@@ -105,7 +106,7 @@ Either way, restart `dsh web` afterwards so the new version loads.
 ## Use
 
 1. `dsh web`, open the printed URL.
-2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly from Claude Code (you must have run `claude` and logged in at least once). For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
+2. Settings → **Subscriptions**: click **Connect** on a provider. For Claude, credentials are imported instantly if you have run `claude` and logged in at least once; without them, Claude authorizes in the browser like the others. For Codex and Grok, authorize in the opened browser tab; if the browser flow can't complete (headless host), expand the manual fallback and paste the callback URL or code.
 3. In any session, open the model picker (`/model`) and choose a model under **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)**.
 
 Not logged in? The provider stays out of the picker, and requests fail with `MISSING_CREDENTIAL` pointing at the Settings page; nothing else breaks.
@@ -121,8 +122,22 @@ Not logged in? The provider stays out of the picker, and requests fail with `MIS
     models:                            # override the discovered/built-in catalogs
       codex:
         - { id: gpt-5.6-sol, name: GPT-5.6 Sol, contextWindow: 272000, inputModalities: [text, image] }
+      copilot:                         # manual entries disable Copilot catalog discovery
+        - { id: gpt-5.6-sol, wire: responses }   # copilot only: force the upstream protocol
 ```
 
+`wire` (copilot entries only) pins a model to `chat-completions` or `responses`. Manual
+entries keep working without it — the field exists because a configured model the live
+catalog does not know would otherwise default to `/chat/completions`, which
+responses-only families (gpt-5.5/5.6, …) reject. Pinning `chat-completions` also opts
+out of the tools+effort auto-reroute described above.
+
+## Proxy
+
+Every subscription request — token exchanges, model-API streams, usage lookups, model discovery, and the `x_search` / `image_generate` / `video_generate` tools — can be routed through an HTTP(S) proxy. Configure it in **Settings → Subscriptions → Proxy → Configure…**: enable the flag, enter the proxy URL (`http://127.0.0.1:7890`), optional username/password, and an optional comma-separated bypass list of hostnames that stay direct (`127.0.0.1`, `localhost`, `*.example.com`). The password is stored in `~/.dsh/plugins/subscriptions/proxy.json` (mode 0600) and is never returned to the browser. A "Test" button probes one endpoint through the current configuration and shows the HTTP status/latency.
+
+Changes apply immediately to subsequent requests — no restart needed. The OAuth authorization page opens in your browser and follows the browser/system proxy, not this setting. SOCKS proxies are not supported.
+
 ## Develop
 
 ```sh

package/README.zh.md

@@ -1,12 +1,12 @@
-# dsh-plugin-subscriptions
+# dsh-plugin-subscriptions [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 [English](README.md) | 中文
 
-把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 直接从已有的 Claude Code 会话导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`)。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
+把你的 **ChatGPT(Codex)**、**Claude**、**Grok(X Premium)** 订阅当作 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 LLM provider 使用 —— 不需要 API key。Codex 和 Grok 通过 dsh web 界面 OAuth 登录(设置 → 订阅);Claude 在存在 Claude Code 会话时直接导入凭据(macOS Keychain 或 `~/.claude/.credentials.json`),否则回退到同样的浏览器 OAuth 流程,因此不要求安装 Claude Code CLI。Token 保存在 `~/.dsh/plugins/subscriptions/auth.json`(权限 0600),过期自动刷新。
 
 ## 演示
 
-设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 从 Claude Code 导入凭据;Codex 和 Grok 使用 OAuth(截图中账号已打码):
+设置 → **订阅**:每个 provider 的登录/退出,无需 API key。Claude 有 Claude Code 会话时导入凭据,否则和 Codex、Grok 一样走 OAuth(截图中账号已打码):
 
 ![订阅设置页](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/subscriptions.png)
 
@@ -14,7 +14,7 @@
 
 ![模型选择器中的订阅模型](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-picker.png)
 
-声明了推理等级的模型会在同一菜单里多出**推理等级**选择 —— Codex 系列模型,以及 Grok 4.6 / 4.5(档位和默认值来自各 provider 的实时目录,不是硬编码列表):
+声明了推理等级的模型会在同一菜单里多出**推理等级**选择 —— Codex 系列模型、Grok 4.6 / 4.5,以及 Copilot 的推理模型(档位和默认值来自各 provider 的实时目录,不是硬编码列表;Copilot 的 `capabilities.supports.reasoning_effort` 数组会按协议映射为 chat completions 的 `reasoning_effort` 或 Responses 的 `reasoning.effort`)。同时声明两个 Copilot 端点的模型(gpt-5.4、gpt-5-mini)默认走 chat completions,但请求同时携带函数工具和推理等级时会自动改走 `/responses` —— Copilot 在 chat 线路上拒绝这种组合:
 
 ![推理等级选择器](https://raw.githubusercontent.com/V1ki/dsh-plugin-subscriptions/main/docs/images/model-effort.png)
 
@@ -41,10 +41,11 @@
 | `codex`  | ChatGPT Plus/Pro | 从 `chatgpt.com/backend-api/codex/models` 实时获取 |
 | `claude` | Claude Pro/Max   | 订阅内所有可用模型(Opus、Sonnet、Haiku、Fable —— 静态目录,随插件更新) |
 | `grok`   | X Premium (xAI)  | 从 `api.x.ai/v1/models` 实时获取(仅对话模型);推理等级来自 Grok CLI 目录(`cli-chat-proxy.grok.com/v1/models`) |
+| `copilot` | GitHub Copilot  | 从 `api.githubcopilot.com/models` 实时获取(两种 wire 的对话模型,含按模型的视觉标记与推理等级);登录使用 OAuth 设备码流程(在 `github.com/login/device` 输入页面显示的验证码) |
 
 只有已登录的 provider 才会出现在会话模型选择器里;登录/退出后列表自动刷新。支持视觉的模型会声明 `['text', 'image']` 输入模态,图片内容会被翻译成各 provider 的 wire 格式。
 
-已登录的卡片还会显示**订阅用量**——按限额窗口(5 小时会话窗、每周窗,以及计划包含的按模型每周窗)展示已用百分比、进度条和重置时间,并带刷新按钮。Codex 用量来自 `chatgpt.com/backend-api/wham/usage`(同时报告计划类型),Claude 用量来自 `api.anthropic.com/api/oauth/usage`,Grok 用量来自 Grok Build CLI 代理的 `cli-chat-proxy.grok.com/v1/billing`(即 CLI `/usage` 面板的数据源,报告共享每周额度和订阅档位)。
+已登录的卡片还会显示**订阅用量**——按限额窗口(5 小时会话窗、每周窗,以及计划包含的按模型每周窗)展示已用百分比、进度条和重置时间,并带刷新按钮。Codex 用量来自 `chatgpt.com/backend-api/wham/usage`(同时报告计划类型),Claude 用量来自 `api.anthropic.com/api/oauth/usage`,Grok 用量来自 Grok Build CLI 代理的 `cli-chat-proxy.grok.com/v1/billing`(即 CLI `/usage` 面板的数据源,报告共享每周额度和订阅档位)。Copilot 没有用量接口,其卡片不显示用量区块。
 
 随 provider 启用自动注册的工具:
 
@@ -105,7 +106,7 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 ## 使用
 
 1. `dsh web`,打开打印的 URL。
-2. **设置 → 订阅**:点对应 provider 的「连接」。Claude 会即时从 Claude Code 导入凭据(需先运行过 `claude` 并登录)。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
+2. **设置 → 订阅**:点对应 provider 的「连接」。若先运行过 `claude` 并登录,Claude 会即时导入凭据;没有凭据时,Claude 也和其他 provider 一样在浏览器里授权。Codex 和 Grok 在打开的标签页里授权;无浏览器环境下可展开手动兜底,粘贴回调 URL 或授权码。
 3. 在任意会话里打开模型选择器(`/model`),选择 **ChatGPT (Codex)** / **Claude (Subscription)** / **Grok (Subscription)** 下的模型。
 
 未登录时:该 provider 不出现在选择器里;直接请求会报 `MISSING_CREDENTIAL` 并提示去设置页登录,不影响其他功能。
@@ -121,8 +122,21 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
     models:                            # 覆盖实时发现/内置目录
       codex:
         - { id: gpt-5.6-sol, name: GPT-5.6 Sol, contextWindow: 272000, inputModalities: [text, image] }
+      copilot:                         # 手工条目会关闭 Copilot 目录发现
+        - { id: gpt-5.6-sol, wire: responses }   # 仅 copilot:强制指定上游协议
 ```
 
+`wire`（仅 copilot 条目）把模型固定到 `chat-completions` 或 `responses`。不加该字段手工条目照常
+工作——它存在的原因是:实时目录不认识的手工模型否则会默认走 `/chat/completions`，而
+responses-only 系列（gpt-5.5/5.6 等）会拒绝该端点。固定为 `chat-completions` 也会退出上文所述
+tools+effort 的自动改道。
+
+## 代理
+
+所有订阅相关请求 —— token 交换、模型 API 流式调用、用量查询、模型目录发现,以及 `x_search` / `image_generate` / `video_generate` 工具 —— 都可以通过 HTTP(S) 代理发出。在 **设置 → 订阅 → 代理 → 配置…** 中设置:勾选启用,填写代理地址(`http://127.0.0.1:7890`)、可选用户名/密码,以及可选的逗号分隔绕过列表(保持直连的主机名,如 `127.0.0.1`、`localhost`、`*.example.com`)。密码保存在 `~/.dsh/plugins/subscriptions/proxy.json`(权限 0600),不会回传给浏览器;「测试」按钮会用当前配置探测一次端点,显示 HTTP 状态码与耗时。
+
+保存后立即对后续请求生效,无需重启。OAuth 授权页在浏览器中打开,走浏览器/系统自身的代理设置,不受此配置影响;不支持 socks 代理。
+
 ## 开发
 
 ```sh

package/lib/auth/device-flow.d.ts

@@ -0,0 +1,55 @@
+/** Static per-provider device-flow facts. */
+export interface DeviceFlowSpec {
+    /** OAuth App / GitHub App client id the device code is requested for. */
+    clientId: string;
+    /** Scope string requested at device-code time. */
+    scope: string;
+    /** Device-code endpoint (e.g. `https://github.com/login/device/code`). */
+    deviceCodeUrl: string;
+    /** Token polling endpoint (e.g. `https://github.com/login/oauth/access_token`). */
+    tokenUrl: string;
+    /** Fetch implementation (injectable for tests). */
+    fetchFn?: typeof fetch;
+}
+/** One in-flight device-flow login attempt. */
+export interface DeviceAttempt {
+    /** URL the user opens to authorize (e.g. `https://github.com/login/device`). */
+    readonly verificationUrl: string;
+    /** Short code the user types at the verification URL. */
+    readonly userCode: string;
+    /**
+     * Poll until GitHub releases the access token.
+     * @returns the GitHub OAuth access token; rejects on timeout, denial, or cancel.
+     */
+    waitToken(): Promise<string>;
+    /** Abort the attempt; `waitToken` rejects with a cancellation error. */
+    cancel(): void;
+}
+/**
+ * Own the set of in-flight device-flow attempts, keyed by provider. One
+ * attempt per provider at a time; an attempt removes itself when it settles.
+ */
+export declare class DeviceFlowManager {
+    private attempts;
+    /**
+     * Whether a device-flow attempt is running for one provider.
+     * @param provider - the provider route.
+     * @returns true while an attempt is polling.
+     */
+    isBusy(provider: string): boolean;
+    /**
+     * The pending attempt for one provider, when any.
+     * @param provider - the provider route.
+     * @returns the in-flight attempt, or `undefined`.
+     */
+    pending(provider: string): DeviceAttempt | undefined;
+    /**
+     * Start a device-flow attempt: request a device code, then poll the token
+     * endpoint in the background of `waitToken`.
+     * @param provider - the provider route (one attempt at a time).
+     * @param spec - static flow facts for this provider.
+     * @returns the live attempt; its `waitToken()` settles the login.
+     * @throws when an attempt is already running or the device-code request fails.
+     */
+    start(provider: string, spec: DeviceFlowSpec): Promise<DeviceAttempt>;
+}

package/lib/auth/device-flow.js

@@ -0,0 +1,177 @@
+/**
+ * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
+ * use the loopback redirect engine: no redirect URI, no PKCE, no client
+ * secret. The user opens a verification URL and types a short code while the
+ * plugin polls the token endpoint until GitHub releases the access token.
+ * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
+ * mirrors {@link OAuthFlowManager} so the auth controller can treat both
+ * engines uniformly.
+ */
+import { proxiedFetch } from '../http.js';
+/** Default poll interval when the device-code response omits one. */
+const DEFAULT_INTERVAL_SEC = 5;
+/** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
+const DEFAULT_EXPIRES_IN_SEC = 900;
+/** Sleep for `ms`, rejecting early when the signal aborts. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        timer.unref();
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Own the set of in-flight device-flow attempts, keyed by provider. One
+ * attempt per provider at a time; an attempt removes itself when it settles.
+ */
+export class DeviceFlowManager {
+    attempts = new Map();
+    /**
+     * Whether a device-flow attempt is running for one provider.
+     * @param provider - the provider route.
+     * @returns true while an attempt is polling.
+     */
+    isBusy(provider) {
+        return this.attempts.has(provider);
+    }
+    /**
+     * The pending attempt for one provider, when any.
+     * @param provider - the provider route.
+     * @returns the in-flight attempt, or `undefined`.
+     */
+    pending(provider) {
+        return this.attempts.get(provider);
+    }
+    /**
+     * Start a device-flow attempt: request a device code, then poll the token
+     * endpoint in the background of `waitToken`.
+     * @param provider - the provider route (one attempt at a time).
+     * @param spec - static flow facts for this provider.
+     * @returns the live attempt; its `waitToken()` settles the login.
+     * @throws when an attempt is already running or the device-code request fails.
+     */
+    async start(provider, spec) {
+        if (this.attempts.has(provider)) {
+            throw new Error(`a ${provider} login attempt is already in progress`);
+        }
+        const fetchFn = spec.fetchFn ?? proxiedFetch;
+        const response = await fetchFn(spec.deviceCodeUrl, {
+            method: 'POST',
+            headers: {
+                'accept': 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({ client_id: spec.clientId, scope: spec.scope }).toString(),
+        });
+        if (!response.ok) {
+            throw new Error(`${provider} device-code request failed (HTTP ${String(response.status)})`);
+        }
+        const wire = await response.json();
+        if (typeof wire.device_code !== 'string' || wire.device_code.length === 0
+            || typeof wire.user_code !== 'string' || wire.user_code.length === 0
+            || typeof wire.verification_uri !== 'string' || wire.verification_uri.length === 0) {
+            throw new Error(`${provider} device-code response is missing device_code/user_code/verification_uri`);
+        }
+        const intervalSec = typeof wire.interval === 'number' && wire.interval > 0
+            ? wire.interval
+            : DEFAULT_INTERVAL_SEC;
+        const expiresInSec = typeof wire.expires_in === 'number' && wire.expires_in > 0
+            ? wire.expires_in
+            : DEFAULT_EXPIRES_IN_SEC;
+        const controller = new AbortController();
+        let resolveToken;
+        let rejectToken;
+        const tokenPromise = new Promise((resolve, reject) => {
+            resolveToken = resolve;
+            rejectToken = reject;
+        });
+        // The promise settles exactly once, from the poll loop below; an unhandled
+        // rejection must not surface if nobody awaited waitToken after a cancel.
+        tokenPromise.catch(() => undefined);
+        const settle = (error, token) => {
+            // Identity check: a late settle from a stale attempt (its poll loop or a
+            // cancel arriving after it already settled) must not kill a NEW attempt
+            // the user started for the same provider.
+            if (this.attempts.get(provider) !== attempt)
+                return;
+            this.attempts.delete(provider);
+            if (error !== undefined)
+                rejectToken(error);
+            else if (token !== undefined)
+                resolveToken(token);
+        };
+        const poll = async () => {
+            let intervalMs = intervalSec * 1000;
+            const deadline = Date.now() + expiresInSec * 1000;
+            while (true) {
+                await sleep(intervalMs, controller.signal);
+                if (Date.now() >= deadline) {
+                    settle(new Error(`login timed out after ${String(Math.round(expiresInSec))}s`));
+                    return;
+                }
+                const pollResponse = await fetchFn(spec.tokenUrl, {
+                    method: 'POST',
+                    headers: {
+                        'accept': 'application/json',
+                        'content-type': 'application/x-www-form-urlencoded',
+                    },
+                    body: new URLSearchParams({
+                        client_id: spec.clientId,
+                        device_code: wire.device_code,
+                        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    }).toString(),
+                    signal: controller.signal,
+                });
+                const result = await pollResponse.json();
+                if (typeof result.access_token === 'string' && result.access_token.length > 0) {
+                    settle(undefined, result.access_token);
+                    return;
+                }
+                switch (result.error) {
+                    case 'authorization_pending':
+                        break;
+                    case 'slow_down':
+                        // RFC 8628 §3.5: add five seconds to the poll interval.
+                        intervalMs += 5000;
+                        break;
+                    case 'access_denied':
+                        settle(new Error('login declined on the GitHub authorization page'));
+                        return;
+                    case 'expired_token':
+                        settle(new Error('the device code expired before authorization completed'));
+                        return;
+                    default:
+                        settle(new Error(`${provider} device-flow polling failed: ${result.error_description ?? result.error ?? `HTTP ${String(pollResponse.status)}`}`));
+                        return;
+                }
+            }
+        };
+        const attempt = {
+            verificationUrl: wire.verification_uri,
+            userCode: wire.user_code,
+            waitToken: () => tokenPromise,
+            cancel: () => {
+                controller.abort(new Error('login cancelled'));
+                settle(new Error('login cancelled'));
+            },
+        };
+        this.attempts.set(provider, attempt);
+        void poll().catch((error) => {
+            // Aborts land here from sleep/fetch; everything else is a transport or
+            // parse failure worth surfacing as the login failure.
+            settle(error instanceof Error ? error : new Error(String(error)));
+        });
+        return attempt;
+    }
+}

package/lib/auth/oauth-flow.js

@@ -117,7 +117,7 @@ export class OAuthFlowManager {
         }
         const input = {
             redirectUri: '',
-            state: randomToken(16),
+            state: randomToken(32),
             pkce: createPkce(),
             nonce: randomHex(8),
         };

package/lib/auth/rpc.d.ts

@@ -8,6 +8,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment';
 import { type ProviderId } from './store.js';
 import type { ProviderUsage } from '../providers/common.js';
+import type { ProxyConfigView, ProxyDraft, ProxyInput, ProxyTestResult } from '../http.js';
 /** The RPC channel this plugin registers on the host connection. */
 export declare const SUBSCRIPTIONS_AUTH_CHANNEL = "/subscriptions-auth";
 /** Decoded image bytes returned by the `image` endpoint. */
@@ -49,17 +50,31 @@ export interface ProviderStatus {
     /** Subscription detail (plan) or the last login error. */
     detail?: string;
 }
+/** Proxy config operations behind the `proxyGet/proxySet/proxyTest` endpoints. */
+export interface ProxyConfigController {
+    /** Current proxy configuration (secrets omitted). */
+    get(): Promise<ProxyConfigView>;
+    /** Validate, persist, and apply one config. */
+    set(input: ProxyInput): Promise<ProxyConfigView>;
+    /** Probe one destination through the draft (unsaved) or stored proxy. */
+    test(payload: {
+        url?: string;
+        proxy?: ProxyDraft;
+    }): Promise<ProxyTestResult>;
+}
 /** Provider-agnostic auth operations the RPC handler delegates to. */
 export interface AuthController {
     /** Current status of one provider. */
     status(provider: ProviderId): Promise<ProviderStatus>;
     /**
      * Start a background login attempt.
-     * @returns the authorize URL for the user's browser.
+     * @returns the authorize URL for the user's browser; device-flow providers
+     *   (copilot) also return the `userCode` the user types at that URL.
      * @throws when an attempt is already running for this provider.
      */
     login(provider: ProviderId): Promise<{
         authorizeUrl: string;
+        userCode?: string;
     }>;
     /**
      * Feed a pasted callback URL or bare code into the pending attempt.
@@ -100,5 +115,6 @@ export interface AuthController {
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
+ * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
  */
-export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController): void;
+export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController, proxy?: ProxyConfigController | undefined): void;

package/lib/auth/rpc.js

@@ -102,7 +102,89 @@ function readSessionId(payload) {
         throw new BadRequest('payload must be an object');
     return readString(payload, 'sessionId');
 }
-async function dispatch(controller, speed, endpoint, payload, signal) {
+/** Validate a `proxySet` payload into a shape `ProxyInput` accepts. */
+function readProxyInput(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        throw new BadRequest('payload must be an object');
+    const record = payload;
+    if (typeof record.enabled !== 'boolean')
+        throw new BadRequest('payload.enabled must be a boolean');
+    if (typeof record.url !== 'string')
+        throw new BadRequest('payload.url must be a string');
+    let username;
+    if (record.username !== undefined) {
+        if (typeof record.username !== 'string')
+            throw new BadRequest('payload.username must be a string when present');
+        username = record.username;
+    }
+    let password;
+    if (record.password !== undefined) {
+        if (record.password !== null && typeof record.password !== 'string') {
+            throw new BadRequest('payload.password must be a string or null when present');
+        }
+        password = record.password;
+    }
+    let bypass;
+    if (record.bypass !== undefined) {
+        if (!Array.isArray(record.bypass) || record.bypass.some(entry => typeof entry !== 'string')) {
+            throw new BadRequest('payload.bypass must be an array of strings when present');
+        }
+        bypass = record.bypass;
+    }
+    return {
+        enabled: record.enabled,
+        url: record.url,
+        ...username === undefined ? {} : { username },
+        ...password === undefined ? {} : { password },
+        ...bypass === undefined ? {} : { bypass },
+    };
+}
+/** Validate a `proxyTest` payload (the destination URL and an optional draft). */
+function readProxyTestPayload(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return {};
+    const record = payload;
+    const url = record.url;
+    if (url === undefined && record.proxy === undefined)
+        return {};
+    if (url !== undefined && (typeof url !== 'string' || url.length === 0)) {
+        throw new BadRequest('payload.url must be a non-empty string when present');
+    }
+    let proxy;
+    if (record.proxy !== undefined) {
+        if (typeof record.proxy !== 'object' || record.proxy === null) {
+            throw new BadRequest('payload.proxy must be an object when present');
+        }
+        const draftRecord = record.proxy;
+        if (typeof draftRecord.url !== 'string' || draftRecord.url.length === 0) {
+            throw new BadRequest('payload.proxy.url must be a non-empty string');
+        }
+        let username;
+        if (draftRecord.username !== undefined) {
+            if (typeof draftRecord.username !== 'string') {
+                throw new BadRequest('payload.proxy.username must be a string when present');
+            }
+            username = draftRecord.username;
+        }
+        let password;
+        if (draftRecord.password !== undefined) {
+            if (typeof draftRecord.password !== 'string') {
+                throw new BadRequest('payload.proxy.password must be a string when present');
+            }
+            password = draftRecord.password;
+        }
+        proxy = {
+            url: draftRecord.url,
+            ...username === undefined ? {} : { username },
+            ...password === undefined ? {} : { password },
+        };
+    }
+    return {
+        ...url === undefined ? {} : { url },
+        ...proxy === undefined ? {} : { proxy },
+    };
+}
+async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
     switch (endpoint) {
         case 'status': {
             const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
@@ -132,6 +214,18 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
         case 'setSpeed':
             await speed.setSpeed(readSessionId(payload), readSpeedTier(payload));
             return ok({ ok: true });
+        case 'proxyGet':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.get());
+        case 'proxySet':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.set(readProxyInput(payload)));
+        case 'proxyTest':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.test(readProxyTestPayload(payload)));
         default:
             throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
     }
@@ -141,8 +235,9 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
+ * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
  */
-export function registerAuthRpc(ctx, controller, speed) {
+export function registerAuthRpc(ctx, controller, speed, proxy = undefined) {
     // `connection` is not in this plugin's inject list (headless compositions
     // lack it), so its startup order is unconstrained: defer registration until
     // the service exists instead of probing once at apply time.
@@ -150,7 +245,7 @@ export function registerAuthRpc(ctx, controller, speed) {
         const connection = ctx.get('connection');
         ctx.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
             try {
-                return await dispatch(controller, speed, endpoint, payload, signal);
+                return await dispatch(controller, speed, proxy, endpoint, payload, signal);
             }
             catch (error) {
                 return failure(error);

package/lib/auth/store.d.ts

@@ -7,7 +7,7 @@
  * owns the durable format.
  */
 /** Provider routes this plugin can serve. */
-export type ProviderId = 'codex' | 'claude' | 'grok';
+export type ProviderId = 'codex' | 'claude' | 'grok' | 'copilot';
 /** Every provider route, in display order. */
 export declare const PROVIDER_IDS: readonly ProviderId[];
 /** Stored ChatGPT/Codex subscription session. */
@@ -47,14 +47,32 @@ export interface GrokSession {
     /** Display account: email, username, or subject claim from the id token. */
     account?: string;
 }
+/**
+ * Stored GitHub Copilot subscription session. Two token generations are at
+ * play: the long-lived GitHub OAuth token from the device flow is kept in
+ * `refreshToken`, and `accessToken` carries the short-lived (~30 minutes)
+ * Copilot API token exchanged from it. A "refresh" is therefore a fresh
+ * exchange against `copilot_internal/v2/token`, not an OAuth grant.
+ */
+export interface CopilotSession {
+    /** Copilot API token; sent as the bearer on api.githubcopilot.com. */
+    accessToken: string;
+    /** Long-lived GitHub OAuth token from the device flow. */
+    refreshToken: string;
+    /** Epoch milliseconds at which the Copilot API token expires. */
+    expiresAt: number;
+    /** GitHub login name, for the status display. */
+    account?: string;
+}
 /** The durable store shape: one optional session per provider. */
 export interface SessionMap {
     codex?: CodexSession;
     claude?: ClaudeSession;
     grok?: GrokSession;
+    copilot?: CopilotSession;
 }
 /** Any stored session, for provider-agnostic plumbing. */
-export type StoredSession = CodexSession | ClaudeSession | GrokSession;
+export type StoredSession = CodexSession | ClaudeSession | GrokSession | CopilotSession;
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.