@goodandready/dsh-subscriptions 0.4.14 → 0.4.16

package/README.zh.md

@@ -0,0 +1,109 @@
+# 📦 @goodandready/dsh-subscriptions
+
+<div align="center">
+
+<h3>DeepSeek Harness 个人 AI 订阅桥接、多账号池轮换与零泄漏 OAuth 插件</h3>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@goodandready/dsh-subscriptions"><img src="https://img.shields.io/npm/v/@goodandready/dsh-subscriptions.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-10b981.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
+  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
+</p>
+
+<p align="center">
+  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/作者全部项目-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="作者全部项目"></a>
+</p>
+
+<p align="center">
+  <a href="README.md"><b>🇬🇧 English</b></a> •
+  <a href="README.ru.md"><b>🇷🇺 Русский</b></a> •
+  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a>
+</p>
+
+</div>
+
+---
+
+## ⚡ 插件概览
+
+**`dsh-subscriptions`** 将您现有的付费个人 AI 订阅无缝接入 **DeepSeek Harness**，作为第一类模型服务商。
+
+无需为日常智能体任务支付昂贵的 API 按量计费。本插件支持标准 OAuth PKCE 鉴权、**单服务商多账号池动态轮换**（遭遇 429 限流时自动秒切可用账号）、**前置配额平滑切换**，并通过**进程内 Cordis 服务 (`ctx.subscriptions`)** 赋能 [`dsh-image-gen`](https://github.com/GooDAnDReaDY/dsh-image-gen) 与 [`dsh-grok-xsearch`](https://github.com/GooDAnDReaDY/dsh-grok-xsearch) 等插件，实现 Token 零网络泄漏。
+
+```mermaid
+graph LR
+    subgraph DSHCore [DeepSeek Harness 对话流]
+        Agent[🤖 智能体任务执行] --> Router{服务商路由器}
+    end
+
+    subgraph SubscriptionsCore [dsh-subscriptions 调度核心]
+        Router --> Pool{多账号负载池}
+        Pool -->|账号 1| Acc1[👤 主账号: 活跃中]
+        Pool -->|账号 2| Acc2[👤 副账号: 待命中]
+        Pool -->|账号 3| Acc3[👤 备用账号: 冷却中]
+        Acc1 -->|HTTP 429 / 配额耗尽| Rotate[智能配额与冷却轮换器]
+        Rotate -->|流量平滑切换| Acc2
+    end
+
+    subgraph VendorBridges [4 大服务商桥接适配]
+        Acc1 --> B1[ChatGPT / Codex 后端]
+        Acc1 --> B2[Claude Pro / Max 协议]
+        Acc1 --> B3[xAI / Grok 订阅]
+        Acc1 --> B4[Google Cloud Code Assist / Antigravity]
+    end
+
+    subgraph EcosystemBridge [Cordis 进程内共享: ctx.subscriptions]
+        Pool --> ImgGen[dsh-image-gen: 订阅零成本生图]
+        Pool --> XSearch[dsh-grok-xsearch: X 社交搜索]
+    end
+
+    style DSHCore fill:#1e1e2e,stroke:#89b4fa,stroke-width:2px,color:#cdd6f4
+    style SubscriptionsCore fill:#181825,stroke:#cba6f7,stroke-width:2px,color:#cdd6f4
+    style VendorBridges fill:#11111b,stroke:#a6e3a1,stroke-width:2px,color:#cdd6f4
+    style EcosystemBridge fill:#181825,stroke:#f38ba8,stroke-width:2px,color:#cdd6f4
+```
+
+---
+
+## ✨ 核心功能
+
+### 支持的内置订阅供应商
+| 供应商 | 订阅级别 | 协议 |
+|---|---|---|
+| `codex` | ChatGPT Plus / Pro | 流式响应、工具调用、图像生成 |
+| `claude` | Claude Pro / Max | 原生 Messages 协议、用量跟踪 |
+| `grok` | xAI / X Premium | 实时推理、计费检查 |
+| `antigravity` | Google Cloud Code Assist | 流式生成 |
+
+### 多账号轮换与限流保护
+* 每个供应商可挂多个账号（如 `CODEX_OAUTH_1`、`CODEX_OAUTH_2`）。
+* 遇到 429/配额耗尽自动切换到下一个健康账号；支持按剩余量提前切换和动态冷却恢复。
+
+### 安全与无头登录
+* OAuth 令牌绝不通过 HTTP API 返回，也不在 Web 界面渲染；仅存放于宿主加密凭据存储。
+* **回环自动回调 (`autoLoopback`，`v0.4.9`)**：供应商重定向为回环地址（如 Codex `:1455`）时，插件自动启动临时本地服务器接收回调，无需手动粘贴链接。
+* **设备码登录（Codex，`v0.4.9`）**：完全无浏览器的主机上，点击 **Device login**，在任意设备打开 `https://auth.openai.com/codex/device` 输入短码即可完成 PKCE 授权。
+
+### 账号级代理（`v0.4.9`）
+* 每个账号可配置独立代理（`http://`、`https://`、`socks5://`）；令牌刷新、供应商检查、模型请求均走该代理。
+* 账号卡片内的 **Check proxy** 按钮一键检测代理延迟。
+
+### 隐私模式与诊断报告（`v0.4.9`）
+* **`privacyMask`**：一个开关即可在整个界面隐藏个人数据（邮箱显示为 `j***n@example.com`），服务端遮蔽，适合屏幕共享。
+* **匿名诊断报告**：设置卡片内一键生成（插件/运行时版本、系统、各供应商健康状态、HTTP 状态聚合、最近错误与耗时、非敏感配置）并自动复制到剪贴板；令牌、邮箱、凭据名与代理地址严格排除。
+* 同区块提供问题追踪器链接，便于提交 issue。
+
+---
+
+## 📦 安装指南
+
+```bash
+dsh plugin --profile web add @goodandready/dsh-subscriptions
+```
+
+---
+
+## 📄 开源协议
+
+MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)

package/lib/accounts.js

@@ -48,7 +48,7 @@ export function vendorConfig(provider, cfg) {
   }
 }
 
-export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitNotice }) {
+export function createAccountStore({ credentials, getConfig, fetchImpl, fetchForRef, onLimitNotice }) {
   const cooldowns = new Map()
   const quotas = new Map()
   const refreshLocks = new Map()
@@ -60,6 +60,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
   const windows = new Map()
   const usageFetched = new Map()
   const doFetch = fetchImpl || fetch
+  // #88: per-account proxy fetch for token refresh / usage (falls back to doFetch).
+  const fetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
 
   async function resolveRaw(ref) {
     try {
@@ -168,7 +170,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
     const promise = (async () => {
       try {
         const cfg = vendorConfig(provider, getConfig())
-        const next = await getVendor(provider).refresh(cfg, blob, doFetch)
+        const next = await getVendor(provider).refresh(cfg, blob, fetchFor(ref))
         const merged = {
           ...blob,
           ...next,
@@ -201,7 +203,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
       if (!raw) continue
       try {
         const blob = await ensureFresh(provider, parseBlob(raw), slot.ref)
-        const snap = await vendor.usage(blob, cfg, doFetch)
+        const snap = await vendor.usage(blob, cfg, fetchFor(slot.ref))
         usageFetched.set(slot.ref, Date.now())
         if (!snap) continue
         if (Number.isFinite(Number(snap.usedPercent))) {

package/lib/adapter.js

@@ -3,6 +3,7 @@ import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
 import { modelCatalog } from './messages.js'
 import { streamWithRotation } from './stream-rotate.js'
+import { pickFetch } from './proxy.js'
 
 function asLlmError(err) {
   if (err instanceof LlmError) return err
@@ -86,7 +87,7 @@ export class SubscriptionAdapter extends LlmAdapter {
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const vendor = getVendor(provider)
           // ponytail: capture x-ratelimit headers without touching vendors
-          const baseFetch = deps.fetchImpl || fetch
+          const baseFetch = pickFetch(deps, account.ref)
           const quotaFetch = async (url, init) => {
             const res = await baseFetch(url, init)
             try {
@@ -131,6 +132,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                   path: '/responses',
                   method: 'POST',
                   status: 200,
+                  ms: Date.now() - t0,
                   kind: 'stream',
                 })
               } catch {}

package/lib/client.js

@@ -88,12 +88,24 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       'intro': 'Log in with a consumer subscription. Tokens stay on the host credentials store. The browser never reads them back. After Connect, if the provider lands on localhost or a vendor page, paste the redirected URL or the code here.',
       'useOrigin': 'Use this Web UI origin as OAuth redirect_uri',
       'useOriginHint': 'Leave off unless you registered your own OAuth client for this origin. Vendor CLI clients usually require their published redirect URI plus the paste step.',
+      'privacyMask': 'Mask emails and account identifiers',
+      'privacyMaskHint': 'For demos and screen sharing: emails show as j***n@example.com.',
       'reconnect': 'Reconnect',
       'connect': 'Connect',
       'disconnect': 'Disconnect',
       'removeSlot': 'Remove slot',
       'pastePlaceholder': 'Paste redirected URL or code',
       'submitCode': 'Submit code',
+      'proxyPlaceholder': 'Per-account proxy (http://, https://, socks5://) - optional',
+      'proxyCheck': 'Check proxy',
+      'proxyOk': 'proxy ok',
+      'proxyFail': 'proxy fail',
+      'deviceLogin': 'Device login',
+      'deviceHint': 'Headless: open the link, enter the code, keep this tab open.',
+      'deviceCopy': 'Copy code',
+      'devicePending': 'Waiting for confirmation',
+      'deviceAuthorized': 'Signed in',
+      'deviceExpired': 'Expired - start again',
       'verifyPrefix': 'Google requires one-time account verification. ',
       'verifyLink': 'Open verification link',
       'verifySuffix': ' then reconnect.',
@@ -143,12 +155,24 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       'intro': 'Вход по обычной пользовательской подписке. Токены остаются в хранилище учётных данных харнесса, браузер их обратно не читает. Если после «Подключить» провайдер увёл на localhost или на свою страницу, вставьте сюда адрес перехода или код.',
       'useOrigin': 'Использовать адрес этого веб-интерфейса как redirect_uri',
       'useOriginHint': 'Включайте, только если зарегистрировали собственного клиента OAuth на этот адрес. Штатным консольным клиентам провайдеров нужен их опубликованный адрес возврата и вставка кода вручную.',
+      'privacyMask': 'Маскировать email и учётные записи',
+      'privacyMaskHint': 'Для демонстрации экрана: email отображается как j***n@example.com.',
       'reconnect': 'Переподключить',
       'connect': 'Подключить',
       'disconnect': 'Отключить',
       'removeSlot': 'Убрать место',
       'pastePlaceholder': 'Адрес перехода или код',
       'submitCode': 'Отправить код',
+      'proxyPlaceholder': 'Прокси аккаунта (http://, https://, socks5://) - необязательно',
+      'proxyCheck': 'Проверить прокси',
+      'proxyOk': 'прокси ок',
+      'proxyFail': 'прокси недоступен',
+      'deviceLogin': 'Вход по коду',
+      'deviceHint': 'Headless: откройте ссылку, введите код, держите вкладку открытой.',
+      'deviceCopy': 'Скопировать код',
+      'devicePending': 'Ожидание подтверждения',
+      'deviceAuthorized': 'Вход выполнен',
+      'deviceExpired': 'Истёк - начните заново',
       'verifyPrefix': 'Google требует однократной проверки аккаунта. ',
       'verifyLink': 'Открыть страницу проверки',
       'verifySuffix': ' затем подключитесь заново.',
@@ -237,6 +261,8 @@ function PluginCard(props) {
       const [accounts, setAccounts] = React.useState([])
       const [providers, setProviders] = React.useState([])
       const [paste, setPaste] = React.useState({})
+      const [device, setDevice] = React.useState({})  // #90 key -> {state,userCode,authUrl,intervalMs,status}
+      const [proxyRes, setProxyRes] = React.useState({})  // #88 key -> {ok,latencyMs,error}
       const [checkRes, setCheckRes] = React.useState({})
       const [checking, setChecking] = React.useState({})
       const [saved, setSaved] = React.useState(false)
@@ -259,6 +285,16 @@ function PluginCard(props) {
         return () => { alive = false }
       }, [])
 
+      // #90: poll device login while any slot is in 'pending' state.
+      React.useEffect(() => {
+        const pendingKeys = Object.entries(device).filter(([, d]) => d && d.status === 'pending')
+        if (!pendingKeys.length) return
+        const timers = pendingKeys.map(([key, d]) => setInterval(() => {
+          devicePollOnce(key.split(':')[0], Number(key.split(':')[1]))
+        }, d.intervalMs || 5000))
+        return () => timers.forEach(clearInterval)
+      })
+
       if (!draft) return React.createElement('div', { className: 'dsub-wrap' }, t('loading'))
 
       const slots = Array.isArray(draft.slots) ? draft.slots : []
@@ -286,6 +322,45 @@ function PluginCard(props) {
         if (data.url) window.open(data.url, '_blank', 'noopener')
       }
 
+      // #90: device-code login (headless). Server mints user_code; we show it,
+      // open the verification page, and poll until authorized.
+      const deviceStartLogin = async (provider, index) => {
+        const key = provider + ':' + index
+        setErr('')
+        const res = await fetch('/dsh-subscriptions/oauth/device/start', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ provider, index }),
+        })
+        const data = await res.json().catch(() => ({}))
+        if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+        setDevice((m) => Object.assign({}, m, { [key]: { state: data.state, userCode: data.userCode, authUrl: data.authUrl, intervalMs: data.intervalMs || 5000, status: 'pending' } }))
+      }
+
+      const devicePollOnce = async (provider, index) => {
+        const key = provider + ':' + index
+        const d = device[key]
+        if (!d || !d.state) return
+        const res = await fetch('/dsh-subscriptions/oauth/device/poll', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ state: d.state }),
+        })
+        const data = await res.json().catch(() => ({}))
+        if (!res.ok) {
+          setDevice((m) => Object.assign({}, m, { [key]: Object.assign({}, d, { status: 'expired' }) }))
+          return
+        }
+        if (data.status === 'authorized') {
+          setDevice((m) => Object.assign({}, m, { [key]: Object.assign({}, d, { status: 'authorized' }) }))
+          reload().catch(() => {})
+          return
+        }
+        if (data.status === 'expired') {
+          setDevice((m) => Object.assign({}, m, { [key]: Object.assign({}, d, { status: 'expired' }) }))
+        }
+      }
+
       const complete = async (provider, index) => {
         setErr('')
         const key = provider + ':' + index
@@ -301,6 +376,24 @@ function PluginCard(props) {
         setPaste((p) => Object.assign({}, p, { [key]: '' }))
       }
 
+      // #88: проверить прокси аккаунта реальным запросом с замером задержки.
+      const doProxyCheck = async (provider, index) => {
+        const key = provider + ':' + index
+        setChecking((c) => Object.assign({}, c, { ['proxy:' + key]: true }))
+        setErr('')
+        try {
+          const res = await fetch('/dsh-subscriptions/proxy-check', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ provider, index }),
+          })
+          const data = await res.json().catch(() => ({}))
+          setProxyRes((m) => Object.assign({}, m, { [key]: data }))
+        } catch (e) { setErr(String(e.message || e)) }
+        setChecking((c) => Object.assign({}, c, { ['proxy:' + key]: false }))
+      }
+
+
       const doCheck = async (provider, index) => {
         const key = provider + ':' + index
         setChecking((c) => Object.assign({}, c, { [key]: true }))
@@ -376,6 +469,16 @@ function PluginCard(props) {
           ),
           React.createElement('div', { className: 'dsub-sub' },
             t('useOriginHint')),
+          React.createElement('label', { className: 'dsub-row' },
+            React.createElement('input', {
+              type: 'checkbox',
+              checked: !!draft.privacyMask,
+              onChange: (e) => setDraft((d) => Object.assign({}, d, { privacyMask: e.target.checked })),
+            }),
+            React.createElement('span', null, t('privacyMask')),
+          ),
+          React.createElement('div', { className: 'dsub-sub' },
+            t('privacyMaskHint')),
         ),
         names.map((prov) => {
           const rows = slots
@@ -404,6 +507,10 @@ function PluginCard(props) {
                     type: 'button', className: 'dsub-mini',
                     onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
                   }, on ? t('reconnect') : t('connect')),
+                  (row.slot.provider === 'codex' ? React.createElement('button', {
+                    type: 'button', className: 'dsub-mini',
+                    onClick: () => deviceStartLogin(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
+                  }, t('deviceLogin')) : null),
                   React.createElement('button', {
                     type: 'button', className: 'dsub-mini',
                     disabled: !on,
@@ -450,7 +557,50 @@ function PluginCard(props) {
                     onClick: () => importToken(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
                   }, t('importToken')),
                 ),
+                React.createElement('div', { className: 'dsub-row' },
+                  React.createElement('input', {
+                    className: 'dsub-grow',
+                    value: row.slot.proxyUrl || '',
+                    placeholder: t('proxyPlaceholder'),
+                    onChange: (e) => {
+                      const next = slots.slice()
+                      next[row.i] = Object.assign({}, next[row.i], { proxyUrl: e.target.value })
+                      setSlots(next)
+                    },
+                  }),
+                  React.createElement('button', {
+                    type: 'button', className: 'dsub-mini',
+                    disabled: checking['proxy:' + key],
+                    onClick: () => doProxyCheck(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
+                  }, checking['proxy:' + key] ? '\u2026' : t('proxyCheck')),
+                ),
+                (function(){
+                  var r = proxyRes[key]
+                  if (!r) return null
+                  var txt = r.ok ? (t('proxyOk') + ' ' + r.latencyMs + 'ms' + (r.viaProxy ? '' : ' (direct)')) : (t('proxyFail') + ': ' + ((r.error && r.error.message) || ''))
+                  return React.createElement('div', { className: r.ok ? 'dsub-ok' : 'dsub-bad' }, txt)
+                })(),
                 ),
+                (function devicePanel(){
+                  var d = device[key]
+                  if (!d) return null
+                  var txt = d.status === 'authorized' ? t('deviceAuthorized') : (d.status === 'expired' ? t('deviceExpired') : t('devicePending'))
+                  var cls = d.status === 'authorized' ? 'dsub-ok' : (d.status === 'expired' ? 'dsub-bad' : 'dsub-verify')
+                  return React.createElement('div', { className: 'dsub-verify' },
+                    React.createElement('div', { className: cls }, txt),
+                    d.status === 'pending' ? React.createElement(React.Fragment, null,
+                      React.createElement('div', { style: { fontSize: '2em', fontWeight: 700, letterSpacing: '0.15em', margin: '4px 0' } }, d.userCode),
+                      React.createElement('div', { className: 'dsub-row' },
+                        React.createElement('button', {
+                          type: 'button', className: 'dsub-mini',
+                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch {} },
+                        }, t('deviceCopy')),
+                        React.createElement('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
+                      ),
+                      React.createElement('div', { className: 'dsub-sub' }, t('deviceHint')),
+                    ) : null,
+                  )
+                })(),
                 account.accountNotice ? React.createElement('div', { className: 'dsub-verify' }, account.accountNotice) : null,
                 account.refreshError ? React.createElement('div', { className: 'dsub-bad' }, t('reconnectRequired') + ': ' + account.refreshError) : null,
                 (function(){ var r=checkRes[key]; if(!r) return null; var txt=r.ok ? ('ok ' + (r.email||'')) : ('fail ' + (r.error && r.error.message || '')); var cls=r.ok ? 'dsub-ok' : 'dsub-bad'; var q=r.quota; if(q && q.remaining!=null) txt += ' quota:'+q.remaining+(q.limit!=null?'/'+q.limit:''); return React.createElement('div', {className: cls}, txt) })(),