@goodandready/dsh-subscriptions 0.4.15 → 0.4.17

package/README.zh.md

@@ -0,0 +1,123 @@
+# 📦 @goodandready/dsh-subscriptions
+
+<div align="center">
+
+<h3>DeepSeek Harness 个人 AI 订阅桥接、多账号池轮换与零泄漏 OAuth 插件</h3>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@goodandready/dsh-subscriptions"><img src="https://img.shields.io/npm/v/@goodandready/dsh-subscriptions.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-10b981.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
+  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
+</p>
+
+<p align="center">
+  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/作者全部项目-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="作者全部项目"></a>
+</p>
+
+<p align="center">
+  <a href="README.md"><b>🇬🇧 English</b></a> •
+  <a href="README.ru.md"><b>🇷🇺 Русский</b></a> •
+  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a>
+</p>
+
+</div>
+
+---
+
+## ⚡ 插件概览
+
+**`dsh-subscriptions`** 将您现有的付费个人 AI 订阅无缝接入 **DeepSeek Harness**，作为第一类模型服务商。
+
+无需为日常智能体任务支付昂贵的 API 按量计费。本插件支持标准 OAuth PKCE 鉴权、**单服务商多账号池动态轮换**（遭遇 429 限流时自动秒切可用账号）、**前置配额平滑切换**，并通过**进程内 Cordis 服务 (`ctx.subscriptions`)** 赋能 [`dsh-image-gen`](https://github.com/GooDAnDReaDY/dsh-image-gen) 与 [`dsh-grok-xsearch`](https://github.com/GooDAnDReaDY/dsh-grok-xsearch) 等插件，实现 Token 零网络泄漏。
+
+```mermaid
+graph LR
+    subgraph DSHCore [DeepSeek Harness 对话流]
+        Agent[🤖 智能体任务执行] --> Router{服务商路由器}
+    end
+
+    subgraph SubscriptionsCore [dsh-subscriptions 调度核心]
+        Router --> Pool{多账号负载池}
+        Pool -->|账号 1| Acc1[👤 主账号: 活跃中]
+        Pool -->|账号 2| Acc2[👤 副账号: 待命中]
+        Pool -->|账号 3| Acc3[👤 备用账号: 冷却中]
+        Acc1 -->|HTTP 429 / 配额耗尽| Rotate[智能配额与冷却轮换器]
+        Rotate -->|流量平滑切换| Acc2
+    end
+
+    subgraph VendorBridges [4 大服务商桥接适配]
+        Acc1 --> B1[ChatGPT / Codex 后端]
+        Acc1 --> B2[Claude Pro / Max 协议]
+        Acc1 --> B3[xAI / Grok 订阅]
+        Acc1 --> B4[Google Cloud Code Assist / Antigravity]
+    end
+
+    subgraph EcosystemBridge [Cordis 进程内共享: ctx.subscriptions]
+        Pool --> ImgGen[dsh-image-gen: 订阅零成本生图]
+        Pool --> XSearch[dsh-grok-xsearch: X 社交搜索]
+    end
+
+    style DSHCore fill:#1e1e2e,stroke:#89b4fa,stroke-width:2px,color:#cdd6f4
+    style SubscriptionsCore fill:#181825,stroke:#cba6f7,stroke-width:2px,color:#cdd6f4
+    style VendorBridges fill:#11111b,stroke:#a6e3a1,stroke-width:2px,color:#cdd6f4
+    style EcosystemBridge fill:#181825,stroke:#f38ba8,stroke-width:2px,color:#cdd6f4
+```
+
+---
+
+## ✨ 核心功能
+
+### 支持的内置订阅供应商
+| 供应商 | 订阅级别 | 协议 |
+|---|---|---|
+| `codex` | ChatGPT Plus / Pro | 流式响应、工具调用、图像生成 |
+| `claude` | Claude Pro / Max | 原生 Messages 协议、用量跟踪 |
+| `grok` | xAI / X Premium | 实时推理、计费检查 |
+| `antigravity` | Google Cloud Code Assist | 流式生成 |
+
+### 多账号轮换与限流保护
+* 每个供应商可挂多个账号（如 `CODEX_OAUTH_1`、`CODEX_OAUTH_2`）。
+* 遇到 429/配额耗尽自动切换到下一个健康账号；支持按剩余量提前切换和动态冷却恢复。
+
+### 安全与无头登录
+* OAuth 令牌绝不通过 HTTP API 返回，也不在 Web 界面渲染；仅存放于宿主加密凭据存储。
+* **回环自动回调 (`autoLoopback`，`v0.4.9`)**：供应商重定向为回环地址（如 Codex `:1455`）时，插件自动启动临时本地服务器接收回调，无需手动粘贴链接。
+* **设备码登录（Codex，`v0.4.9`）**：完全无浏览器的主机上，点击 **Device login**，在任意设备打开 `https://auth.openai.com/codex/device` 输入短码即可完成 PKCE 授权。
+
+### 账号级代理（`v0.4.9`）
+* 每个账号可配置独立代理（`http://`、`https://`、`socks5://`）；令牌刷新、供应商检查、模型请求均走该代理。
+* 账号卡片内的 **Check proxy** 按钮一键检测代理延迟。
+
+### 本地 Ollama 网关与无缝回退（`v0.4.17`）
+* **原生 provider (`ollama`)**：本地 Ollama 可达时（`ollamaBaseUrl`，默认 `http://127.0.0.1:11434`），自动出现在 DSH 原生模型选择器中（模型来自 `/api/tags`），无需密钥。
+* **无缝配额回退 (`ollamaFallback`，默认开启)**：某供应商的所有账号耗尽或不可达且尚未输出任何内容时，对话自动切换到本地模型（`ollamaFallbackModel` 或 `/api/tags` 第一个模型），并记录到请求历史（`kind: fallback`）。
+* 免费（$0）应急通道：无网络、无配额也能用。
+
+### Effort、Verbosity 与 Fast Mode（`v0.4.17`）
+* **推理力度 (Effort)**：Codex 模型从实时目录上报支持的力度等级，原生选择器校验后以 `reasoning.effort` 传入 `/responses` 协议；Grok 按自身目录过滤转发。
+* **详略程度 (`codexVerbosity`)**：`low`/`medium`/`high` 以 `text.verbosity` 传给 Codex 推理模型；留空为协议默认。
+* **Fast Mode (`codexFastMode`)**：每次 Codex 请求携带 `service_tier: priority`（1.5x 速度计费档）；启用时活动订阅芯片显示 `⚡`。
+
+### 按模型家族的冷却与模型过滤（`v0.4.17`）
+* **Reasoning 与 Standard 分离**：推理模型（claude `*thinking*`、grok `*reasoning*`、全部 codex 模型）触发 429 时，只冷却该账号的 reasoning 家族——同账号的 standard 模型立即可用；旧版冷却仍按整账号生效。
+* **隐藏过时模型 (`hideDeprecatedModels`)**：从原生选择器中过滤 `test`/`preview`/`dev`/`alpha`/`beta`/`legacy` 模型 id（同时作用于实时目录与静态回退）。
+
+### 隐私模式与诊断报告（`v0.4.9`）
+* **`privacyMask`**：一个开关即可在整个界面隐藏个人数据（邮箱显示为 `j***n@example.com`），服务端遮蔽，适合屏幕共享。
+* **匿名诊断报告**：设置卡片内一键生成（插件/运行时版本、系统、各供应商健康状态、HTTP 状态聚合、最近错误与耗时、非敏感配置）并自动复制到剪贴板；令牌、邮箱、凭据名与代理地址严格排除。
+* 同区块提供问题追踪器链接，便于提交 issue。
+
+---
+
+## 📦 安装指南
+
+```bash
+dsh plugin --profile web add @goodandready/dsh-subscriptions
+```
+
+---
+
+## 📄 开源协议
+
+MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)

package/lib/accounts.js

@@ -42,13 +42,16 @@ export function vendorConfig(provider, cfg) {
     originator: pick('Originator', d.originator || ''),
     systemPrefix: pick('SystemPrefix', d.systemPrefix || ''),
     clientVersion: pick('ClientVersion', d.clientVersion || ''),
+    // #93/#92: per-vendor request shaping (codex only consumes these today).
+    verbosity: pick('Verbosity', ''),
+    fastMode: !!(cfg && cfg[`${provider}FastMode`]),
     models: Array.isArray(cfg && cfg[modelsKey]) && cfg[modelsKey].length
       ? cfg[modelsKey]
       : (d.models || []),
   }
 }
 
-export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitNotice }) {
+export function createAccountStore({ credentials, getConfig, fetchImpl, fetchForRef, onLimitNotice }) {
   const cooldowns = new Map()
   const quotas = new Map()
   const refreshLocks = new Map()
@@ -60,6 +63,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
   const windows = new Map()
   const usageFetched = new Map()
   const doFetch = fetchImpl || fetch
+  // #88: per-account proxy fetch for token refresh / usage (falls back to doFetch).
+  const fetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
 
   async function resolveRaw(ref) {
     try {
@@ -122,7 +127,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
     }
     return {
       ...base,
-      cooldownUntil: cooldowns.get(ref) || 0,
+      cooldownUntil: cooldowns.get(ref) ? cooldowns.get(ref).until : 0,
+      cooldownFamilies: cooldowns.get(ref) && cooldowns.get(ref).families ? cooldowns.get(ref).families : null,
       quota: quotas.get(ref) || null,
       usage: windows.get(ref) || base.usage || null,
       health: health.get(ref) || null,
@@ -168,7 +174,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
     const promise = (async () => {
       try {
         const cfg = vendorConfig(provider, getConfig())
-        const next = await getVendor(provider).refresh(cfg, blob, doFetch)
+        const next = await getVendor(provider).refresh(cfg, blob, fetchFor(ref))
         const merged = {
           ...blob,
           ...next,
@@ -201,7 +207,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
       if (!raw) continue
       try {
         const blob = await ensureFresh(provider, parseBlob(raw), slot.ref)
-        const snap = await vendor.usage(blob, cfg, doFetch)
+        const snap = await vendor.usage(blob, cfg, fetchFor(slot.ref))
         usageFetched.set(slot.ref, Date.now())
         if (!snap) continue
         if (Number.isFinite(Number(snap.usedPercent))) {
@@ -270,7 +276,15 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, onLimitN
     resolveRaw,
     ensureFresh,
     refreshUsage,
-    rememberCooldown(ref, until) { cooldowns.set(ref, until) },
+    // #87: family-scoped cooldowns. families=null blocks the whole account
+    // (legacy behavior); a list blocks only those model families.
+    rememberCooldown(ref, until, families) {
+      if (!families || !families.length) { cooldowns.set(ref, { until: Number(until) || 0, families: null }); return }
+      const prev = cooldowns.get(ref)
+      const merged = new Set(families)
+      if (prev && Array.isArray(prev.families)) for (const f of prev.families) merged.add(f)
+      cooldowns.set(ref, { until: Math.max(Number(until) || 0, prev ? prev.until : 0), families: Array.from(merged) })
+    },
     rememberQuota(ref, snap) { if (snap) quotas.set(ref, snap); else quotas.delete(ref) },
     shouldSkipRefresh(ref, now, retryMs) { const f = refreshFailures.get(ref); if (!f) return false; return (Number(f.at) + Number(retryMs)) > Number(now) },
     getQuota(ref) { return quotas.get(ref) || null },

package/lib/adapter.js

@@ -3,6 +3,12 @@ import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
 import { modelCatalog } from './messages.js'
 import { streamWithRotation } from './stream-rotate.js'
+import { pickFetch } from './proxy.js'
+
+// #94: heuristic for test/preview/beta/legacy model ids.
+function isDeprecatedId(id) {
+  return /(^|[-_:])(test|preview|dev|alpha|beta|snapshot|experimental|legacy|deprecated)([-_:]|$)/i.test(id)
+}
 
 function asLlmError(err) {
   if (err instanceof LlmError) return err
@@ -36,16 +42,22 @@ export class SubscriptionAdapter extends LlmAdapter {
     if (!accounts.some((a) => a.hasToken)) return []
     const cfg = this.deps.vendorConfig(provider)
     const fetchImpl = this.deps.fetchImpl || fetch
+    let models = null
     try {
       const blob = await this.deps.ensureFresh(
         provider,
         await this.deps.loadBlob(accounts.find((a) => a.hasToken).ref),
         accounts.find((a) => a.hasToken).ref,
       )
-      const models = await getVendor(provider).listModels(blob, cfg, fetchImpl)
-      if (Array.isArray(models) && models.length) return models
+      const live = await getVendor(provider).listModels(blob, cfg, fetchImpl)
+      if (Array.isArray(live) && live.length) models = live
     } catch { /* use built-in catalog */ }
-    return modelCatalog(provider, cfg.models)
+    if (!models) models = modelCatalog(provider, cfg.models)
+    // #94: optionally hide test/preview/beta/legacy ids from the picker.
+    if (typeof this.deps.hideDeprecatedModels === 'function' && this.deps.hideDeprecatedModels()) {
+      models = models.filter((m) => !isDeprecatedId(String((m && m.id) || '')))
+    }
+    return models
   }
 
   async resolveModel(provider, model, _signal) {
@@ -68,25 +80,26 @@ export class SubscriptionAdapter extends LlmAdapter {
   async *stream(options) {
     const provider = options.provider
     const deps = this.deps
+    let yieldedAny = false
     try {
       if (typeof deps.refreshUsage === 'function') {
         await deps.refreshUsage(provider)
       }
-      yield* streamWithRotation({
+      for await (const event of streamWithRotation({
         accounts: await deps.listAccounts(provider),
         nowMs: () => Date.now(),
         cooldownMs: deps.cooldownMs(),
         switchAtRemaining: typeof deps.switchAtRemaining === 'function' ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0),
         options,
         onCooldown: (account) => {
-          deps.rememberCooldown(account.ref, account.cooldownUntil)
+          deps.rememberCooldown(account.ref, account.cooldownUntil, account.cooldownFamilies || null)
           if (typeof deps.recordSwitch === 'function') deps.recordSwitch(account.ref)
         },
         streamOnce: async function* (account, opts) {
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const vendor = getVendor(provider)
           // ponytail: capture x-ratelimit headers without touching vendors
-          const baseFetch = deps.fetchImpl || fetch
+          const baseFetch = pickFetch(deps, account.ref)
           const quotaFetch = async (url, init) => {
             const res = await baseFetch(url, init)
             try {
@@ -131,6 +144,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                   path: '/responses',
                   method: 'POST',
                   status: 200,
+                  ms: Date.now() - t0,
                   kind: 'stream',
                 })
               } catch {}
@@ -146,8 +160,15 @@ export class SubscriptionAdapter extends LlmAdapter {
             throw err
           }
         },
-      })
+      })) { yieldedAny = true; yield event }
+      return
     } catch (err) {
+      // #91: when the whole pool is exhausted and nothing has been streamed
+      // yet, continue seamlessly on local Ollama instead of failing the chat.
+      if (!yieldedAny && typeof deps.ollamaFallback === 'function') {
+        yield* deps.ollamaFallback({ options, provider, err })
+        return
+      }
       throw asLlmError(err)
     }
   }

package/lib/client.js

@@ -88,12 +88,24 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       'intro': 'Log in with a consumer subscription. Tokens stay on the host credentials store. The browser never reads them back. After Connect, if the provider lands on localhost or a vendor page, paste the redirected URL or the code here.',
       'useOrigin': 'Use this Web UI origin as OAuth redirect_uri',
       'useOriginHint': 'Leave off unless you registered your own OAuth client for this origin. Vendor CLI clients usually require their published redirect URI plus the paste step.',
+      'privacyMask': 'Mask emails and account identifiers',
+      'privacyMaskHint': 'For demos and screen sharing: emails show as j***n@example.com.',
       'reconnect': 'Reconnect',
       'connect': 'Connect',
       'disconnect': 'Disconnect',
       'removeSlot': 'Remove slot',
       'pastePlaceholder': 'Paste redirected URL or code',
       'submitCode': 'Submit code',
+      'proxyPlaceholder': 'Per-account proxy (http://, https://, socks5://) - optional',
+      'proxyCheck': 'Check proxy',
+      'proxyOk': 'proxy ok',
+      'proxyFail': 'proxy fail',
+      'deviceLogin': 'Device login',
+      'deviceHint': 'Headless: open the link, enter the code, keep this tab open.',
+      'deviceCopy': 'Copy code',
+      'devicePending': 'Waiting for confirmation',
+      'deviceAuthorized': 'Signed in',
+      'deviceExpired': 'Expired - start again',
       'verifyPrefix': 'Google requires one-time account verification. ',
       'verifyLink': 'Open verification link',
       'verifySuffix': ' then reconnect.',
@@ -143,12 +155,24 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       'intro': 'Вход по обычной пользовательской подписке. Токены остаются в хранилище учётных данных харнесса, браузер их обратно не читает. Если после «Подключить» провайдер увёл на localhost или на свою страницу, вставьте сюда адрес перехода или код.',
       'useOrigin': 'Использовать адрес этого веб-интерфейса как redirect_uri',
       'useOriginHint': 'Включайте, только если зарегистрировали собственного клиента OAuth на этот адрес. Штатным консольным клиентам провайдеров нужен их опубликованный адрес возврата и вставка кода вручную.',
+      'privacyMask': 'Маскировать email и учётные записи',
+      'privacyMaskHint': 'Для демонстрации экрана: email отображается как j***n@example.com.',
       'reconnect': 'Переподключить',
       'connect': 'Подключить',
       'disconnect': 'Отключить',
       'removeSlot': 'Убрать место',
       'pastePlaceholder': 'Адрес перехода или код',
       'submitCode': 'Отправить код',
+      'proxyPlaceholder': 'Прокси аккаунта (http://, https://, socks5://) - необязательно',
+      'proxyCheck': 'Проверить прокси',
+      'proxyOk': 'прокси ок',
+      'proxyFail': 'прокси недоступен',
+      'deviceLogin': 'Вход по коду',
+      'deviceHint': 'Headless: откройте ссылку, введите код, держите вкладку открытой.',
+      'deviceCopy': 'Скопировать код',
+      'devicePending': 'Ожидание подтверждения',
+      'deviceAuthorized': 'Вход выполнен',
+      'deviceExpired': 'Истёк - начните заново',
       'verifyPrefix': 'Google требует однократной проверки аккаунта. ',
       'verifyLink': 'Открыть страницу проверки',
       'verifySuffix': ' затем подключитесь заново.',
@@ -237,6 +261,8 @@ function PluginCard(props) {
       const [accounts, setAccounts] = React.useState([])
       const [providers, setProviders] = React.useState([])
       const [paste, setPaste] = React.useState({})
+      const [device, setDevice] = React.useState({})  // #90 key -> {state,userCode,authUrl,intervalMs,status}
+      const [proxyRes, setProxyRes] = React.useState({})  // #88 key -> {ok,latencyMs,error}
       const [checkRes, setCheckRes] = React.useState({})
       const [checking, setChecking] = React.useState({})
       const [saved, setSaved] = React.useState(false)
@@ -259,6 +285,16 @@ function PluginCard(props) {
         return () => { alive = false }
       }, [])
 
+      // #90: poll device login while any slot is in 'pending' state.
+      React.useEffect(() => {
+        const pendingKeys = Object.entries(device).filter(([, d]) => d && d.status === 'pending')
+        if (!pendingKeys.length) return
+        const timers = pendingKeys.map(([key, d]) => setInterval(() => {
+          devicePollOnce(key.split(':')[0], Number(key.split(':')[1]))
+        }, d.intervalMs || 5000))
+        return () => timers.forEach(clearInterval)
+      })
+
       if (!draft) return React.createElement('div', { className: 'dsub-wrap' }, t('loading'))
 
       const slots = Array.isArray(draft.slots) ? draft.slots : []
@@ -286,6 +322,45 @@ function PluginCard(props) {
         if (data.url) window.open(data.url, '_blank', 'noopener')
       }
 
+      // #90: device-code login (headless). Server mints user_code; we show it,
+      // open the verification page, and poll until authorized.
+      const deviceStartLogin = async (provider, index) => {
+        const key = provider + ':' + index
+        setErr('')
+        const res = await fetch('/dsh-subscriptions/oauth/device/start', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ provider, index }),
+        })
+        const data = await res.json().catch(() => ({}))
+        if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+        setDevice((m) => Object.assign({}, m, { [key]: { state: data.state, userCode: data.userCode, authUrl: data.authUrl, intervalMs: data.intervalMs || 5000, status: 'pending' } }))
+      }
+
+      const devicePollOnce = async (provider, index) => {
+        const key = provider + ':' + index
+        const d = device[key]
+        if (!d || !d.state) return
+        const res = await fetch('/dsh-subscriptions/oauth/device/poll', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ state: d.state }),
+        })
+        const data = await res.json().catch(() => ({}))
+        if (!res.ok) {
+          setDevice((m) => Object.assign({}, m, { [key]: Object.assign({}, d, { status: 'expired' }) }))
+          return
+        }
+        if (data.status === 'authorized') {
+          setDevice((m) => Object.assign({}, m, { [key]: Object.assign({}, d, { status: 'authorized' }) }))
+          reload().catch(() => {})
+          return
+        }
+        if (data.status === 'expired') {
+          setDevice((m) => Object.assign({}, m, { [key]: Object.assign({}, d, { status: 'expired' }) }))
+        }
+      }
+
       const complete = async (provider, index) => {
         setErr('')
         const key = provider + ':' + index
@@ -301,6 +376,24 @@ function PluginCard(props) {
         setPaste((p) => Object.assign({}, p, { [key]: '' }))
       }
 
+      // #88: проверить прокси аккаунта реальным запросом с замером задержки.
+      const doProxyCheck = async (provider, index) => {
+        const key = provider + ':' + index
+        setChecking((c) => Object.assign({}, c, { ['proxy:' + key]: true }))
+        setErr('')
+        try {
+          const res = await fetch('/dsh-subscriptions/proxy-check', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ provider, index }),
+          })
+          const data = await res.json().catch(() => ({}))
+          setProxyRes((m) => Object.assign({}, m, { [key]: data }))
+        } catch (e) { setErr(String(e.message || e)) }
+        setChecking((c) => Object.assign({}, c, { ['proxy:' + key]: false }))
+      }
+
+
       const doCheck = async (provider, index) => {
         const key = provider + ':' + index
         setChecking((c) => Object.assign({}, c, { [key]: true }))
@@ -376,6 +469,16 @@ function PluginCard(props) {
           ),
           React.createElement('div', { className: 'dsub-sub' },
             t('useOriginHint')),
+          React.createElement('label', { className: 'dsub-row' },
+            React.createElement('input', {
+              type: 'checkbox',
+              checked: !!draft.privacyMask,
+              onChange: (e) => setDraft((d) => Object.assign({}, d, { privacyMask: e.target.checked })),
+            }),
+            React.createElement('span', null, t('privacyMask')),
+          ),
+          React.createElement('div', { className: 'dsub-sub' },
+            t('privacyMaskHint')),
         ),
         names.map((prov) => {
           const rows = slots
@@ -404,6 +507,10 @@ function PluginCard(props) {
                     type: 'button', className: 'dsub-mini',
                     onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
                   }, on ? t('reconnect') : t('connect')),
+                  (row.slot.provider === 'codex' ? React.createElement('button', {
+                    type: 'button', className: 'dsub-mini',
+                    onClick: () => deviceStartLogin(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
+                  }, t('deviceLogin')) : null),
                   React.createElement('button', {
                     type: 'button', className: 'dsub-mini',
                     disabled: !on,
@@ -450,7 +557,50 @@ function PluginCard(props) {
                     onClick: () => importToken(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
                   }, t('importToken')),
                 ),
+                React.createElement('div', { className: 'dsub-row' },
+                  React.createElement('input', {
+                    className: 'dsub-grow',
+                    value: row.slot.proxyUrl || '',
+                    placeholder: t('proxyPlaceholder'),
+                    onChange: (e) => {
+                      const next = slots.slice()
+                      next[row.i] = Object.assign({}, next[row.i], { proxyUrl: e.target.value })
+                      setSlots(next)
+                    },
+                  }),
+                  React.createElement('button', {
+                    type: 'button', className: 'dsub-mini',
+                    disabled: checking['proxy:' + key],
+                    onClick: () => doProxyCheck(row.slot.provider, row.slot.index).catch((e) => setErr(String(e.message || e))),
+                  }, checking['proxy:' + key] ? '\u2026' : t('proxyCheck')),
+                ),
+                (function(){
+                  var r = proxyRes[key]
+                  if (!r) return null
+                  var txt = r.ok ? (t('proxyOk') + ' ' + r.latencyMs + 'ms' + (r.viaProxy ? '' : ' (direct)')) : (t('proxyFail') + ': ' + ((r.error && r.error.message) || ''))
+                  return React.createElement('div', { className: r.ok ? 'dsub-ok' : 'dsub-bad' }, txt)
+                })(),
                 ),
+                (function devicePanel(){
+                  var d = device[key]
+                  if (!d) return null
+                  var txt = d.status === 'authorized' ? t('deviceAuthorized') : (d.status === 'expired' ? t('deviceExpired') : t('devicePending'))
+                  var cls = d.status === 'authorized' ? 'dsub-ok' : (d.status === 'expired' ? 'dsub-bad' : 'dsub-verify')
+                  return React.createElement('div', { className: 'dsub-verify' },
+                    React.createElement('div', { className: cls }, txt),
+                    d.status === 'pending' ? React.createElement(React.Fragment, null,
+                      React.createElement('div', { style: { fontSize: '2em', fontWeight: 700, letterSpacing: '0.15em', margin: '4px 0' } }, d.userCode),
+                      React.createElement('div', { className: 'dsub-row' },
+                        React.createElement('button', {
+                          type: 'button', className: 'dsub-mini',
+                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch {} },
+                        }, t('deviceCopy')),
+                        React.createElement('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
+                      ),
+                      React.createElement('div', { className: 'dsub-sub' }, t('deviceHint')),
+                    ) : null,
+                  )
+                })(),
                 account.accountNotice ? React.createElement('div', { className: 'dsub-verify' }, account.accountNotice) : null,
                 account.refreshError ? React.createElement('div', { className: 'dsub-bad' }, t('reconnectRequired') + ': ' + account.refreshError) : null,
                 (function(){ var r=checkRes[key]; if(!r) return null; var txt=r.ok ? ('ok ' + (r.email||'')) : ('fail ' + (r.error && r.error.message || '')); var cls=r.ok ? 'dsub-ok' : 'dsub-bad'; var q=r.quota; if(q && q.remaining!=null) txt += ' quota:'+q.remaining+(q.limit!=null?'/'+q.limit:''); return React.createElement('div', {className: cls}, txt) })(),
@@ -638,7 +788,7 @@ function PluginCard(props) {
           expiryNotifyDays: (data && data.expiryNotifyDays) || 7,
           active: (data && data.active) || null,
         }
-      } catch { return { logged: [], usage: 0, expiresAt: {}, labels: {}, expiryNotifyDays: 7, active: null } }
+      } catch { return { logged: [], usage: 0, expiresAt: {}, labels: {}, expiryNotifyDays: 7, fastMode: false, active: null } }
     }
 
     // #52: компактный чип в шапке сессии со статусом подключённых подписок.
@@ -683,12 +833,12 @@ function PluginCard(props) {
         const idx = a.index != null ? ('#' + a.index) : ''
         const plan = a.plan ? (' ' + a.plan) : ''
         // #77: без provider-префикса
-        const label = idx + plan
+        const label = (a.provider === 'codex' && state.fastMode ? '\u26a1' : '') + idx + plan
         // windows: "5h 12%  7d 8%"
         const winLabels = wins.map((w) => (w.label || w.id) + ' ' + Math.round(w.usedPercent) + '%').join('  ')
         return React.createElement('span', {
           className: acls,
-          title: a.model ? (idx + ' · ' + a.model) : idx,
+          title: a.model ? (prov + idx + ' · ' + a.model) : (prov + idx),
         },
           React.createElement('span', { className: 'dsub-chipDot' }),
           label,