@goodandready/dsh-subscriptions 0.4.15 → 0.4.17

package/lib/index.js

@@ -1,5 +1,6 @@
+import { readFileSync } from 'node:fs'
 import z from '@deepseek-ai/schemastery'
-import { PROVIDERS, oauthRef, isProvider, displayName, droppedCredentialRefs } from './refs.js'
+import { PROVIDERS, oauthRef, parseOauthRef, isProvider, displayName, droppedCredentialRefs } from './refs.js'
 import { createPkce } from './pkce.js'
 import { parseCallbackInput, requestOrigin, webCallbackUri } from './oauth.js'
 import { writeJson, writeHtml, readBody, isTrustedSettingsRequest, queryOf } from './http.js'
@@ -13,6 +14,10 @@ import { createSubscriptionsService } from './subscriptions.js'
 import { encryptWithPassphrase, decryptWithPassphrase } from './crypto.js'
 import { quotaSnapshot } from './ratelimit.js'
 import { createAccountStore, normalizeSlots, vendorConfig } from './accounts.js'
+import { startLoopback } from './loopback.js'
+import { OllamaAdapter, ollamaAlive, ollamaModels, ollamaBase } from './ollama.js'
+import { maskEmail, maskLabel, maskText } from './mask.js'
+import { proxyFetch, pickFetch } from './proxy.js'
 import { HistoryStore } from './history.js'
 import {
   inspectGoogleAccount,
@@ -24,6 +29,9 @@ export const name = 'dsh-subscriptions'
 export const inject = ['llm', 'credentials', 'webServer', 'settings']
 
 const NS = 'dsh-subscriptions'
+
+let pkgVersion = ''
+try { pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '' } catch {}
 const PENDING_TTL_MS = 15 * 60 * 1000
 
 const Slot = z.object({
@@ -35,6 +43,8 @@ const Slot = z.object({
     .description('Optional display label. Empty uses the account email after login.'),
   expiresAt: z.number().default(0)
     .description('#67 Optional subscription expiry timestamp (ms). When set and within expiryNotifyDays, the header chip shows the account and expiry date.'),
+  proxyUrl: z.string().default('')
+    .description('#88 Per-account proxy URL (http://, https://, socks5://). All requests for this account route through it. Empty = direct connection.'),
 })
 
 const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))
@@ -54,11 +64,27 @@ export const Config = z.object({
     .description('Emit log notices when usage crosses 70/90/100% of a window.'),
   expiryNotifyDays: z.number().default(7)
     .description('#67 Warn in the header chip this many days before a subscription expiry (expiresAt). 0 disables.'),
+  privacyMask: z.boolean().default(false)
+    .description('#98 Hide personal data in the UI: emails show as j***n@example.com.'),
   slots: z.array(Slot).default(defaultSlots)
     .description('Account slots. Secrets are not stored here; only the credential ref names.'),
   useWebCallback: z.boolean().default(false)
     .description('When on, redirect_uri is this Web UI origin + /dsh-subscriptions/oauth/callback. When off, the vendor CLI registered redirect is used and you paste the redirected URL.'),
+  autoLoopback: z.boolean().default(true)
+    .description('#89 When on and the vendor redirect_uri is a loopback address (codex :1455, grok :56121), a temporary local server catches the OAuth callback automatically - no paste needed. Paste fallback stays available.'),
+  ollamaBaseUrl: z.string().default('http://127.0.0.1:11434')
+    .description('#91 Local Ollama base URL. Served as the ollama provider in the native model picker when reachable.'),
+  ollamaFallback: z.boolean().default(true)
+    .description('#91 When every account of a provider is exhausted, continue the chat on local Ollama instead of failing.'),
+  ollamaFallbackModel: z.string().default('')
+    .description('#91 Ollama model used for the fallback (for example qwen2.5-coder). Empty = first model from /api/tags.'),
+  hideDeprecatedModels: z.boolean().default(false)
+    .description('#94 Hide test/preview/beta/legacy model ids from the native model picker.'),
   codexClientId: z.string().default(''),
+  codexVerbosity: z.string().default('')
+    .description('#93 Response verbosity for Codex reasoning models: low, medium or high. Empty = protocol default.'),
+  codexFastMode: z.boolean().default(false)
+    .description('#92 Fast Mode for Codex: sends service_tier priority (1.5x speed billing tier) with every request.'),
   codexRedirectUri: z.string().default(''),
   codexBaseUrl: z.string().default(''),
   claudeClientId: z.string().default(''),
@@ -87,6 +113,8 @@ function redirectFor(provider, cfg, origin) {
   return overlay.redirectUri || webCallbackUri(origin)
 }
 
+const OK_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Signed in. You can close this tab and return to Settings.</p>'
+
 export function apply(ctx, config) {
   let getConfig = () => config
   let settingsApi
@@ -126,10 +154,20 @@ export function apply(ctx, config) {
   const live = () => Config(structuredClone(getConfig() ?? {})) ?? config
   syncCustomVendors()
 
+  // #88: fetch bound to the per-account proxy (slot.proxyUrl), or null for direct.
+  const fetchForRef = (ref) => {
+    const parsed = parseOauthRef(ref)
+    if (!parsed) return null
+    const slot = normalizeSlots(live().slots).find((s) => s.provider === parsed.provider && s.index === parsed.index)
+    if (!slot || !slot.proxyUrl) return null
+    return proxyFetch(slot.proxyUrl)
+  }
+
   const store = createAccountStore({
     credentials: ctx.credentials,
     getConfig: live,
     fetchImpl: fetch,
+    fetchForRef,
     onLimitNotice: (provider, ref, win, threshold) => {
       if (!live().notifyLimits) return
       const label = win.ru || win.en || win.id
@@ -140,6 +178,44 @@ export function apply(ctx, config) {
   const history = new HistoryStore()
   const recordHistory = (entry) => history.add(entry)
 
+  // #91: local Ollama - native provider + seamless fallback when the whole
+  // pool is exhausted and nothing has been streamed yet.
+  const ollamaAdapter = new OllamaAdapter({
+    baseUrl: () => ollamaBase(live()),
+    fallbackModel: () => live().ollamaFallbackModel || '',
+  })
+  let ollamaHandle
+  async function syncOllama() {
+    const cfg = live()
+    const alive = !!cfg.ollamaFallback && await ollamaAlive(ollamaBase(cfg), fetch)
+    if (alive && !ollamaHandle) {
+      try { ollamaHandle = ctx.llm.registerAdapter(['ollama'], ollamaAdapter) } catch { /* already registered elsewhere */ }
+    } else if (!alive && ollamaHandle) {
+      try { ollamaHandle() } catch { /* already gone */ }
+      ollamaHandle = undefined
+    }
+  }
+  async function* ollamaFallbackStream({ options, provider, err }) {
+    const cfg = live()
+    const models = await ollamaModels(ollamaBase(cfg), fetch).catch(() => [])
+    if (!cfg.ollamaFallback || !models.length) throw err
+    const model = cfg.ollamaFallbackModel || models[0].id
+    try { ctx.emit && ctx.emit('subscriptions.ollama-fallback', { provider, model, reason: err && err.code || 'EXHAUSTED' }) } catch {}
+    try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider}: все аккаунты исчерпаны (${err && err.code || 'EXHAUSTED'}), откат на ollama/${model}`) } catch {}
+    try {
+      recordHistory({
+        provider: 'ollama',
+        ref: 'OLLAMA_FALLBACK',
+        model,
+        path: '/v1/chat/completions',
+        method: 'POST',
+        status: 200,
+        kind: 'fallback',
+      })
+    } catch {}
+    yield* ollamaAdapter.stream({ ...options, provider: 'ollama', model })
+  }
+
   const subscriptions = createSubscriptionsService({
     listAccounts: (provider) => store.listAccounts(provider),
     loadBlob: (ref) => store.loadBlob(ref),
@@ -147,7 +223,7 @@ export function apply(ctx, config) {
     vendorConfig: (provider) => vendorConfig(provider, live()),
     cooldownMs: () => live().cooldownMs,
     switchAtRemaining: () => live().switchAtRemaining,
-    rememberCooldown: (ref, until) => store.rememberCooldown(ref, until),
+    rememberCooldown: (ref, until, families) => store.rememberCooldown(ref, until, families),
     recordSuccess: (ref) => store.recordSuccess(ref),
     getHealth: (ref) => store.getHealth(ref),
     recordSwitch: (ref) => store.recordSwitch(ref),
@@ -159,6 +235,9 @@ export function apply(ctx, config) {
     getRequestCount: (ref) => store.getRequestCount(ref),
     recordHistory,
     fetchImpl: fetch,
+    fetchForRef,
+    ollamaFallback: ollamaFallbackStream,
+    hideDeprecatedModels: () => !!live().hideDeprecatedModels,
   })
 
   // Служба генерации картинок на подписке.
@@ -209,13 +288,14 @@ export function apply(ctx, config) {
     vendorConfig: (provider) => vendorConfig(provider, live()),
     cooldownMs: () => live().cooldownMs,
     switchAtRemaining: () => live().switchAtRemaining,
-    rememberCooldown: (ref, until) => store.rememberCooldown(ref, until),
+    rememberCooldown: (ref, until, families) => store.rememberCooldown(ref, until, families),
     rememberQuota: (ref, snap) => store.rememberQuota(ref, snap),
     getQuota: (ref) => store.getQuota(ref),
     refreshUsage: (provider) => store.refreshUsage(provider),
     saveBlob: (ref, blob) => store.saveBlob(ref, blob),
     recordHistory,
     fetchImpl: fetch,
+    fetchForRef,
   })
 
   let handle
@@ -291,7 +371,7 @@ export function apply(ctx, config) {
     pending.delete(row.state)
     await syncAdapter()
     refreshModels().catch(() => {})
-    return { ref, label: blob.label || blob.email || displayName(provider) }
+    return { ref, label: pmL(blob.label || blob.email) || displayName(provider) }
   }
 
   async function enrichAntigravityAccount(slot, info) {
@@ -343,6 +423,69 @@ export function apply(ctx, config) {
     return (slots || []).filter((slot) => isProvider(slot.provider))
   }
 
+  // #98: privacy masking. pmE for raw emails, pmL for display labels (only email-looking ones masked).
+  const privacyOn = () => !!live().privacyMask
+  const pmE = (s) => privacyOn() ? maskEmail(s) : String(s || '')
+  const pmL = (s) => privacyOn() ? maskLabel(s) : String(s || '')
+
+  // #99: anonymized diagnostics report. No tokens, emails, refs, proxy URLs.
+  function scrubReport(v) {
+    if (typeof v === 'string') return maskText(v)
+    if (Array.isArray(v)) return v.map(scrubReport)
+    if (v && typeof v === 'object') {
+      const o = {}
+      for (const k of Object.keys(v)) o[k] = scrubReport(v[k])
+      return o
+    }
+    return v
+  }
+
+  async function diagnosticsReport() {
+    const cfg = live()
+    const slots = normalizeSlots(cfg.slots)
+    const mk = () => ({ loggedIn: false, slots: 0, configured: 0, cooldown: 0, proxy: 0, maxUsagePercent: null })
+    const providers = {}
+    for (const p of PROVIDERS) providers[p] = mk()
+    const logged = await store.loggedInProviders()
+    for (const slot of slots) {
+      const pv = providers[slot.provider] || (providers[slot.provider] = mk())
+      pv.slots++
+      if (slot.proxyUrl) pv.proxy++
+      try {
+        const info = await store.describeRef(slot.ref)
+        if (info.configured) pv.configured++
+        if (info.cooldownUntil && info.cooldownUntil > Date.now()) pv.cooldown++
+        if (info.usagePercent != null) pv.maxUsagePercent = Math.max(pv.maxUsagePercent || 0, Math.round(info.usagePercent))
+      } catch {}
+    }
+    for (const p of Object.keys(providers)) providers[p].loggedIn = logged.includes(p)
+    const rows = history.all()
+    const byStatus = {}
+    for (const r of rows) {
+      const k = (r.provider || '?') + ':' + (r.status || '?')
+      byStatus[k] = (byStatus[k] || 0) + 1
+    }
+    const lastErrors = rows.filter((r) => r.status && r.status >= 400).slice(0, 10)
+      .map((r) => ({ ts: r.ts, provider: r.provider, status: r.status, kind: r.kind || 'request', ms: r.ms || null }))
+    return scrubReport({
+      generatedAt: new Date().toISOString(),
+      plugin: NS + (pkgVersion ? ' v' + pkgVersion : ''),
+      runtime: { node: process.version, platform: process.platform, arch: process.arch, uptimeSec: Math.round(process.uptime()) },
+      providers,
+      requests: { total: rows.length, byStatus, lastErrors },
+      settings: {
+        cooldownMs: cfg.cooldownMs,
+        switchAtRemaining: cfg.switchAtRemaining,
+        probeIntervalMin: cfg.probeIntervalMin,
+        useWebCallback: !!cfg.useWebCallback,
+        autoLoopback: !!cfg.autoLoopback,
+        privacyMask: !!cfg.privacyMask,
+        customVendors: Array.isArray(cfg.customVendors) ? cfg.customVendors.length : 0,
+        proxySlots: slots.filter((s) => s.proxyUrl).length,
+      },
+    })
+  }
+
   async function accountsView() {
     const out = []
     for (const slot of normalizeSlots(live().slots)) {
@@ -351,7 +494,7 @@ export function apply(ctx, config) {
         provider: slot.provider,
         index: slot.index,
         ref: slot.ref,
-        label: slot.label || info.label,
+        label: pmL(slot.label || info.label),
         configured: info.configured,
         writable: info.writable,
         cooldownUntil: info.cooldownUntil,
@@ -380,6 +523,7 @@ export function apply(ctx, config) {
 
   ctx.effect(() => {
     syncAdapter().catch(() => { /* first paint */ })
+    syncOllama().catch(() => { /* first paint */ })
     // #75: eager refresh usage на старте, чтобы windows (5h/7d) появились в blob сразу
     // и активная подписка в чипе сразу показывала 5h/7d/..., а не ждала probeInterval.
     const eager = async () => {
@@ -470,7 +614,7 @@ export function apply(ctx, config) {
       await tick()
     }
     wrapped().catch(() => {})
-    const timer = setInterval(() => { wrapped().catch(() => {}) }, 60 * 1000)
+    const timer = setInterval(() => { wrapped().catch(() => {}); syncOllama().catch(() => {}) }, 60 * 1000)
     return () => clearInterval(timer)
   }, 'dsh-subscriptions: probe loop')
 
@@ -541,7 +685,7 @@ export function apply(ctx, config) {
           // #67: дата окончания подписки берётся из слота (вводится в настройках).
           if (slot.expiresAt) {
             expires[slot.provider] = Math.max(expires[slot.provider] || 0, slot.expiresAt)
-            labels[slot.provider] = slot.label || info.label || slot.provider
+            labels[slot.provider] = pmL(slot.label || info.label || slot.provider)
           }
         } catch {}
       }
@@ -586,11 +730,24 @@ export function apply(ctx, config) {
         expiresAt: expires,
         labels,
         expiryNotifyDays: live().expiryNotifyDays,
+        fastMode: !!live().codexFastMode,
         active,
       })
     },
   }), 'dsh-subscriptions: /status')
 
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/diagnostics',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      writeJson(res, 200, { ok: true, report: await diagnosticsReport() })
+    },
+  }), 'dsh-subscriptions: /diagnostics')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/oauth/start',
@@ -620,10 +777,135 @@ export function apply(ctx, config) {
       })
       const cfg = { ...vendorConfig(provider, live()), redirectUri }
       const url = getVendor(provider).authorizeUrl(cfg, pkce)
-      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri })
+      // #89: если redirect_uri loopback — поднять временный сервер перехвата.
+      let autoCatch = false
+      if (live().autoLoopback) {
+        try {
+          const cb = new URL(redirectUri)
+          if (cb.hostname === 'localhost' || cb.hostname === '127.0.0.1') {
+            autoCatch = true
+            startLoopback({
+              redirectUri,
+              onCode: async (params) => {
+                const code = params.get('code') || ''
+                const state = params.get('state') || ''
+                if (!code) throw new Error('no code')
+                await completeOAuth({ provider, index, code, state })
+                return OK_HTML
+              },
+            }).catch(() => {})
+          }
+        } catch { autoCatch = false }
+      }
+      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri, autoCatch })
     },
   }), 'dsh-subscriptions: /oauth/start')
 
+  // #90: Device-code login (headless/VPS). Codex-only: auth.openai.com mints an
+  // authorization_code + code_verifier server-side; we finish with the normal
+  // PKCE exchange using the device redirect URI. Device code stays server-side
+  // in the pending map (same lifetime as PKCE pending rows).
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/device/start',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8'))
+      } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(body.provider || '')
+      const index = Number(body.index || 1)
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const vendor = getVendor(provider)
+      if (typeof vendor.deviceStart !== 'function') {
+        writeJson(res, 400, { ok: false, error: { code: 'device', message: 'device login not supported for ' + provider } })
+        return
+      }
+      try {
+        const cfg = vendorConfig(provider, live())
+        const start = await vendor.deviceStart(cfg, fetch)
+        const state = 'dev-' + Date.now() + '-' + Math.random().toString(36).slice(2, 10)
+        sweepPending(Date.now())
+        pending.set(state, {
+          kind: 'device',
+          provider,
+          index,
+          ref: oauthRef(provider, index),
+          deviceAuthId: start.deviceAuthId,
+          userCode: start.userCode,
+          intervalMs: start.intervalMs,
+          createdAt: Date.now(),
+        })
+        writeJson(res, 200, { ok: true, state, userCode: start.userCode, authUrl: start.authUrl, intervalMs: start.intervalMs })
+      } catch (e) {
+        writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
+      }
+    },
+  }), 'dsh-subscriptions: /oauth/device/start')
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/device/poll',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8'))
+      } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const state = String(body.state || '')
+      sweepPending(Date.now())
+      const row = pending.get(state)
+      if (!row || row.kind !== 'device') {
+        writeJson(res, 404, { ok: false, error: { code: 'expired', message: 'device login session expired; start again' } })
+        return
+      }
+      const vendor = getVendor(row.provider)
+      try {
+        const cfg = vendorConfig(row.provider, live())
+        const out = await vendor.devicePoll(cfg, { deviceAuthId: row.deviceAuthId, userCode: row.userCode }, fetch)
+        if (out.status !== 'authorized') {
+          writeJson(res, 200, { ok: true, status: out.status })
+          return
+        }
+        const slots = normalizeSlots(live().slots)
+        const slot = slots.find((s) => s.ref === row.ref)
+        const blob = out.blob
+        if (slot && slot.label) blob.label = slot.label
+        await store.saveBlob(row.ref, blob)
+        pending.delete(state)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, { ok: true, status: 'authorized', ref: row.ref, label: pmL(blob.label || blob.email) || displayName(row.provider) })
+      } catch (e) {
+        writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
+      }
+    },
+  }), 'dsh-subscriptions: /oauth/device/poll')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/oauth/callback',
@@ -721,7 +1003,7 @@ export function apply(ctx, config) {
       try { blob = await store.ensureFresh(provider, blob, ref) } catch (e) {
         writeJson(res, 200, {
           ok: false, provider, index: payload.index, ref,
-          email: blob.email || '', label: blob.label || '', expiresAt: blob.expiresAt || null,
+          email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: info.quota || null,
           error: { code: 'refresh', message: String(e && e.message || e) },
         })
@@ -729,7 +1011,7 @@ export function apply(ctx, config) {
       }
       const vendor = getVendor(provider)
       if (typeof vendor.check !== 'function') {
-        writeJson(res, 200, { ok: true, provider, index: payload.index, ref, email: blob.email || '', label: blob.label || '', expiresAt: blob.expiresAt || null, quota: info.quota || null })
+        writeJson(res, 200, { ok: true, provider, index: payload.index, ref, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: info.quota || null })
         return
       }
       let capturedQuota = null
@@ -743,11 +1025,11 @@ export function apply(ctx, config) {
       }
       try {
         await vendor.check(blob, vendorConfig(provider, live()), probeFetch)
-        writeJson(res, 200, { ok: true, provider, index: payload.index, ref, email: blob.email || '', label: blob.label || '', expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
+        writeJson(res, 200, { ok: true, provider, index: payload.index, ref, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
       } catch (e) {
         writeJson(res, 200, {
           ok: false, provider, index: payload.index, ref,
-          email: blob.email || '', label: blob.label || '', expiresAt: blob.expiresAt || null,
+          email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: capturedQuota || info.quota || null,
           error: { code: e && e.code ? e.code : 'VENDOR', message: String(e && e.message || e).slice(0, 300) },
         })
@@ -810,6 +1092,64 @@ export function apply(ctx, config) {
     },
   }), 'dsh-subscriptions: proxy')
 
+  // #88: проверка прокси аккаунта — реальный запрос к эндпоинту провайдера с замером задержки.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/proxy-check',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8'))
+      } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(body.provider || '')
+      const index = Number(body.index || 1)
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const slots = normalizeSlots(live().slots)
+      const slot = slots.find((s) => s.provider === provider && s.index === index)
+      const proxyUrl = (slot && slot.proxyUrl) || ''
+      const DEFAULT_BASE = {
+        codex: 'https://chatgpt.com/backend-api/codex',
+        claude: 'https://api.anthropic.com',
+        grok: 'https://api.x.ai/v1',
+        antigravity: 'https://cloudcode-pa.googleapis.com',
+      }
+      const base = String((vendorConfig(provider, live()) || {}).baseUrl || DEFAULT_BASE[provider] || '').replace(/\/$/, '')
+      const started = Date.now()
+      try {
+        const impl = (proxyUrl && proxyFetch(proxyUrl)) || fetch
+        if (proxyUrl && impl === fetch) throw new Error('invalid proxy URL')
+        const out = await impl(base + '/models', {
+          method: 'GET',
+          headers: { Accept: 'application/json' },
+          signal: AbortSignal.timeout(10000),
+        })
+        // Любой HTTP-ответ (включая 401/403) = прокси и эндпоинт доступны.
+        writeJson(res, 200, { ok: true, status: out.status, latencyMs: Date.now() - started, viaProxy: !!proxyUrl })
+      } catch (e) {
+        writeJson(res, 200, {
+          ok: false,
+          latencyMs: Date.now() - started,
+          viaProxy: !!proxyUrl,
+          error: { code: (e && e.code) || 'NETWORK', message: String((e && e.message) || e).slice(0, 200) },
+        })
+      }
+    },
+  }), 'dsh-subscriptions: proxy-check')
+
   // Экспорт зашифрованного бандла токенов. Токены не логгируются.
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',

package/lib/loopback.js

@@ -0,0 +1,66 @@
+import http from 'node:http'
+
+// #89: временный loopback-сервер для перехвата OAuth callback.
+// Слушает на зарегистрированном у провайдера redirect_uri (порт фиксирован
+// вендором: codex localhost:1455, grok 127.0.0.1:56121). Принимает GET с
+// code/state, отдаёт HTML-страницу и завершается после первого запроса.
+
+const OK_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Signed in. You can close this tab and return to Settings.</p>'
+const ERR_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Login failed. Return to Settings and paste the redirected URL.</p>'
+
+/**
+ * Поднять loopback-сервер и дождаться callback.
+ * @param {object} opts
+ * @param {string} opts.redirectUri  зарегистрированный redirect_uri (localhost/127.0.0.1)
+ * @param {number} opts.timeoutMs    время жизни сервера
+ * @param {(query: URLSearchParams) => Promise<string>} opts.onCode
+ *        вызывается с query callback-запроса; возвращает HTML для браузера.
+ *        Бросок исключения = ошибка авторизации (отдаётся ERR_HTML).
+ * @returns {Promise<{url: string, close: () => void}>}
+ */
+export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode }) {
+  const parsed = new URL(redirectUri)
+  if (parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {
+    throw new Error(`loopback redirect requires localhost, got ${parsed.hostname}`)
+  }
+  const port = Number(parsed.port) || 80
+  const path = parsed.pathname
+
+  const state = { server: null, timer: null, done: false }
+  const promise = new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url || '/', `http://127.0.0.1:${port}`)
+      // Провайдер может редиректить на путь с suffix (например /auth/callback/extra)
+      if (!url.pathname.startsWith(path)) {
+        res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' })
+        res.end(ERR_HTML)
+        return
+      }
+      if (state.done) return
+      state.done = true
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+      Promise.resolve(onCode(url.searchParams))
+        .then((html) => res.end(html || OK_HTML))
+        .catch(() => res.end(ERR_HTML))
+        .finally(() => {
+          clearTimeout(state.timer)
+          server.close()
+          resolve({ ok: true })
+        })
+    })
+    server.on('error', (err) => {
+      state.done = true
+      clearTimeout(state.timer)
+      reject(err)
+    })
+    state.server = server
+    server.listen(port, parsed.hostname, () => {})
+    state.timer = setTimeout(() => {
+      if (state.done) return
+      state.done = true
+      server.close()
+      reject(new Error('loopback timeout: no callback received'))
+    }, timeoutMs)
+  })
+  return promise
+}

package/lib/mask.js

@@ -0,0 +1,21 @@
+// #98: privacy masking. Emails -> j***n@example.com. Non-email labels pass through.
+export function maskEmail(value) {
+  const s = String(value || '')
+  const at = s.indexOf('@')
+  if (at <= 0) return s
+  const local = s.slice(0, at)
+  const tail = local.length > 2 ? local[local.length - 1] : ''
+  return local[0] + '***' + tail + s.slice(at)
+}
+
+export function maskLabel(value) {
+  const s = String(value || '')
+  return s.includes('@') ? maskEmail(s) : s
+}
+
+const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g
+
+// #99: scrub free-text (error messages, notes): mask embedded emails only.
+export function maskText(value) {
+  return String(value || '').replace(EMAIL_RE, (m) => maskEmail(m))
+}

package/lib/messages.js

@@ -65,7 +65,7 @@ export function openaiTools(options) {
   }))
 }
 
-export function codexResponsesBody(options, fallbackInstructions) {
+export function codexResponsesBody(options, fallbackInstructions, vendorCfg) {
   const systemParts = []
   if (options.system) systemParts.push(options.system)
   const input = []
@@ -134,6 +134,13 @@ export function codexResponsesBody(options, fallbackInstructions) {
     instructions,
     input,
     ...(responsesTools && responsesTools.length ? { tools: responsesTools } : {}),
+    // #93: reasoning effort chosen in the native picker flows to the protocol.
+    ...(options.reasoningEffort ? { reasoning: { effort: String(options.reasoningEffort) } } : {}),
+    // #93: verbosity comes from the codexVerbosity setting (low/medium/high).
+    ...(vendorCfg && /^(low|medium|high)$/.test(String(vendorCfg.verbosity || ''))
+      ? { text: { verbosity: String(vendorCfg.verbosity) } } : {}),
+    // #92: Fast Mode = 1.5x speed billing tier on the Codex backend.
+    ...(vendorCfg && vendorCfg.fastMode ? { service_tier: 'priority' } : {}),
     ...(options.maxTokens != null ? { max_output_tokens: options.maxTokens } : {}),
     ...(options.temperature != null ? { temperature: options.temperature } : {}),
   }