@goodandready/dsh-subscriptions 0.6.0 → 0.6.1

package/lib/index.js

@@ -61,8 +61,8 @@ export function apply(ctx, config) {
     })
   })
 
-  // Регистрация кастомных вендоров из Config. Вызывается при старте и при
-  // каждой смене конфига (replace) — реестр пересобирается с нуля.
+  // Registering custom vendors from Config. Runs at startup and on
+  // every config change (replace) - the registry is rebuilt from scratch.
   function syncCustomVendors() {
     let profiles
     try {
@@ -104,7 +104,7 @@ export function apply(ctx, config) {
     onLimitNotice: (provider, ref, win, threshold) => {
       if (!live().notifyLimits) return
       const label = win.ru || win.en || win.id
-      try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider} ${ref}: лимит ${label} на ${threshold}%`) } catch {}
+      try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider} ${ref}: limit ${label} at ${threshold}%`) } catch {}
       try { ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }) } catch {}
     },
   })
@@ -141,7 +141,7 @@ export function apply(ctx, config) {
     if (!cfg.ollamaFallback || !models.length) throw err
     const model = cfg.ollamaFallbackModel || models[0].id
     try { ctx.emit && ctx.emit('subscriptions.ollama-fallback', { provider, model, reason: err && err.code || 'EXHAUSTED' }) } catch {}
-    try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider}: все аккаунты исчерпаны (${err && err.code || 'EXHAUSTED'}), откат на ollama/${model}`) } catch {}
+    try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider}: all accounts exhausted (${err && err.code || 'EXHAUSTED'}), откат на ollama/${model}`) } catch {}
     try {
       recordHistory({
         provider: 'ollama',
@@ -181,15 +181,15 @@ export function apply(ctx, config) {
     hideDeprecatedModels: () => !!live().hideDeprecatedModels,
   })
 
-  // Служба генерации картинок на подписке.
+  // Subscription-backed image generation service.
   //
-  // Наружу отдаётся действие, а не токен: маршрут в сети раздавал бы живой
-  // ключ доступа каждому, кто дотянется до харнесса, а служба живёт внутри
-  // процесса и видна только другим плагинам. Обновлением токена по-прежнему
-  // занимается один хозяин — этот плагин.
+  // An action is exposed, not a token: a network route would hand a live
+  // access key to anyone reaching the harness, while the service lives inside
+  // the process and is visible only to sibling plugins. Token refresh stays
+  // with a single owner - this plugin.
   ctx.effect(() => ctx.provide('subscriptions', subscriptions), 'dsh-subscriptions: subscriptions service')
   ctx.effect(() => ctx.provide('subscriptionImages', {
-    /** Провайдеры, у которых есть вход прямо сейчас. */
+    /** Providers with an active session right now. */
     async available() {
       const logged = await store.loggedInProviders()
       return ['codex', 'grok'].filter((name) => logged && logged[name])
@@ -202,13 +202,13 @@ export function apply(ctx, config) {
     async generate(request) {
       const provider = request && request.provider
       if (provider !== 'codex' && provider !== 'grok') {
-        throw new Error(`неизвестный провайдер подписки: ${provider}`)
+        throw new Error(`unknown subscription provider: ${provider}`)
       }
       const accounts = await store.listAccounts(provider)
       const slot = (accounts || []).find((row) => row && row.ref)
-      if (!slot) throw new Error(`нет входа в ${provider}: войдите в разделе «Подписки»`)
+      if (!slot) throw new Error(`not logged in to ${provider}: sign in in the Subscriptions section`)
       const raw = await store.resolveRaw(slot.ref)
-      if (!raw) throw new Error(`нет входа в ${provider}: войдите в разделе «Подписки»`)
+      if (!raw) throw new Error(`not logged in to ${provider}: sign in in the Subscriptions section`)
       const session = await store.ensureFresh(provider, parseBlob(raw), slot.ref)
       return generateOnce({
         provider,
@@ -220,7 +220,7 @@ export function apply(ctx, config) {
         signal: request.signal,
       })
     },
-  }), 'dsh-subscriptions: служба генерации картинок')
+  }), 'dsh-subscriptions: image generation service')
   const pending = new Map()
   const adapter = new SubscriptionAdapter({
     listAccounts: (provider) => store.listAccounts(provider),
@@ -466,8 +466,8 @@ export function apply(ctx, config) {
   ctx.effect(() => {
     syncAdapter().catch(() => { /* first paint */ })
     syncOllama().catch(() => { /* first paint */ })
-    // #75: eager refresh usage на старте, чтобы windows (5h/7d) появились в blob сразу
-    // и активная подписка в чипе сразу показывала 5h/7d/..., а не ждала probeInterval.
+    // #75: eager usage refresh at startup so the windows (5h/7d) land in the blob immediately
+    // and the active subscription chip shows 5h/7d/... right away instead of waiting for probeInterval.
     const eager = async () => {
       try {
         for (const slot of normalizeSlots(live().slots)) {
@@ -516,9 +516,9 @@ export function apply(ctx, config) {
     return () => clear(id)
   }, 'dsh-subscriptions: refresh ahead')
 
-  // Фоновый health-check: раз в N минут прогоняет дешёвый check по всем
-  // подключённым аккаунтам. Мёртвые помечаются через describeRef, cooldown
-  // не ставится (как в /check).
+  // Background health-check: every N minutes runs a cheap check across all
+  // connected accounts. Dead ones are flagged via describeRef, no cooldown
+  // is set (same as /check).
   ctx.effect(() => {
     const tick = async () => {
       const cfg = live()

package/lib/loopback.js

@@ -1,21 +1,21 @@
 import http from 'node:http'
 
-// #89: временный loopback-сервер для перехвата OAuth callback.
-// Слушает на зарегистрированном у провайдера redirect_uri (порт фиксирован
-// вендором: codex localhost:1455, grok 127.0.0.1:56121). Принимает GET с
-// code/state, отдаёт HTML-страницу и завершается после первого запроса.
+// #89: temporary loopback server to catch the OAuth callback.
+// Listens on the redirect_uri registered with the provider (vendor-fixed
+// port: codex localhost:1455, grok 127.0.0.1:56121). Accepts a GET with
+// code/state, serves an HTML page and shuts down after the first request.
 
 const OK_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Signed in. You can close this tab and return to Settings.</p>'
 const ERR_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Login failed. Return to Settings and paste the redirected URL.</p>'
 
 /**
- * Поднять loopback-сервер и дождаться callback.
+ * Start the loopback server and wait for the callback.
  * @param {object} opts
- * @param {string} opts.redirectUri  зарегистрированный redirect_uri (localhost/127.0.0.1)
- * @param {number} opts.timeoutMs    время жизни сервера
+ * @param {string} opts.redirectUri  registered redirect_uri (localhost/127.0.0.1)
+ * @param {number} opts.timeoutMs    server lifetime
  * @param {(query: URLSearchParams) => Promise<string>} opts.onCode
- *        вызывается с query callback-запроса; возвращает HTML для браузера.
- *        Бросок исключения = ошибка авторизации (отдаётся ERR_HTML).
+ *        called with the callback request query; returns HTML for the browser.
+ *        Throwing means an authorization error (ERR_HTML is served).
  * @returns {Promise<{url: string, close: () => void}>}
  */
 export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode }) {
@@ -30,7 +30,7 @@ export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode
   const promise = new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || '/', `http://127.0.0.1:${port}`)
-      // Провайдер может редиректить на путь с suffix (например /auth/callback/extra)
+      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra)
       if (!url.pathname.startsWith(path)) {
         res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' })
         res.end(ERR_HTML)

package/lib/ratelimit.js

@@ -212,7 +212,7 @@ export function formatQuota(q) {
   if (!q) return ""
   const parts = []
   if (q.remaining!=null && q.limit!=null) parts.push(q.remaining+"/"+q.limit)
-  else if (q.remaining!=null) parts.push("осталось "+q.remaining)
-  if (q.resetAt) parts.push("сброс "+new Date(q.resetAt).toLocaleString())
+  else if (q.remaining!=null) parts.push("left "+q.remaining)
+  if (q.resetAt) parts.push("reset "+new Date(q.resetAt).toLocaleString())
   return parts.join(" · ")
 }

package/lib/refs.js

@@ -1,4 +1,4 @@
-// Встроенные провайдеры + динамические из Config.customVendors.
+// Built-in providers + dynamic ones from Config.customVendors.
 export const BUILTIN_PROVIDERS = Object.freeze([
   'codex',
   'claude',
@@ -8,6 +8,14 @@ export const BUILTIN_PROVIDERS = Object.freeze([
   'glm',
   'cursor',
   'kiro',
+  'copilot',
+  'qwen',
+  'ernie',
+  'spark',
+  'jetbrains',
+  'perplexity',
+  'replit',
+  'cody',
 ])
 
 const dynamicIds = new Set()

package/lib/routes/accounts.js

@@ -0,0 +1,343 @@
+import { normalizeSlots } from '../accounts.js'
+import { Config, publicConfig } from '../config-schema.js'
+import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
+import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
+import { isProvider, oauthRef } from '../refs.js'
+
+export function registerAccountsRoutes(ctx, state) {
+  const {
+    live,
+    accountsView,
+    getSettingsApi,
+    syncCustomVendors,
+    syncAdapter,
+    stripLegacySlots,
+    store,
+    refreshModels,
+    refForSlot,
+    resetCredits,
+    subscriptions,
+  } = state
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/reset-credits',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      const q = queryOf(req)
+      const provider = q.get('provider') || ''
+      const index = Number(q.get('index') || '1')
+      const ref = refForSlot(provider, index)
+      if (!ref) { writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } }); return }
+      try {
+        writeJson(res, 200, { ok: true, ...(await resetCredits.inspect(ref)) })
+      } catch (e) {
+        writeJson(res, 200, { ok: false, error: { code: 'reset', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /reset-credits')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/reset-credits/prepare',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 4096)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const ref = refForSlot(String(payload.provider || ''), Number(payload.index) || 1)
+      if (!ref) { writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } }); return }
+      try {
+        writeJson(res, 200, { ok: true, ...(await resetCredits.prepare(ref)) })
+      } catch (e) {
+        writeJson(res, 200, { ok: false, error: { code: 'reset', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /reset-credits/prepare')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/reset-credits/consume',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 4096)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      try {
+        const result = await resetCredits.consume({ challengeId: payload.challengeId, acknowledged: payload.acknowledged })
+        writeJson(res, 200, { ok: true, result })
+        refreshModels().catch(() => {})
+      } catch (e) {
+        writeJson(res, 200, { ok: false, error: { code: 'reset', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /reset-credits/consume')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/discover-local',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      try {
+        const detected = await discoverLocalCliSessions()
+        writeJson(res, 200, { ok: true, detected })
+      } catch (e) {
+        writeJson(res, 500, { ok: false, error: { message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /discover-local')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import-local',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8') || '{}')
+      } catch {
+        body = null
+      }
+      if (!body || !body.provider) {
+        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'missing provider' } })
+        return
+      }
+      try {
+        const blob = await loadLocalCliBlob(body.provider)
+        const prov = body.provider
+        const idx = Number(body.index) || 1
+        const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
+        const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
+        if (!exists && getSettingsApi()) {
+          const nextSlots = curSlots.concat([{
+            provider: prov,
+            index: idx,
+            label: blob.email || '',
+          }])
+          const parsed = Config({ ...live(), slots: stripLegacySlots(nextSlots) })
+          await getSettingsApi().replace(parsed)
+          syncCustomVendors()
+        }
+        const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
+        const ref = slot ? slot.ref : `${prov.toUpperCase()}_OAUTH_${idx}`
+        await store.saveBlob(ref, blob)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, {
+          ok: true,
+          ref,
+          provider: prov,
+          email: blob.email || '',
+          accounts: await accountsView(),
+          config: publicConfig(live()),
+        })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /import-local')
+
+
+  // Export of the encrypted token bundle. Tokens are never logged.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/export',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const passphrase = payload.passphrase
+      if (!passphrase || typeof passphrase !== 'string') {
+        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase is required' } })
+        return
+      }
+      try {
+        const accounts = []
+        for (const slot of normalizeSlots(live().slots)) {
+          try {
+            const blob = await store.loadBlob(slot.ref)
+            accounts.push({ ref: slot.ref, provider: slot.provider, index: slot.index, label: slot.label || blob.label || '', blob })
+          } catch { /* skip missing */ }
+        }
+        if (!accounts.length) {
+          writeJson(res, 200, { ok: false, error: { code: 'empty', message: 'no connected accounts' } })
+          return
+        }
+        const bundle = JSON.stringify({ v: 1, exportedAt: Date.now(), accounts })
+        const encrypted = encryptWithPassphrase(bundle, passphrase)
+        writeJson(res, 200, { ok: true, payload: encrypted, count: accounts.length })
+      } catch (e) {
+        writeJson(res, 500, { ok: false, error: { code: 'export', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /export')
+
+
+  // Import of the encrypted bundle.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 1024 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const { passphrase, payload: encrypted } = payload
+      if (!passphrase || !encrypted) {
+        writeJson(res, 400, { ok: false, error: { code: 'params', message: 'passphrase and payload are required' } })
+        return
+      }
+      let bundle
+      try {
+        bundle = JSON.parse(decryptWithPassphrase(encrypted, passphrase))
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'decrypt', message: 'wrong passphrase or corrupted bundle' } })
+        return
+      }
+      if (!bundle || !Array.isArray(bundle.accounts)) {
+        writeJson(res, 400, { ok: false, error: { code: 'format', message: 'invalid bundle format' } })
+        return
+      }
+      let imported = 0
+      for (const row of bundle.accounts) {
+        try {
+          await store.saveBlob(row.ref, row.blob)
+          imported++
+        } catch { /* skip broken */ }
+      }
+      await syncAdapter()
+      writeJson(res, 200, { ok: true, imported, total: bundle.accounts.length, accounts: await accountsView() })
+    }),
+  }), 'dsh-subscriptions: /import')
+
+
+  // #45: import an existing refresh token / API key without an OAuth flow.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import-token',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = payload.provider
+      const index = Number(payload.index || '1')
+      const refreshToken = payload.refreshToken
+      const apiKey = payload.apiKey
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      if (!refreshToken && !apiKey) {
+        writeJson(res, 400, { ok: false, error: { code: 'token', message: 'refreshToken or apiKey is required' } })
+        return
+      }
+      try {
+        const ref = oauthRef(provider, index)
+        const blob = { accessToken: apiKey || refreshToken, refreshToken: refreshToken || apiKey }
+        if (apiKey) { blob.apiKey = apiKey; blob.apiKeyOnly = true }
+        await store.saveBlob(ref, blob)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'import', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /import-token')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/logout',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      try {
+        const ref = oauthRef(payload.provider, payload.index)
+        await store.clearRef(ref)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'logout', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /logout')
+}