@goodandready/dsh-subscriptions 0.6.10 → 0.6.11

package/README.md

@@ -272,6 +272,14 @@ Supports Anthropic's adaptive thinking (`thinking: { type: "adaptive" }`) and re
 
 ---
 
+## 🔒 OAuth Client Validation & Route Updates (Added in v0.6.11)
+
+- **OAuth Client ID Guard (GitHub #2)**: uildAuthorizeUrl and ntigravity.authorizeUrl now strictly require a non-empty clientId. If unconfigured, the endpoint returns an explicit HTTP 400 (missing_client_id) and the UI prompts the user to configure ntigravityClientId in plugin settings or use "From CLI" instead of directing the browser to a failing Google OAuth page.
+- **Config Schema Secret Key**: Added ntigravityClientSecret to the plugin configuration schema, allowing convenient entry of private client secrets alongside ntigravityClientId with automatic masking in public endpoints.
+- **Zhipu GLM Console Route Migration (GitHub #3)**: Updated the Zhipu GLM authorization and API key center link to the active console route (https://bigmodel.cn/usercenter/proj-mgmt/apikeys), eliminating 404 navigation errors caused by vendor console restructuring.
+
+---
+
 ## 🛡️ Reliability & Quality Hardening (Added in v0.6.10)
 
 - **Structured Error Handling**: Eliminated all empty catch blocks across the plugin runtime via safe `bestEffort` helper logging debug diagnostics.

package/README.ru.md

@@ -245,6 +245,14 @@ dsh-subscriptions:
 
 ---
 
+## 🔒 Защита OAuth Client ID и обновление ссылок (Добавлено в v0.6.11)
+
+- **Защита OAuth Client ID (GitHub #2)**: uildAuthorizeUrl и ntigravity.authorizeUrl теперь строго требуют непустой clientId. Если параметр не задан, сервер возвращает явный код ошибки HTTP 400 (missing_client_id), а интерфейс выводит подсказку с предложением указать ntigravityClientId в настройках или нажать «📥 Из CLI», предотвращая отправку битых запросов в Google OAuth.
+- **Секретный ключ в схеме настроек**: В схему Config добавлено поле ntigravityClientSecret для удобного ввода Client Secret рядом с ntigravityClientId с автоматическим маскированием в публичном API.
+- **Актуализация маршрута Zhipu GLM (GitHub #3)**: Ссылка на консоль API-ключей Zhipu GLM обновлена на актуальный адрес (https://bigmodel.cn/usercenter/proj-mgmt/apikeys), устраняя ошибку 404 («页面跑丢啦！！»), вызванную миграцией маршрутов вендора.
+
+---
+
 ## 🛡️ Надежность и стандарты качества (Добавлено в v0.6.10)
 
 - **Структурированная обработка ошибок**: Устранены все пустые блоки catch в рантайме плагина с переходом на безопасный хелпер `bestEffort` с диагностическим логированием.

package/README.zh.md

@@ -167,6 +167,14 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 ---
 
+## 🔒 OAuth Client ID 校验保护与控制台地址更新 (v0.6.11 新增)
+
+- **Google OAuth Client ID 校验保护 (GitHub #2)**：uildAuthorizeUrl 和 ntigravity.authorizeUrl 严格要求非空 clientId。未配置时服务端返回明确的 HTTP 400 (missing_client_id)，前端界面提示用户在插件设置中填写 ntigravityClientId 或使用“📥 从 CLI 导入”，避免浏览器跳转至 Google OAuth 400 报错页面。
+- **配置架构新增密钥项**：在插件 Config 架构中新增 ntigravityClientSecret，方便用户在设置中配置客户端密钥，并在公共接口中自动脱敏脱密。
+- **智谱 GLM 控制台地址迁移 (GitHub #3)**：将智谱 GLM 授权与 API Key 获取链接更新为最新控制台有效路由 (https://bigmodel.cn/usercenter/proj-mgmt/apikeys)，彻底解决因服务商控制台路由调整导致的 404 错误。
+
+---
+
 ## 🛡️ 稳定性与代码质量强化 (v0.6.10 新增)
 
 - **结构化异常降级**: 全面移除运行时空 catch 块，统一采用带诊断日志的 `bestEffort` 安全兜底机制。

package/lib/client.js

@@ -292,7 +292,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           "3. 粘贴到输入框中并点击 \"保存令牌\"。",
           "4. 若已安装 ZCode CLI (~/.zcode)，点击 \"📥 从 CLI 导入\" 即可自动导入。",
         ],
-        link: "https://open.bigmodel.cn/usercenter/apikeys",
+        link: "https://bigmodel.cn/usercenter/proj-mgmt/apikeys",
       },
       grok: {
         title: "xAI Grok",
@@ -434,6 +434,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "fcMinutes": "m",
       "reconnect": "Reconnect",
       "connect": "Connect",
+      "missingClientIdAntigravity": "Google OAuth requires a custom Client ID. Please configure antigravityClientId in plugin settings below, or click '📥 From CLI' to import active credentials.",
       "disconnect": "Disconnect",
       "removeSlot": "Remove slot",
       "pastePlaceholder": "Paste redirected URL or code",
@@ -603,6 +604,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "fcMinutes": "分",
       "reconnect": "重新连接",
       "connect": "连接",
+      "missingClientIdAntigravity": "Google OAuth 需要自定义 Client ID。请在下方设置中配置 antigravityClientId，或点击‘📥 从 CLI 导入’直接导入本地会话。",
       "disconnect": "断开连接",
       "removeSlot": "移除槽位",
       "pastePlaceholder": "粘贴重定向 URL 或授权代码",
@@ -985,6 +987,10 @@ const cssId = 'dsh-subscriptions/settings.module.css'
 
       const connect = async (provider, index) => {
         setErr('')
+        if (provider === 'antigravity' && (!draft || !draft.antigravityClientId || !String(draft.antigravityClientId).trim())) {
+          setErr(t('missingClientIdAntigravity'))
+          return
+        }
         const res = await fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(provider) + '&index=' + encodeURIComponent(index), { cache: 'no-store' })
         const data = await res.json().catch(() => ({}))
         if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))

package/lib/config-schema.js

@@ -64,6 +64,8 @@ export const Config = z.object({
   grokClientVersion: z.string().default('')
     .description('Grok CLI identity version header. Empty uses the built-in default.'),
   antigravityClientId: z.string().default(''),
+  antigravityClientSecret: z.string().default('')
+    .description('Google Cloud OAuth Client Secret for Antigravity.'),
   antigravityRedirectUri: z.string().default(''),
   customVendors: z.array(z.any()).default([])
     .description('Declarative OpenAI-Responses-compatible providers. See README.'),

package/lib/oauth.js

@@ -7,6 +7,9 @@ export function buildAuthorizeUrl({
   extra,
   scope,
 }) {
+  if (!clientId || typeof clientId !== 'string' || !clientId.trim()) {
+    throw new Error('Missing required parameter: clientId')
+  }
   const url = new URL(authUrl)
   url.searchParams.set('response_type', 'code')
   url.searchParams.set('client_id', clientId)

package/lib/routes/oauth.js

@@ -51,7 +51,20 @@ export function registerOauthRoutes(ctx, state) {
         createdAt: Date.now(),
       })
       const cfg = { ...vendorConfig(provider, live()), redirectUri }
-      const url = getVendor(provider).authorizeUrl(cfg, pkce)
+      let url
+      try {
+        url = getVendor(provider).authorizeUrl(cfg, pkce)
+      } catch (err) {
+        pending.delete(pkce.state)
+        writeJson(res, 400, {
+          ok: false,
+          error: {
+            code: 'missing_client_id',
+            message: err.message || 'OAuth authorization configuration error',
+          },
+        })
+        return
+      }
       // #89: if redirect_uri is loopback - start a temporary catch server.
       let autoCatch = false
       if (live().autoLoopback) {

package/lib/vendors/antigravity.js

@@ -52,6 +52,9 @@ export function defaults() {
 }
 
 export function authorizeUrl(cfg, pkce) {
+  if (!cfg || !cfg.clientId || !String(cfg.clientId).trim()) {
+    throw new Error('Google OAuth requires a custom Client ID. Please configure antigravityClientId in plugin settings or use "From CLI" to import active credentials.')
+  }
   return buildAuthorizeUrl({
     authUrl: AUTH,
     clientId: cfg.clientId,

package/lib/vendors/glm.js

@@ -47,7 +47,7 @@ export function defaults() {
 }
 
 export function authorizeUrl() {
-  return 'https://open.bigmodel.cn/usercenter/apikeys'
+  return 'https://bigmodel.cn/usercenter/proj-mgmt/apikeys'
 }
 
 export async function listModels(_blob, cfg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",