@goodandready/dsh-subscriptions 0.6.14 → 0.6.16

package/lib/accounts.js

@@ -2,7 +2,7 @@ import { fetchWithTimeout } from "./http.js"
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { oauthRef, isProvider } from './refs.js'
 import { parseBlob, serializeBlob } from './blob.js'
-import { recordSwitch, recordExhaust, recordBroken } from './health.js'
+import { recordSwitch, recordExhaust, recordBroken, computeHealthScore } from './health.js'
 import { executeWithRetry } from './backoff.js'
 import { getVendor } from './vendors/index.js'
 
@@ -177,6 +177,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         cooldownUntil: info.cooldownUntil,
         cooldownFamilies: info.cooldownFamilies || null,
         quota: info.quota || null,
+        healthScore: computeHealthScore(info.health),
         quarantineUntil: inQ ? q.until : 0,
         quarantineReason: inQ ? q.reason : null,
         label: slot.label || info.label,

package/lib/adapter.js

@@ -99,7 +99,10 @@ export class SubscriptionAdapter extends LlmAdapter {
     let yieldedAny = false
     try {
       if (typeof deps.refreshUsage === 'function') {
-        await deps.refreshUsage(provider)
+        try {
+          const p = deps.refreshUsage(provider)
+          if (p && typeof p.catch === 'function') p.catch(() => {})
+        } catch { /* fire-and-forget background usage refresh */ }
       }
       for await (const event of streamWithRotation({
         accounts: await deps.listAccounts(provider),
@@ -108,7 +111,7 @@ export class SubscriptionAdapter extends LlmAdapter {
         switchAtRemaining: typeof deps.switchAtRemaining === 'function' ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0),
         options,
         onCooldown: (account) => {
-          deps.rememberCooldown(account.ref, account.cooldownUntil, account.cooldownFamilies || null)
+          if (typeof deps.rememberCooldown === 'function') deps.rememberCooldown(account.ref, account.cooldownUntil, account.cooldownFamilies || null)
           if (typeof deps.recordSwitch === 'function') deps.recordSwitch(account.ref)
         },
         streamOnce: async function* (account, opts) {

package/lib/client.js

@@ -1838,7 +1838,22 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       // and collapse instead of a row in the side list. The registration key must
       // equal the settings namespace, otherwise the tab silently hides the slot.
       try {
-        // Row seat first (the seat the current core renders), legacy seat after it.
+        // Plugin-list seat (plugins.item) first: the seat the current core
+        // (0.1.6-alpha.2) renders as the plugin's own page with its configuration. The
+        // label is a static string on purpose — it is resolved while the page renders,
+        // and a locale lookup there would take the whole client batch down with it.
+        ctx.slots.inject('plugins.item', () => ctx.slots.register(
+          {
+            name: 'plugins.item',
+            id: ROW_ID,
+            order: 60,
+            label: () => 'Subscriptions',
+            locale: NS,
+            inject: () => ({ ctx: ctx }),
+          },
+          PluginCard,
+        ))
+        // Row seat and the legacy seat stay as fallbacks.
         ctx.slots.inject('plugins.row.config', () => ctx.slots.register(
           {
             name: 'plugins.row.config',

package/lib/http.js

@@ -42,7 +42,35 @@ export function isLoopback(value) {
  * @returns {boolean}
  * Reject cross-site writes. Do not require loopback: Web UI is used over LAN and reverse proxies. */
 export function isTrustedSettingsRequest(request) {
-  return request.headers['sec-fetch-site'] !== 'cross-site'
+  const headers = request?.headers || {}
+  const secFetchSite = headers['sec-fetch-site']
+  if (secFetchSite) {
+    return secFetchSite !== 'cross-site'
+  }
+  const host = headers.host || headers['x-forwarded-host']
+  const origin = headers.origin
+  if (origin) {
+    try {
+      const u = new URL(origin)
+      if (host && u.host.toLowerCase() !== host.toLowerCase()) {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+  const referer = headers.referer
+  if (!origin && referer) {
+    try {
+      const u = new URL(referer)
+      if (host && u.host.toLowerCase() !== host.toLowerCase()) {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+  return true
 }
 
 export function queryOf(req) {

package/lib/index.js

@@ -26,7 +26,9 @@ import { OllamaAdapter, ollamaAlive, ollamaModels, ollamaBase } from './ollama.j
 import { createResetCreditService } from './reset-credits.js'
 import { maskEmail, maskLabel, maskText } from './mask.js'
 import { proxyFetch, pickFetch } from './proxy.js'
-import { HistoryStore } from './history.js'
+import { HistoryStore, DEFAULT_HISTORY_DIR } from './history.js'
+export { observeForecast, estimateForecast } from './forecast.js'
+export { formatRelativeReset } from './relative-time.js'
 import {
   inspectGoogleAccount,
   antigravityMetadata,
@@ -116,7 +118,7 @@ export function apply(ctx, config) {
       bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
-  const history = new HistoryStore()
+  const history = new HistoryStore(DEFAULT_HISTORY_DIR, 7 * 24 * 60 * 60 * 1000, 1000)
   const recordHistory = (entry) => history.add(entry)
 
   // #85: host-only reset credit service for Codex accounts.
@@ -324,18 +326,24 @@ export function apply(ctx, config) {
       const existing = normalizeSlots(live().slots)
       const existingRefs = new Set(existing.map((s) => s.ref))
       const candidateProviders = PROVIDERS.filter((p) => isProvider(p))
-      const additions = []
-
+      const candidates = []
       for (const provider of candidateProviders) {
         for (let index = 1; index <= 10; index++) {
           const ref = oauthRef(provider, index)
-          if (existingRefs.has(ref)) continue
+          if (!existingRefs.has(ref)) {
+            candidates.push({ provider, index, ref })
+          }
+        }
+      }
+
+      const additionResults = await Promise.all(
+        candidates.map(async ({ provider, index, ref }) => {
           let d
           try {
             d = await creds.describe(credentialRef(ref))
           } catch (err) {
             if (logger && logger.debug) logger.debug(`[dsh-subscriptions reconcile] describe ${ref} error: ` + (err && err.message || err))
-            continue
+            return null
           }
           if (d && d.configured) {
             let label = d.label || ''
@@ -347,10 +355,12 @@ export function apply(ctx, config) {
             } catch (loadErr) {
               if (logger && logger.debug) logger.debug(`[dsh-subscriptions reconcile] loadBlob ${ref} error: ` + (loadErr && loadErr.message || loadErr))
             }
-            additions.push({ provider, index, label })
+            return { provider, index, label }
           }
-        }
-      }
+          return null
+        })
+      )
+      const additions = additionResults.filter(Boolean)
 
       if (!additions.length) return
       if (logger && logger.info) {
@@ -700,7 +710,7 @@ export function apply(ctx, config) {
           const vendor = getVendor(slot.provider)
           if (typeof vendor.check !== 'function') continue
           const cfg2 = vendorConfig(slot.provider, live())
-          const probeFetch = async (u, i) => fetch(u, i)
+          const probeFetch = async (u, i) => ((typeof fetchForRef === 'function' && fetchForRef(ref)) || fetch)(u, i)
           await vendor.check(fresh, cfg2, probeFetch).catch((e) => {
             if (logger && logger.warn) logger.warn("[dsh-subscriptions] probe " + ref + ": " + String(e && e.message || e).slice(0, 200))
           })

package/lib/reset-credits.js

@@ -64,6 +64,14 @@ export function parseConsumeResult(raw) {
 export function createResetCreditService({ loadBlob, fetchImpl, now = Date.now, randomId = randomUUID }) {
   const challenges = new Map()
 
+  function pruneChallenges(nowMs = now()) {
+    for (const [id, ch] of challenges.entries()) {
+      if (nowMs > ch.expiresAt) {
+        challenges.delete(id)
+      }
+    }
+  }
+
   async function readDetails(ref) {
     const blob = await loadBlob(ref)
     const access = blob && blob.accessToken
@@ -101,6 +109,7 @@ export function createResetCreditService({ loadBlob, fetchImpl, now = Date.now,
     async prepare(ref) {
       const { accountId, details } = await readDetails(ref)
       const preparedAt = now()
+      pruneChallenges(preparedAt)
       const readyAt = preparedAt + CONFIRM_DELAY_MS
       const expiresAt = Math.min(preparedAt + CHALLENGE_TTL_MS, details.creditExpiresAt === undefined ? Number.MAX_SAFE_INTEGER : details.creditExpiresAt)
       if (expiresAt <= readyAt) throw new Error('the available reset expires too soon')

package/lib/routes/status.js

@@ -18,6 +18,7 @@ export function registerStatusRoutes(ctx, state) {
     diagnosticsReport,
     pmL = (s) => s,
     pmE = (s) => s,
+    fetchForRef,
   } = state
 
   async function configResponse() {
@@ -213,7 +214,8 @@ export function registerStatusRoutes(ctx, state) {
       const probeFetch = async (url, init = {}) => {
         const timeoutSignal = AbortSignal.timeout(15_000)
         const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
-        const res2 = await fetch(url, { ...init, signal })
+        const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
+        const res2 = await doFetch(url, { ...init, signal })
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -327,7 +329,8 @@ export function registerStatusRoutes(ctx, state) {
         const probeFetch = async (url, init = {}) => {
           const timeoutSignal = AbortSignal.timeout(15_000)
           const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
-          const res2 = await fetch(url, { ...init, signal })
+          const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
+          const res2 = await doFetch(url, { ...init, signal })
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/session-pin.js

@@ -8,8 +8,19 @@ const DEFAULT_TTL_MS = 30 * 60 * 1000 // 30 mins
  * @param {number} [ttlMs]
  * @returns {void}
  */
+export function pruneSessionPins(now = Date.now()) {
+  for (const [id, entry] of sessionPins.entries()) {
+    if (now > entry.expiresAt) {
+      sessionPins.delete(id)
+    }
+  }
+}
+
 export function pinSession(sessionId, accountRef, ttlMs = DEFAULT_TTL_MS) {
   if (!sessionId || !accountRef) return
+  if (sessionPins.size >= 50) {
+    pruneSessionPins()
+  }
   sessionPins.set(sessionId, {
     accountRef,
     expiresAt: Date.now() + ttlMs

package/lib/vendors/copilot.js

@@ -111,6 +111,85 @@ export async function pollDeviceToken(deviceCode, fetchImpl) {
   return readJson(res)
 }
 
+
+export async function deviceStart(cfg, fetchImpl) {
+  const json = await requestDeviceCode(fetchImpl)
+  if (!json || !json.user_code || !json.device_code) {
+    throw httpError(502, "GitHub device code response is incomplete", "DEVICE")
+  }
+  return {
+    userCode: json.user_code,
+    deviceAuthId: json.device_code,
+    intervalMs: Math.max(parseInt(json.interval, 10) || 5, 1) * 1000,
+    authUrl: json.verification_uri || "https://github.com/login/device",
+  }
+}
+
+export async function devicePoll(cfg, session, fetchImpl) {
+  const impl = fetchImpl || fetch
+  let json
+  try {
+    json = await pollDeviceToken(session.deviceAuthId, impl)
+  } catch (err) {
+    throw httpError(502, String(err && err.message || err), "DEVICE")
+  }
+  if (json.error === "authorization_pending" || json.error === "slow_down") {
+    return { status: "pending" }
+  }
+  if (json.error) {
+    throw httpError(400, json.error_description || json.error, "DEVICE")
+  }
+  if (!json.access_token) {
+    return { status: "pending" }
+  }
+  const githubToken = json.access_token
+  const exchange = await exchangeCopilotToken(githubToken, impl)
+  const copilotToken = exchange && exchange.token
+  const expiresAt = exchange && exchange.expires_at ? exchange.expires_at * 1000 : Date.now() + 30 * 60 * 1000
+
+  let label = "copilot"
+  let email = ""
+  try {
+    const userRes = await impl(COPILOT_USER_URL, {
+      headers: {
+        Authorization: `Bearer ${githubToken}`,
+        "User-Agent": "GitHubCopilotChat/0.24.0",
+      },
+    })
+    if (userRes.ok) {
+      const user = await readJson(userRes)
+      if (user && user.login) {
+        label = user.login
+        if (user.email) email = user.email
+      }
+    }
+  } catch { /* best-effort */ }
+
+  return {
+    status: "authorized",
+    blob: {
+      accessToken: copilotToken || githubToken,
+      refreshToken: githubToken,
+      githubToken,
+      expiresAt,
+      label,
+      email,
+    },
+  }
+}
+
+export async function refresh(cfg, blob, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const githubToken = blob && (blob.refreshToken || blob.githubToken)
+  if (!githubToken) return blob
+  const exchange = await exchangeCopilotToken(githubToken, impl)
+  return {
+    ...blob,
+    accessToken: exchange.token || blob.accessToken,
+    expiresAt: exchange.expires_at ? exchange.expires_at * 1000 : Date.now() + 30 * 60 * 1000,
+  }
+}
+
 export async function exchangeCopilotToken(githubToken, fetchImpl) {
   const impl = fetchImpl || fetch
   const res = await impl(COPILOT_TOKEN_URL, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.14",
+  "version": "0.6.16",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",