@goodandready/dsh-subscriptions 0.6.18 → 0.6.20

package/lib/accounts.js

@@ -163,7 +163,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   }
 
   async function listAccounts(provider) {
-    const slots = normalizeSlots(getConfig().slots).filter((s) => s.provider === provider)
+    const curConfig = getConfig()
+    const slots = normalizeSlots(curConfig.slots).filter((s) => s.provider === provider)
     const out = []
     const now = Date.now()
     for (const slot of slots) {
@@ -187,8 +188,10 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   }
 
   async function loggedInProviders() {
+    const curConfig = getConfig()
+    const slots = normalizeSlots(curConfig.slots)
     const found = new Set()
-    for (const slot of normalizeSlots(getConfig().slots)) {
+    for (const slot of slots) {
       const info = await describeRef(slot.ref)
       if (info.configured) found.add(slot.provider)
     }
@@ -202,7 +205,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
     if (refreshLocks.has(lockKey)) return refreshLocks.get(lockKey)
     const promise = (async () => {
       try {
-        const cfg = vendorConfig(provider, getConfig())
+        const curConfig = getConfig()
+        const cfg = vendorConfig(provider, curConfig)
         const next = await executeWithRetry(
           () => getVendor(provider).refresh(cfg, blob, fetchFor(ref)),
           {
@@ -238,9 +242,11 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   }
 
   async function refreshUsage(provider) {
-    const cfg = vendorConfig(provider, getConfig())
+    const curConfig = getConfig()
+    const cfg = vendorConfig(provider, curConfig)
     const vendor = getVendor(provider)
-    for (const slot of normalizeSlots(getConfig().slots).filter((s) => s.provider === provider)) {
+    const slots = normalizeSlots(curConfig.slots).filter((s) => s.provider === provider)
+    for (const slot of slots) {
       const last = usageFetched.get(slot.ref) || 0
       if (Date.now() - last < USAGE_TTL_MS) continue
       let raw = ''

package/lib/config-schema.js

@@ -82,7 +82,7 @@ export const Config = z.object({
 })
 
 export function publicConfig(cfg) {
-  const clone = structuredClone(cfg)
+  const clone = { ...cfg }
   // #242: redact all *ClientSecret fields before exposing config via GET /config.
   // Secrets must never leave the server; the UI does not need them.
   for (const key of Object.keys(clone)) {

package/lib/index.js

@@ -64,22 +64,30 @@ const OK_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</titl
 
 export function apply(ctx, config) {
   const logger = ctx.logger ? ctx.logger('subscriptions') : console
-  let getConfig = () => config
   let settingsApi
-  ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(NS, Config, { base: config })
-    settingsApi = scope
-    getConfig = () => scope.get() ?? config
-    Promise.resolve().then(() => {
-      reconcileSlots().catch((err) => {
-        if (logger && logger.warn) logger.warn('[dsh-subscriptions] reconcileSlots initial error: ' + (err && err.message || err))
-      })
-    })
-    sctx.effect(() => () => {
-      settingsApi = undefined
-      getConfig = () => config
-    })
-  })
+  // #367: maintain a single immutable config snapshot without structuredClone on hot path
+  let cachedConfig = Config(config ?? {}) ?? config
+
+  function syncSnapshot(raw) {
+    if (raw !== undefined && raw !== null) {
+      try {
+        cachedConfig = Config(raw ?? {}) ?? config
+      } catch {
+        cachedConfig = config
+      }
+    } else if (settingsApi && typeof settingsApi.get === 'function') {
+      try {
+        const rawSettings = settingsApi.get()
+        cachedConfig = Config(rawSettings ?? {}) ?? config
+      } catch {
+        cachedConfig = config
+      }
+    }
+    syncCustomVendors()
+    return cachedConfig
+  }
+
+  const live = () => cachedConfig
 
   // Registering custom vendors from Config. Runs at startup and on
   // every config change (replace) - the registry is rebuilt from scratch.
@@ -104,9 +112,58 @@ export function apply(ctx, config) {
     }
   }
 
-  const live = () => Config(structuredClone(getConfig() ?? {})) ?? config
   syncCustomVendors()
 
+  ctx.inject(['settings'], (sctx) => {
+    const scope = sctx.settings.register(NS, Config, { base: config })
+    settingsApi = {
+      ...scope,
+      get: () => (typeof scope.get === 'function' ? scope.get() : cachedConfig),
+      async replace(next) {
+        syncSnapshot(next)
+        if (typeof scope.replace === 'function') {
+          return await scope.replace(next)
+        }
+      },
+    }
+
+    if (typeof scope.get === 'function') {
+      syncSnapshot(scope.get())
+    }
+
+    if (typeof scope.watch === 'function') {
+      try {
+        const unwatch = scope.watch((next) => syncSnapshot(next))
+        if (typeof unwatch === 'function') {
+          sctx.effect(() => unwatch)
+        }
+      } catch { /* ignore watch error */ }
+    }
+
+    Promise.resolve().then(() => {
+      reconcileSlots().catch((err) => {
+        if (logger && logger.warn) logger.warn('[dsh-subscriptions] reconcileSlots initial error: ' + (err && err.message || err))
+      })
+    })
+
+    const onDocUpdated = (ns) => {
+      if (!ns || ns === NS) {
+        syncSnapshot()
+      }
+    }
+    if (typeof sctx.on === 'function') {
+      sctx.on('settings/document-updated', onDocUpdated)
+    } else if (typeof ctx.on === 'function') {
+      ctx.on('settings/document-updated', onDocUpdated)
+    }
+
+    sctx.effect(() => () => {
+      settingsApi = undefined
+      cachedConfig = Config(config ?? {}) ?? config
+      syncCustomVendors()
+    })
+  })
+
   // #88: fetch bound to the per-account proxy (slot.proxyUrl), or null for direct.
   const fetchForRef = (ref) => {
     const parsed = parseOauthRef(ref)

package/lib/routes/status.js

@@ -285,6 +285,10 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       let payload = {}
       try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch (err) { /* ignore status inspection error */ }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.18",
+  "version": "0.6.20",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",