@goodandready/dsh-subscriptions 0.6.21 → 0.6.23

package/lib/mask.js

@@ -30,7 +30,7 @@ export function cleanErrorMessage(raw) {
       if (parsed.error && parsed.error.message) text = parsed.error.message
       else if (parsed.message) text = parsed.message
       else if (parsed.code) text = parsed.code
-    } catch (err) { /* ignore JSON parse failure */ }
+    } catch { /* ignore JSON parse failure */ }
   }
   const firstLine = text.split('\n')[0].trim()
   if (firstLine.length > 160) {

package/lib/ollama.js

@@ -37,19 +37,19 @@ export class OllamaAdapter extends LlmAdapter {
     return { id: provider, name: 'Ollama (local)' }
   }
 
-  providerRetryPolicy(_provider) {
+  providerRetryPolicy() {
     return undefined
   }
 
-  async listModels(provider) {
+  async listModels() {
     return ollamaModels(this.deps.baseUrl(), this.deps.fetchImpl || fetch)
   }
 
-  imageRequestPricing(_provider, _model) {
+  imageRequestPricing() {
     return undefined
   }
 
-  async resolveModel(provider, model, _signal) {
+  async resolveModel(provider, model) {
     return { provider, id: model, name: model }
   }
 

package/lib/routes/accounts.js

@@ -29,6 +29,10 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const q = queryOf(req)
       const provider = q.get('provider') || ''
       const index = Number(q.get('index') || '1')
@@ -107,6 +111,10 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       try {
         const detected = await discoverLocalCliSessions()
         writeJson(res, 200, { ok: true, detected })
@@ -246,7 +254,7 @@ export function registerAccountsRoutes(ctx, state) {
       let bundle
       try {
         bundle = JSON.parse(decryptWithPassphrase(encrypted, passphrase))
-      } catch (e) {
+      } catch {
         writeJson(res, 400, { ok: false, error: { code: 'decrypt', message: 'wrong passphrase or corrupted bundle' } })
         return
       }

package/lib/routes/proxy.js

@@ -21,7 +21,7 @@ export function registerProxyRoutes(ctx, state) {
       }
       const raw = await readBody(req, 128 * 1024).catch(() => Buffer.alloc(0))
       let body = {}
-      try { body = JSON.parse(raw.toString('utf8') || '{}') } catch (err) { body = {} }
+      try { body = JSON.parse(raw.toString('utf8') || '{}') } catch { body = {} }
       const events = Array.isArray(body && body.events) ? body.events : []
       const analysis = analyzeSessionEvents(events)
       writeJson(res, 200, { ok: true, analysis })

package/lib/routes/status.js

@@ -1,4 +1,4 @@
-import { getRecentAlerts } from '../alerts.js'
+import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, publicConfig } from '../config-schema.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
@@ -22,9 +22,12 @@ export function registerStatusRoutes(ctx, state) {
     fetchForRef,
   } = state
 
+  let currentRevision = 1
+
   async function configResponse() {
     return {
       ok: true,
+      revision: currentRevision,
       config: publicConfig(live()),
       accounts: await accountsView(),
       providers: PROVIDERS.map((id) => ({ id, name: displayName(id) })),
@@ -36,6 +39,10 @@ export function registerStatusRoutes(ctx, state) {
     path: '/dsh-subscriptions/config',
     handler: safeJsonHandler(async (req, res) => {
       if (req.method === 'GET') {
+        if (!isTrustedSettingsRequest(req)) {
+          writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+          return
+        }
         writeJson(res, 200, await configResponse())
         return
       }
@@ -56,12 +63,27 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
         return
       }
+      // #379: revision conflict detection (CAS)
+      const baseRev = payload?.revision != null ? Number(payload.revision) : (req.headers?.['if-match'] ? Number(req.headers['if-match']) : null)
+      if (baseRev != null && !Number.isNaN(baseRev) && baseRev !== currentRevision) {
+        writeJson(res, 409, {
+          ok: false,
+          error: {
+            code: 'conflict',
+            message: 'configuration has been modified concurrently',
+            currentRevision,
+          },
+        })
+        return
+      }
+
       if (payload && typeof payload.config === 'object') payload = payload.config
       try {
         if (Array.isArray(payload.slots)) payload.slots = stripLegacySlots(payload.slots)
         const parsed = Config(payload)
         const dropped = droppedCredentialRefs(live().slots, parsed.slots)
         await getSettingsApi().replace(parsed)
+        currentRevision++
         syncCustomVendors()
         for (const ref of dropped) await store.clearRef(ref)
         await syncAdapter()
@@ -77,8 +99,21 @@ export function registerStatusRoutes(ctx, state) {
     kind: 'exact',
     path: '/dsh-subscriptions/status',
     handler: safeJsonHandler(async (req, res) => {
+      if (req.method === 'DELETE') {
+        if (!isTrustedSettingsRequest(req)) {
+          writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+          return
+        }
+        clearAlerts()
+        writeJson(res, 200, { ok: true })
+        return
+      }
       if (req.method !== 'GET') {
-        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or DELETE only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
       const logged = await store.loggedInProviders()
@@ -97,7 +132,7 @@ export function registerStatusRoutes(ctx, state) {
             expires[slot.provider] = Math.max(expires[slot.provider] || 0, slot.expiresAt)
             labels[slot.provider] = pmL(slot.label || info.label || slot.provider)
           }
-        } catch (err) { /* ignore status inspection error */ }
+        } catch { /* ignore status inspection error */ }
       }
       // #69/#72: active subscription = last successful request (newest first).
       let active = null
@@ -120,7 +155,7 @@ export function registerStatusRoutes(ctx, state) {
               .filter((w) => w && typeof w.usedPercent === 'number')
               .map((w) => ({ id: w.id || w.en || w.ru, label: w.en || w.ru || w.id, usedPercent: w.usedPercent }))
           }
-        } catch (err) { /* ignore status inspection error */ }
+        } catch { /* ignore status inspection error */ }
         active = {
           provider: lastRow.provider,
           index,
@@ -156,6 +191,10 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       writeJson(res, 200, { ok: true, report: await diagnosticsReport() })
     }),
   }), 'dsh-subscriptions: /diagnostics')
@@ -220,7 +259,7 @@ export function registerStatusRoutes(ctx, state) {
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
-        } catch (err) { /* ignore status inspection error */ }
+        } catch { /* ignore status inspection error */ }
         return res2
       }
       try {
@@ -250,6 +289,10 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const host = (req.headers.host || '').split(':')[0]
       if (host !== 'localhost' && host !== '127.0.0.1') {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'localhost only' } })
@@ -269,6 +312,10 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const summary = typeof history.telemetrySummary === 'function'
         ? history.telemetrySummary()
         : { totalRequests: history.size(), requests24h: 0, successRequests: 0, errorRequests: 0, successRate: 100, avgLatencyMs: 0 }
@@ -290,7 +337,7 @@ export function registerStatusRoutes(ctx, state) {
         return
       }
       let payload = {}
-      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch (err) { /* ignore status inspection error */ }
+      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch { /* ignore status inspection error */ }
 
       let provider = payload.provider
       let index = payload.index || 1
@@ -339,7 +386,7 @@ export function registerStatusRoutes(ctx, state) {
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
-          } catch (err) { /* ignore status inspection error */ }
+          } catch { /* ignore status inspection error */ }
           return res2
         }
         try {
@@ -397,6 +444,10 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const limit = Math.min(Number(queryOf(req).get('limit') || '50'), 100)
       writeJson(res, 200, { ok: true, alerts: getRecentAlerts(limit) })
     }),

package/lib/routes.js

@@ -10,7 +10,6 @@ import { registerPluginUpdater } from './updater.js'
 export function registerRoutes(ctx, state) {
   const {
     accountsView,
-    history,
     live,
   } = state
 

package/lib/session-pin.js

@@ -41,11 +41,3 @@ export function getPinnedAccountRef(sessionId) {
   }
   return entry.accountRef
 }
-
-export function unpinSession(sessionId) {
-  if (sessionId) sessionPins.delete(sessionId)
-}
-
-export function clearSessionPins() {
-  sessionPins.clear()
-}

package/lib/subscriptions.js

@@ -1,7 +1,6 @@
 import { isProvider } from "./refs.js"
 import { pickAccount, markCooldown, isSwitchableError, modelFamily } from "./rotate.js"
 import { quotaSnapshot } from "./ratelimit.js"
-import { getVendor } from "./vendors/index.js"
 import { pickFetch } from "./proxy.js"
 
 // ponytail: allowlist per provider — add path to extend without touching request logic
@@ -20,7 +19,7 @@ export function isAllowed(provider, path) {
   p = p.split("?")[0].split("#")[0]
   try {
     if (p.startsWith("http://") || p.startsWith("https://")) p = new URL(p).pathname
-  } catch (err) { /* ignore subscriptions error */ }
+  } catch { /* ignore subscriptions error */ }
   if (!p.startsWith("/")) p = "/" + p
   for (const allowed of list) {
     const a = allowed.split("?")[0]
@@ -140,17 +139,17 @@ export function createSubscriptionsService(deps) {
           try {
             const snap = quotaSnapshot(provider, res.headers, null, Date.now())
             if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
-          } catch (err) { /* ignore subscriptions error */ }
+          } catch { /* ignore subscriptions error */ }
           if (!res.ok && res.clone) {
             try {
               const txt = await res.clone().text()
               let j = null
-              try { j = JSON.parse(txt) } catch (err) { /* ignore subscriptions error */ }
+              try { j = JSON.parse(txt) } catch { /* ignore subscriptions error */ }
               if (j) {
                 const snap2 = quotaSnapshot(provider, res.headers, j, Date.now())
                 if (snap2 && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap2)
               }
-            } catch (err) { /* ignore subscriptions error */ }
+            } catch { /* ignore subscriptions error */ }
           }
           if (!res.ok) {
             const txt = await res.text().catch(() => "")
@@ -174,7 +173,7 @@ export function createSubscriptionsService(deps) {
                 ms: Date.now() - t0,
                 kind: "request",
               })
-            } catch (err) { /* ignore subscriptions error */ }
+            } catch { /* ignore subscriptions error */ }
           }
           return res
         } catch (err) {

package/lib/vault.js

@@ -50,14 +50,14 @@ export function importVault(encryptedPayload, passphrase) {
   let jsonStr
   try {
     jsonStr = decryptWithPassphrase(raw, pass)
-  } catch (err) {
+  } catch {
     throw new Error('failed to decrypt vault: invalid passphrase or corrupted payload')
   }
 
   let data
   try {
     data = JSON.parse(jsonStr)
-  } catch (err) {
+  } catch {
     throw new Error('malformed vault content: invalid JSON')
   }
 

package/lib/vendor-factory.js

@@ -12,7 +12,6 @@ import { buildAuthorizeUrl } from "./oauth.js"
 import { codexResponsesBody, modelCatalog } from "./messages.js"
 import { formTokenRequest, jsonTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError } from "./wire.js"
 import { emailFromToken } from "./jwt.js"
-import { asUsageSnapshot } from "./usage.js"
 
 function defaultModels(models) {
   return modelCatalog("custom", (models || []).map((row) => (typeof row === "string" ? { id: row, name: row } : row)))

package/lib/vendors/antigravity.js

@@ -152,7 +152,7 @@ export async function usage(blob, _cfg, fetchImpl) {
   return retrieveQuotaPercent(fetchImpl || fetch, blob.accessToken, headersFor(blob.projectId || ''))
 }
 
-export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal, saveBlob }) {
+export async function* streamOnce({ blob, options, fetchImpl, headers, signal, saveBlob }) {
   // Abort must cover the project pre-flight as well as the stream.
   const preflight = (u, i) => fetchImpl(u, { ...(i || {}), signal })
   const ready = await withProject(blob, preflight, saveBlob)

package/lib/vendors/codex.js

@@ -174,7 +174,7 @@ export async function listModels(blob, cfg, fetchImpl) {
     }
     if (!rows.length) throw new Error('empty codex catalog')
     rows.sort((a, b) => a.priority - b.priority)
-    return modelCatalog(id, rows.map(({ priority, ...row }) => row))
+    return modelCatalog(id, rows.map((row) => { const copy = { ...row }; delete copy.priority; return copy }))
   } catch { /* catalog fallback */ }
   return catalog
 }

package/lib/vendors/grok.js

@@ -220,7 +220,7 @@ export async function usage(blob, cfg, fetchImpl) {
           const decoded = decodeGrokCreditsFrame(Buffer.from(buf))
           if (decoded != null) pct = decoded
         }
-      } catch (err) { /* ignore grok usage capture error */ }
+      } catch { /* ignore grok usage capture error */ }
     }
     const snap = asUsageSnapshot(pct)
     if (snap) snap.windows = usageWindows(json)

package/lib/vendors/index.js

@@ -14,7 +14,6 @@ import * as grok from './grok.js'
 import * as antigravity from './antigravity.js'
 import * as kimi from './kimi.js'
 import * as glm from './glm.js'
-import { createVendorFromProfile } from '../vendor-factory.js'
 
 const builtins = {
   codex,

package/lib/vendors/qwen.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages, openaiTools } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, httpError } from '../wire.js'
 import { asUsageSnapshot } from '../usage.js'
 
 export const id = 'qwen'

package/lib/vendors/spark.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, httpError } from '../wire.js'
 import { asUsageSnapshot } from '../usage.js'
 
 export const id = 'spark'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.21",
+  "version": "0.6.23",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -15,6 +15,8 @@
     "lib/",
     "cordis.patch.yml",
     "README.md",
+    "README.ru.md",
+    "README.zh.md",
     "LICENSE"
   ],
   "keywords": [