@goodandready/dsh-subscriptions 0.6.25 → 0.6.27

package/lib/adapter.js

@@ -118,6 +118,9 @@ export class SubscriptionAdapter extends LlmAdapter {
         },
         streamOnce: async function* (account, opts) {
           const t0 = Date.now()
+          let firstChunkTime = null
+          let outputTokens = 0
+          let approxChars = 0
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const vendor = getVendor(provider)
           // ponytail: capture x-ratelimit headers without touching vendors
@@ -145,7 +148,7 @@ export class SubscriptionAdapter extends LlmAdapter {
           }
           try {
             if (typeof deps.rememberRequest === 'function') deps.rememberRequest(account.ref)
-            yield* vendor.streamOnce({
+            for await (const chunk of vendor.streamOnce({
               blob,
               options: opts,
               fetchImpl: quotaFetch,
@@ -153,12 +156,37 @@ export class SubscriptionAdapter extends LlmAdapter {
               config: deps.vendorConfig(provider),
               signal: opts.signal,
               saveBlob: (next) => deps.saveBlob(account.ref, next),
-            })
+            })) {
+              if (firstChunkTime === null) {
+                firstChunkTime = Date.now()
+              }
+              if (chunk && typeof chunk === 'object') {
+                if (chunk.type === 'usage' && chunk.usage) {
+                  const u = toTokenUsage(chunk.usage)
+                  if (u && typeof u.outputTokens === 'number' && u.outputTokens > 0) {
+                    outputTokens = u.outputTokens
+                  }
+                } else if (chunk.type === 'text-delta' && typeof chunk.text === 'string') {
+                  approxChars += chunk.text.length
+                }
+              }
+              yield chunk
+            }
+            if (!outputTokens && approxChars > 0) {
+              outputTokens = Math.max(1, Math.round(approxChars / 4))
+            }
             // stream completed successfully: clear cooldown and health penalties
             if (typeof deps.recordSuccess === 'function') deps.recordSuccess(account.ref)
             // #65: record in the request and cost history.
             if (typeof deps.recordHistory === 'function') {
               try {
+                const totalMs = Date.now() - t0
+                const ttftMs = firstChunkTime !== null ? Math.max(0, firstChunkTime - t0) : null
+                const genMs = (firstChunkTime !== null && totalMs > ttftMs) ? (totalMs - ttftMs) : 0
+                const tps = (outputTokens > 0 && genMs > 0)
+                  ? Math.round((outputTokens / (genMs / 1000)) * 10) / 10
+                  : null
+
                 deps.recordHistory({
                   provider,
                   ref: account.ref,
@@ -166,7 +194,10 @@ export class SubscriptionAdapter extends LlmAdapter {
                   path: '/responses',
                   method: 'POST',
                   status: 200,
-                  ms: Date.now() - t0,
+                  ms: totalMs,
+                  ttftMs,
+                  tps,
+                  outputTokens: outputTokens || undefined,
                   kind: 'stream',
                 })
               } catch { /* ignore quota capture failure */ }

package/lib/client.js

@@ -149,6 +149,7 @@ window.__ModuleLoader__.load({
     '.dsub-slot-meta-row{display:flex;flex-wrap:wrap;align-items:center;gap:10px;margin-top:12px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2);font-size:12px}' +
     '.dsub-ref-tag{display:inline-flex;align-items:center;gap:5px;font-size:11.5px;color:var(--dsw-alias-label-secondary)}' +
     '.dsub-ref-tag code{padding:2px 6px;border-radius:4px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);font-family:ui-monospace,monospace;color:var(--dsw-alias-label-primary);font-size:11px}' +
+    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default,#3b82f6);background:color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 20%,transparent)}' +
     '.dsub-btn-danger{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 40%,transparent)!important;color:var(--dsw-alias-state-error-primary)!important}' +
     '.dsub-btn-danger:hover:not(:disabled){background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent)!important}' +
     '.dsub-poolTitle{margin-top:16px;margin-bottom:8px;font-size:11.5px;font-weight:700;color:var(--dsw-alias-label-secondary);text-transform:uppercase;letter-spacing:.05em}' +
@@ -321,6 +322,22 @@ const cssId = 'dsh-subscriptions/settings.module.css'
         ],
         link: "https://aws.amazon.com",
       },
+      copilot: {
+        title: "GitHub Copilot",
+        stepsEn: [
+          "1. Click \"Device Login\" (or \"Connect\") on the slot card.",
+          "2. A one-time code will appear on the card.",
+          "3. Open https://github.com/login/device, enter the code, and approve access for your GitHub account with Copilot subscription.",
+          "4. The plugin automatically captures tokens and enables Copilot models.",
+        ],
+        stepsZh: [
+          "1. 点击卡片上的 \"设备码登录\" (Device Login) 或 \"连接\"。",
+          "2. 界面将展示一次性设备授权码。",
+          "3. 在浏览器打开 https://github.com/login/device 输入代码，并为您拥有 Copilot 订阅的 GitHub 账户授权。",
+          "4. 授权成功后，插件会自动捕获会话并激活 GitHub Copilot 官方模型。",
+        ],
+        link: "https://github.com/login/device",
+      },
     }
 
     const en = {
@@ -503,7 +520,21 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "healthQuarantine": "Quarantine",
       "healthWarmup": "Warmup",
       "healthActive": "Active",
-      "healthIdle": "Idle"
+      "healthIdle": "Idle",
+      "speedMetricsHint": "Time to first token (TTFT) and token generation speed",
+      "backupExport": "Export Backup",
+      "backupImport": "Import Backup",
+      "backupExportTitle": "Export Encrypted Backup",
+      "backupImportTitle": "Import Encrypted Backup",
+      "backupExportAction": "Export",
+      "backupImportAction": "Import",
+      "backupPassphrase": "Vault Passphrase (min 4 chars)",
+      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM and PBKDF2.",
+      "backupImportHint": "Restore encrypted subscription accounts and credentials from a vault payload.",
+      "backupPayloadPlaceholder": "Paste DSHE... encrypted string here",
+      "backupExportOk": "Backup exported successfully",
+      "backupImportOk": "Backup imported successfully",
+      "backupDownload": "Download .enc"
 };
 
     const zh = {
@@ -686,7 +717,21 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "healthQuarantine": "隔离期",
       "healthWarmup": "预热中",
       "healthActive": "活跃",
-      "healthIdle": "空闲"
+      "healthIdle": "空闲",
+      "speedMetricsHint": "首字响应延迟 (TTFT) 与每秒生成速度 (Tokens/s)",
+      "backupExport": "导出备份",
+      "backupImport": "导入备份",
+      "backupExportTitle": "导出加密备份",
+      "backupImportTitle": "导入加密备份",
+      "backupExportAction": "导出",
+      "backupImportAction": "导入",
+      "backupPassphrase": "凭据库密码（至少 4 位）",
+      "backupExportHint": "使用 AES-256-GCM 与 PBKDF2 安全加密导出所有订阅账户与配置。",
+      "backupImportHint": "从已加密的备份内容中导入并恢复订阅账户与凭据。",
+      "backupPayloadPlaceholder": "在此粘贴 DSHE... 加密内容",
+      "backupExportOk": "备份导出成功",
+      "backupImportOk": "备份导入成功",
+      "backupDownload": "下载 .enc 文件"
 };
     // #51: live countdown to the quota window reset (account.quota.resetAt).
                 function cleanErrorMessage(raw) {
@@ -908,6 +953,64 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       const [telemetry, setTelemetry] = React.useState(null)
       const [smoke, setSmoke] = React.useState({ testing: false, result: null })
       const [updater, setUpdater] = React.useState({ checking: false, updating: false, status: null, message: '' })
+      const [backupModal, setBackupModal] = React.useState(null)
+      const [backupPass, setBackupPass] = React.useState('')
+      const [backupData, setBackupData] = React.useState('')
+      const [backupErr, setBackupErr] = React.useState('')
+      const [backupInfo, setBackupInfo] = React.useState('')
+      const [backupLoading, setBackupLoading] = React.useState(false)
+
+      const doExportBackup = async () => {
+        setBackupErr(''); setBackupInfo(''); setBackupLoading(true)
+        try {
+          const res = await fetch('/dsh-subscriptions/export-backup', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ passphrase: backupPass, algorithm: 'pbkdf2' }),
+          })
+          const d = await res.json().catch(() => ({}))
+          if (!res.ok || !d.ok) throw new Error((d.error && d.error.message) || ('HTTP ' + res.status))
+          setBackupData(d.vault)
+          setBackupInfo(t('backupExportOk') + ' (' + d.slotCount + ' slots)')
+        } catch (e) {
+          setBackupErr(cleanErrorMessage(e.message || e))
+        }
+        setBackupLoading(false)
+      }
+
+      const doImportBackup = async () => {
+        setBackupErr(''); setBackupInfo(''); setBackupLoading(true)
+        try {
+          const res = await fetch('/dsh-subscriptions/import-backup', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ passphrase: backupPass, vault: backupData.trim() }),
+          })
+          const d = await res.json().catch(() => ({}))
+          if (!res.ok || !d.ok) throw new Error((d.error && d.error.message) || ('HTTP ' + res.status))
+          setBackupInfo(t('backupImportOk') + ' (' + d.slotCount + ' slots)')
+          if (d.accounts) setAccounts(d.accounts)
+          await reload()
+        } catch (e) {
+          setBackupErr(cleanErrorMessage(e.message || e))
+        }
+        setBackupLoading(false)
+      }
+
+      const downloadBackupFile = () => {
+        if (!backupData) return
+        try {
+          const blob = new window.Blob([backupData], { type: 'text/plain;charset=utf-8' })
+          const url = URL.createObjectURL(blob)
+          const a = document.createElement('a')
+          a.href = url
+          a.download = 'dsh-subscriptions-backup.enc'
+          document.body.appendChild(a)
+          a.click()
+          document.body.removeChild(a)
+          URL.revokeObjectURL(url)
+        } catch { /* ignore */ }
+      }
 
       const checkUpdater = () => {
         setUpdater((u) => Object.assign({}, u, { checking: true, message: '' }))
@@ -1056,6 +1159,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
 
       const connect = async (provider, index) => {
         setErr('')
+        if (provider === 'copilot') {
+          return deviceStartLogin(provider, index).catch((e) => setErr(cleanErrorMessage(e.message || e)))
+        }
         if (provider === 'antigravity' && (!draft || !draft.antigravityClientId || !String(draft.antigravityClientId).trim())) {
           setErr(t('missingClientIdAntigravity'))
           return
@@ -1521,6 +1627,8 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           React.createElement('div', { className: 'dsub-row' },
             React.createElement('button', { type: 'button', className: 'dsub-mini', onClick: genDiag }, t('diagGenerate')),
             React.createElement('button', { type: 'button', className: 'dsub-mini', onClick: runAnalyzeSession }, analyzingCache ? '…' : t('cacheAnalyze')),
+            React.createElement('button', { type: 'button', className: 'dsub-mini', onClick: () => { setBackupModal('export'); setBackupErr(''); setBackupInfo('') } }, '🔒 ' + t('backupExport')),
+            React.createElement('button', { type: 'button', className: 'dsub-mini', onClick: () => { setBackupModal('import'); setBackupErr(''); setBackupInfo('') } }, '📥 ' + t('backupImport')),
             React.createElement('a', { href: 'https://github.com/GooDAnDReaDY/dsh-subscriptions/issues', target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('diagIssues')),
           ),
           React.createElement('div', { className: 'dsub-sub' }, t('diagHint')),
@@ -1535,6 +1643,63 @@ const cssId = 'dsh-subscriptions/settings.module.css'
             }, t('diagCopy')),
             React.createElement('pre', { className: 'dsub-diag' }, diag),
           ) : null,
+          backupModal ? React.createElement('div', { className: 'dsub-panel-box', style: { marginTop: '10px' } },
+            React.createElement('div', { className: 'dsub-panel-title' },
+              React.createElement('span', null, backupModal === 'export' ? ('🔒 ' + t('backupExportTitle')) : ('📥 ' + t('backupImportTitle'))),
+              React.createElement('button', {
+                type: 'button',
+                className: 'dsub-mini',
+                onClick: () => { setBackupModal(null); setBackupPass(''); setBackupData(''); setBackupErr(''); setBackupInfo('') }
+              }, '✕ ' + t('closeModal'))
+            ),
+            React.createElement('div', { className: 'dsub-panel-desc' },
+              backupModal === 'export' ? t('backupExportHint') : t('backupImportHint')
+            ),
+            React.createElement('div', { style: { display: 'flex', flexDirection: 'column', gap: '8px', marginTop: '8px' } },
+              backupModal === 'import' ? React.createElement('textarea', {
+                className: 'dsub-diag',
+                style: { width: '100%', height: '80px', fontFamily: 'monospace', fontSize: '11px' },
+                placeholder: t('backupPayloadPlaceholder'),
+                value: backupData,
+                onChange: (e) => setBackupData(e.target.value),
+              }) : null,
+              React.createElement('div', { className: 'dsub-row' },
+                React.createElement('input', {
+                  type: 'password',
+                  className: 'dsub-grow',
+                  placeholder: t('backupPassphrase'),
+                  value: backupPass,
+                  onChange: (e) => setBackupPass(e.target.value),
+                }),
+                backupModal === 'export' ? React.createElement('button', {
+                  type: 'button',
+                  className: 'dsub-mini',
+                  disabled: backupLoading || !backupPass || backupPass.length < 4,
+                  onClick: doExportBackup,
+                }, backupLoading ? '…' : t('backupExportAction')) : React.createElement('button', {
+                  type: 'button',
+                  className: 'dsub-mini',
+                  disabled: backupLoading || !backupPass || !backupData,
+                  onClick: doImportBackup,
+                }, backupLoading ? '…' : t('backupImportAction'))
+              ),
+              backupErr ? React.createElement('div', { className: 'dsub-bad' }, backupErr) : null,
+              backupInfo ? React.createElement('div', { className: 'dsub-ok' }, backupInfo) : null,
+              (backupModal === 'export' && backupData) ? React.createElement('div', { className: 'dsub-row' },
+                React.createElement('button', {
+                  type: 'button',
+                  className: 'dsub-mini',
+                  onClick: () => { try { navigator.clipboard.writeText(backupData) } catch { /* ignore */ } },
+                }, t('diagCopy')),
+                React.createElement('button', {
+                  type: 'button',
+                  className: 'dsub-mini',
+                  onClick: downloadBackupFile,
+                }, t('backupDownload')),
+                React.createElement('pre', { className: 'dsub-diag', style: { maxHeight: '60px', overflow: 'hidden', textOverflow: 'ellipsis' } }, backupData)
+              ) : null
+            )
+          ) : null,
         ),
         names.map((prov) => {
           const rows = slots
@@ -1564,7 +1729,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                     type: 'button', className: 'dsub-mini',
                     onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, on ? t('reconnect') : t('connect')),
-                  (row.slot.provider === 'codex' ? React.createElement('button', {
+                  ((row.slot.provider === 'codex' || row.slot.provider === 'copilot') ? React.createElement('button', {
                     type: 'button', className: 'dsub-mini',
                     onClick: () => deviceStartLogin(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, t('deviceLogin')) : null),
@@ -1826,7 +1991,11 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                           var est = Math.floor(rem / (w.usedPercent / account.requests))
                           if (est > 0) extra = React.createElement('span', null, t('forecast') + ' ' + est)
                         }
-                        items.push(renderItem(windowLabel(w), w.usedPercent, extra))
+                        var resetElem = w.resetAt ? React.createElement(ResetCountdown, { key: 'reset-' + idx, resetAt: w.resetAt }) : null
+                        var extraContent = (resetElem && extra)
+                          ? React.createElement('span', { className: 'dsub-row', style: { gap: '6px' } }, resetElem, extra)
+                          : (resetElem || extra)
+                        items.push(renderItem(windowLabel(w), w.usedPercent, extraContent))
                       }
                     })
                   }
@@ -1851,11 +2020,24 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                     React.createElement('div', { className: 'dsub-usage-grid' }, items)
                   )
                 })(),
-                (account.paidTierName || account.ref ? React.createElement('div', { className: 'dsub-slot-meta-row' },
+                ((account.paidTierName || account.ref || (telemetry && telemetry.accounts && telemetry.accounts[account.ref])) ? React.createElement('div', { className: 'dsub-slot-meta-row' },
                   account.paidTierName ? React.createElement('span', { className: 'dsub-sub' },
                     React.createElement('strong', null, t('plan') + ': '),
                     account.paidTierName
                   ) : null,
+                  (function(){
+                    const accTelem = telemetry && telemetry.accounts && telemetry.accounts[account.ref]
+                    if (!accTelem) return null
+                    const parts = []
+                    if (accTelem.avgTtftMs != null) parts.push('TTFT: ' + accTelem.avgTtftMs + 'ms')
+                    else if (accTelem.lastTtftMs != null) parts.push('TTFT: ' + accTelem.lastTtftMs + 'ms')
+                    if (accTelem.avgTps != null) parts.push(accTelem.avgTps + ' t/s')
+                    else if (accTelem.lastTps != null) parts.push(accTelem.lastTps + ' t/s')
+                    if (parts.length === 0) return null
+                    return React.createElement('span', { className: 'dsub-speed-tag', title: t('speedMetricsHint') },
+                      '⚡ ' + parts.join(' · ')
+                    )
+                  })(),
                   account.ref ? React.createElement('span', { className: 'dsub-ref-tag' },
                     React.createElement('span', null, t('storedAs')),
                     React.createElement('code', null, account.ref)
@@ -2166,7 +2348,13 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       if (state.active) {
         const a = state.active
         const wins = Array.isArray(a.windows) ? a.windows : []
-        const winStr = wins.map((w) => (w.label || w.id) + ' ' + Math.round(w.usedPercent) + '%').join(' ')
+        const winStr = wins.map((w) => {
+          let s = (w.label || w.id) + ' ' + Math.round(w.usedPercent) + '%'
+          if (w.resetAt && w.resetAt > now) {
+            s += ' (' + formatRelativeReset(w.resetAt, t('lang'), now) + ')'
+          }
+          return s
+        }).join(' ')
         const provName = a.provider ? (a.provider.charAt(0).toUpperCase() + a.provider.slice(1)) : ''
         pillText = (a.provider === 'codex' && a.fastMode ? '⚡ ' : '') + provName + (winStr ? ' · ' + winStr : (a.usagePercent != null ? ' · ' + Math.round(a.usagePercent) + '%' : ''))
       }
@@ -2209,7 +2397,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
             ),
             secWin ? React.createElement('div', null,
               React.createElement('div', { className: 'dsub-barLabelRow' },
-                React.createElement('span', null, (secWin.label || '7d') + ' window'),
+                React.createElement('span', null, ((secWin.label || '7d') + ' window') + (secWin && secWin.resetAt ? ' (' + formatRelativeReset(secWin.resetAt, t('lang'), now) + ')' : '')),
                 React.createElement('span', { style: { fontVariantNumeric: 'tabular-nums' } }, secPct + '%'),
               ),
               React.createElement('div', { className: 'dsub-barTrack' },

package/lib/crypto.js

@@ -1,27 +1,46 @@
-import { scryptSync, createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
+import { scryptSync, pbkdf2Sync, createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
 
-// AES-256-GCM with a passphrase-derived key (scrypt, no separately stored salt -
-// the salt is stored at the head of the block).
-export function encryptWithPassphrase(plainText, passphrase) {
+// AES-256-GCM with PBKDF2 (100,000 iterations, SHA-256) (DSHE2:) or scrypt (DSHE1:).
+// Backward-compatible across both key derivation algorithms.
+export function encryptWithPassphrase(plainText, passphrase, { algorithm = "scrypt" } = {}) {
   const salt = randomBytes(16)
-  const key = scryptSync(String(passphrase), salt, 32)
+  const isPbkdf2 = algorithm === "pbkdf2"
+  const key = isPbkdf2
+    ? pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    : scryptSync(String(passphrase), salt, 32)
   const iv = randomBytes(12)
   const cipher = createCipheriv("aes-256-gcm", key, iv)
   const encrypted = Buffer.concat([cipher.update(String(plainText), "utf8"), cipher.final()])
   const tag = cipher.getAuthTag()
   // format: magic + salt + iv + tag + data
-  return "DSHE1:" + Buffer.concat([salt, iv, tag, encrypted]).toString("base64")
+  const prefix = isPbkdf2 ? "DSHE2:" : "DSHE1:"
+  return prefix + Buffer.concat([salt, iv, tag, encrypted]).toString("base64")
 }
 
 export function decryptWithPassphrase(payload, passphrase) {
   const raw = String(payload || "")
-  if (!raw.startsWith("DSHE1:")) throw new Error("unknown export format")
-  const buf = Buffer.from(raw.slice(6), "base64")
-  const salt = buf.subarray(0, 16)
-  const iv = buf.subarray(16, 28)
-  const tag = buf.subarray(28, 44)
-  const data = buf.subarray(44)
-  const key = scryptSync(String(passphrase), salt, 32)
+  let key
+  let salt
+  let iv
+  let tag
+  let data
+  if (raw.startsWith("DSHE2:")) {
+    const buf = Buffer.from(raw.slice(6), "base64")
+    salt = buf.subarray(0, 16)
+    iv = buf.subarray(16, 28)
+    tag = buf.subarray(28, 44)
+    data = buf.subarray(44)
+    key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+  } else if (raw.startsWith("DSHE1:")) {
+    const buf = Buffer.from(raw.slice(6), "base64")
+    salt = buf.subarray(0, 16)
+    iv = buf.subarray(16, 28)
+    tag = buf.subarray(28, 44)
+    data = buf.subarray(44)
+    key = scryptSync(String(passphrase), salt, 32)
+  } else {
+    throw new Error("unknown export format")
+  }
   const decipher = createDecipheriv("aes-256-gcm", key, iv)
   decipher.setAuthTag(tag)
   return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8")

package/lib/gemini-schema.js

@@ -52,7 +52,14 @@ export function toGeminiSchema(schema, depth) {
     out.items = toGeminiSchema(Array.isArray(items) ? items[0] : (items || { type: 'string' }), level + 1)
   }
   if (Array.isArray(schema.enum) && schema.enum.length) {
-    out.enum = schema.enum.map((item) => String(item))
+    const cleaned = [...new Set(
+      schema.enum
+        .map((item) => String(item ?? '').trim())
+        .filter((item) => item.length > 0),
+    )]
+    if (cleaned.length > 0) {
+      out.enum = cleaned
+    }
   }
   return out
 }

package/lib/history.js

@@ -109,6 +109,108 @@ export class HistoryStore {
     return this.rows.length
   }
 
+  /** Summarize session and 24-hour telemetry for UI stat cards. */
+  accountTelemetry(ref) {
+    if (!ref) return null
+    let count = 0
+    let ttftSum = 0
+    let ttftCount = 0
+    let lastTtft = null
+    let tpsSum = 0
+    let tpsCount = 0
+    let lastTps = null
+    let totalOutputTokens = 0
+    let latencySum = 0
+    let lastLatency = 0
+
+    for (const r of this.rows) {
+      if (r.ref !== ref) continue
+      count++
+      if (typeof r.ms === "number" && r.ms > 0) {
+        latencySum += r.ms
+        if (!lastLatency) lastLatency = r.ms
+      }
+      if (typeof r.ttftMs === "number" && r.ttftMs >= 0) {
+        ttftSum += r.ttftMs
+        ttftCount++
+        if (lastTtft === null) lastTtft = r.ttftMs
+      }
+      if (typeof r.tps === "number" && r.tps > 0) {
+        tpsSum += r.tps
+        tpsCount++
+        if (lastTps === null) lastTps = r.tps
+      }
+      if (typeof r.outputTokens === "number" && r.outputTokens > 0) {
+        totalOutputTokens += r.outputTokens
+      }
+    }
+    if (count === 0) return null
+    return {
+      totalRequests: count,
+      avgLatencyMs: count > 0 ? Math.round(latencySum / count) : 0,
+      lastLatencyMs: lastLatency,
+      avgTtftMs: ttftCount > 0 ? Math.round(ttftSum / ttftCount) : null,
+      lastTtftMs: lastTtft,
+      avgTps: tpsCount > 0 ? Math.round((tpsSum / tpsCount) * 10) / 10 : null,
+      lastTps: lastTps,
+      totalOutputTokens,
+    }
+  }
+
+  accountsTelemetry() {
+    const map = {}
+    for (const r of this.rows) {
+      if (!r.ref) continue
+      if (!map[r.ref]) {
+        map[r.ref] = {
+          count: 0,
+          latencySum: 0,
+          lastLatency: 0,
+          ttftSum: 0,
+          ttftCount: 0,
+          lastTtft: null,
+          tpsSum: 0,
+          tpsCount: 0,
+          lastTps: null,
+          totalOutputTokens: 0,
+        }
+      }
+      const st = map[r.ref]
+      st.count++
+      if (typeof r.ms === "number" && r.ms > 0) {
+        st.latencySum += r.ms
+        if (!st.lastLatency) st.lastLatency = r.ms
+      }
+      if (typeof r.ttftMs === "number" && r.ttftMs >= 0) {
+        st.ttftSum += r.ttftMs
+        st.ttftCount++
+        if (st.lastTtft === null) st.lastTtft = r.ttftMs
+      }
+      if (typeof r.tps === "number" && r.tps > 0) {
+        st.tpsSum += r.tps
+        st.tpsCount++
+        if (st.lastTps === null) st.lastTps = r.tps
+      }
+      if (typeof r.outputTokens === "number" && r.outputTokens > 0) {
+        st.totalOutputTokens += r.outputTokens
+      }
+    }
+    const out = {}
+    for (const [ref, st] of Object.entries(map)) {
+      out[ref] = {
+        totalRequests: st.count,
+        avgLatencyMs: st.count > 0 ? Math.round(st.latencySum / st.count) : 0,
+        lastLatencyMs: st.lastLatency,
+        avgTtftMs: st.ttftCount > 0 ? Math.round(st.ttftSum / st.ttftCount) : null,
+        lastTtftMs: st.lastTtft,
+        avgTps: st.tpsCount > 0 ? Math.round((st.tpsSum / st.tpsCount) * 10) / 10 : null,
+        lastTps: st.lastTps,
+        totalOutputTokens: st.totalOutputTokens,
+      }
+    }
+    return out
+  }
+
   /** Summarize session and 24-hour telemetry for UI stat cards. */
   telemetrySummary() {
     const total = this.rows.length
@@ -124,6 +226,7 @@ export class HistoryStore {
         lastRequestAt: null,
         lastProvider: null,
         lastModel: null,
+        accounts: {},
       }
     }
     let success = 0
@@ -157,6 +260,7 @@ export class HistoryStore {
       lastRequestAt: (first && first.ts) || null,
       lastProvider: (first && first.provider) || null,
       lastModel: (first && first.model) || null,
+      accounts: this.accountsTelemetry(),
     }
   }
 }

package/lib/import-auth.js

@@ -169,7 +169,27 @@ async function discoverLocalCliSessionsInner() {
   }
 
   // 9. GitHub Copilot token
-  if (process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN) {
+  const copilotPaths = [
+    homeFile('.config', 'github-copilot', 'hosts.json'),
+    homeFile('.config', 'github-copilot', 'apps.json'),
+  ]
+  for (const p of copilotPaths) {
+    const cp = await readJson(p)
+    if (cp) {
+      const gh = cp['github.com'] || cp
+      const tok = gh.oauth_token || gh.token || gh.access_token
+      if (tok) {
+        detected.copilot = {
+          provider: 'copilot',
+          path: p,
+          email: gh.user || 'GitHub Copilot User',
+          hasRefreshToken: false,
+        }
+        break
+      }
+    }
+  }
+  if (!detected.copilot && (process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN)) {
     detected.copilot = {
       provider: 'copilot',
       path: 'GITHUB_COPILOT_TOKEN env',
@@ -217,12 +237,23 @@ export async function loadLocalCliBlob(provider, options = {}) {
   }
 
   if (provider === 'copilot') {
-    const tok = process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN || ''
+    let tok = process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN || ''
+    let email = 'GitHub Copilot User'
+    if (info.path && info.path !== 'GITHUB_COPILOT_TOKEN env') {
+      const cp = await readJson(info.path)
+      if (cp) {
+        const gh = cp['github.com'] || cp
+        tok = gh.oauth_token || gh.token || gh.access_token || tok
+        email = gh.user || email
+      }
+    }
     return {
       accessToken: tok,
       refreshToken: tok,
+      githubToken: tok,
       expiresAt: Date.now() + 30 * 86400 * 1000,
-      email: 'GitHub Copilot User'
+      email,
+      label: email,
     }
   }
 

package/lib/refs.js

@@ -55,6 +55,7 @@ const DISPLAY = {
   glm: 'Zhipu GLM',
   cursor: 'Cursor',
   kiro: 'AWS Kiro',
+  copilot: 'GitHub Copilot',
 }
 
 export function displayName(provider) {

package/lib/rotate.js

@@ -8,11 +8,19 @@ const SWITCH_CODES = new Set([
   'LICENSE_REQUIRED',
 ])
 
+export function isRegionError(err) {
+  if (!err || typeof err !== 'object') return false
+  const status = Number(err.status || err.statusCode) || 0
+  const msg = String(err.message || '')
+  return status === 400 && (/FAILED_PRECONDITION/i.test(msg) || /User location is not supported/i.test(msg))
+}
+
 export function isSwitchableError(err) {
   if (!err || typeof err !== 'object') return false
   if (err.name === 'AbortError' || err.code === 'ABORT_ERR' || err.code === 'ERR_ABORTED' || (err.message && /aborted/i.test(err.message))) return false
   const code = err.code || (err.failure && err.failure.code)
   if (SWITCH_CODES.has(code)) return true
+  if (isRegionError(err)) return true
   const status = err.status || err.statusCode
   return status === 401 || status === 403 || status === 429 || status === 500 || status === 502 || status === 503
 }

package/lib/routes/accounts.js

@@ -349,100 +349,117 @@ export function registerAccountsRoutes(ctx, state) {
     }),
   }), 'dsh-subscriptions: /logout')
 
-  // #353: Encrypted Vault export
+  const handleVaultExport = safeJsonHandler(async (req, res) => {
+    if (req.method !== 'POST') {
+      writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+      return
+    }
+    if (!isTrustedSettingsRequest(req)) {
+      writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+      return
+    }
+    let payload
+    try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+      writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+      return
+    }
+    const passphrase = payload.passphrase
+    const algorithm = payload.algorithm || 'pbkdf2'
+    try {
+      const slots = live().slots || []
+      const blobs = {}
+      for (const slot of normalizeSlots(slots)) {
+        try {
+          const blob = await store.loadBlob(slot.ref)
+          if (blob) blobs[slot.ref] = blob
+        } catch { /* ignore */ }
+      }
+      const result = exportVault({ slots, blobs, algorithm }, passphrase)
+      writeJson(res, 200, result)
+    } catch (e) {
+      writeJson(res, 400, { ok: false, error: { code: 'vault_export', message: String(e && e.message || e) } })
+    }
+  })
+
+  // #353 & #396: Encrypted Vault export
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/vault/export',
-    handler: safeJsonHandler(async (req, res) => {
-      if (req.method !== 'POST') {
-        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
-        return
-      }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
-      let payload
-      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
-        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
-        return
-      }
-      const passphrase = payload.passphrase
-      try {
-        const slots = live().slots || []
-        const blobs = {}
-        for (const slot of normalizeSlots(slots)) {
-          try {
-            const blob = await store.loadBlob(slot.ref)
-            if (blob) blobs[slot.ref] = blob
-          } catch { /* ignore */ }
-        }
-        const result = exportVault({ slots, blobs }, passphrase)
-        writeJson(res, 200, result)
-      } catch (e) {
-        writeJson(res, 400, { ok: false, error: { code: 'vault_export', message: String(e && e.message || e) } })
-      }
-    }),
+    handler: handleVaultExport,
   }), 'dsh-subscriptions: /vault/export')
 
-  // #353: Encrypted Vault import
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
-    path: '/dsh-subscriptions/vault/import',
-    handler: safeJsonHandler(async (req, res) => {
-      if (req.method !== 'POST') {
-        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
-        return
-      }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
-      let payload
-      try { payload = JSON.parse((await readBody(req, 2 * 1024 * 1024)).toString('utf8') || '{}') } catch {
-        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
-        return
-      }
-      const { passphrase, vault } = payload
-      try {
-        const result = importVault(vault, passphrase)
-        const settings = getSettingsApi()
-        let parsed
-        if (result.slots.length) {
-          if (!settings) throw new Error('settings are unavailable for vault import')
-          const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
-          for (const s of result.slots) {
-            const idx = curSlots.findIndex((c) => c.provider === s.provider && Number(c.index) === Number(s.index))
-            if (idx >= 0) {
-              curSlots[idx] = { ...curSlots[idx], ...s }
-            } else {
-              curSlots.push(s)
-            }
+    path: '/dsh-subscriptions/export-backup',
+    handler: handleVaultExport,
+  }), 'dsh-subscriptions: /export-backup')
+
+  const handleVaultImport = safeJsonHandler(async (req, res) => {
+    if (req.method !== 'POST') {
+      writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+      return
+    }
+    if (!isTrustedSettingsRequest(req)) {
+      writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+      return
+    }
+    let payload
+    try { payload = JSON.parse((await readBody(req, 2 * 1024 * 1024)).toString('utf8') || '{}') } catch {
+      writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+      return
+    }
+    const { passphrase, vault } = payload
+    try {
+      const result = importVault(vault, passphrase)
+      const settings = getSettingsApi()
+      let parsed
+      if (result.slots.length) {
+        if (!settings) throw new Error('settings are unavailable for vault import')
+        const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
+        for (const s of result.slots) {
+          const idx = curSlots.findIndex((c) => c.provider === s.provider && Number(c.index) === Number(s.index))
+          if (idx >= 0) {
+            curSlots[idx] = { ...curSlots[idx], ...s }
+          } else {
+            curSlots.push(s)
           }
-          parsed = Config({ ...live(), slots: stripLegacySlots(curSlots) })
-        }
-        let blobCount = 0
-        for (const [ref, blob] of Object.entries(result.blobs)) {
-          await store.saveBlob(ref, blob)
-          blobCount++
-        }
-        if (parsed) {
-          await settings.replace(parsed)
-          syncCustomVendors()
         }
-        await syncAdapter()
-        refreshModels().catch(() => {})
-        writeJson(res, 200, {
-          ok: true,
-          slotCount: result.slots.length,
-          blobCount,
-          exportedAt: result.exportedAt,
-          accounts: await accountsView(),
-        })
-      } catch (e) {
-        writeJson(res, 400, { ok: false, error: { code: 'vault_import', message: String(e && e.message || e) } })
+        parsed = Config({ ...live(), slots: stripLegacySlots(curSlots) })
       }
-    }),
+      let blobCount = 0
+      for (const [ref, blob] of Object.entries(result.blobs)) {
+        await store.saveBlob(ref, blob)
+        blobCount++
+      }
+      if (parsed) {
+        await settings.replace(parsed)
+        syncCustomVendors()
+      }
+      await syncAdapter()
+      refreshModels().catch(() => {})
+      writeJson(res, 200, {
+        ok: true,
+        slotCount: result.slots.length,
+        blobCount,
+        exportedAt: result.exportedAt,
+        accounts: await accountsView(),
+      })
+    } catch (e) {
+      writeJson(res, 400, { ok: false, error: { code: 'vault_import', message: String(e && e.message || e) } })
+    }
+  })
+
+  // #353 & #396: Encrypted Vault import
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/import',
+    handler: handleVaultImport,
   }), 'dsh-subscriptions: /vault/import')
 
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import-backup',
+    handler: handleVaultImport,
+  }), 'dsh-subscriptions: /import-backup')
+
 }

package/lib/stream-rotate.js

@@ -1,4 +1,4 @@
-import { pickAccount, markCooldown, isSwitchableError, modelFamily } from './rotate.js'
+import { pickAccount, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED } from './quarantine.js'
 
 export async function* streamWithRotation({
@@ -45,38 +45,52 @@ export async function* streamWithRotation({
     tried.add(account.ref || account.id)
 
     let firstChunkDelivered = false
-    try {
-      for await (const chunk of streamOnce(account, options)) {
-        firstChunkDelivered = true
-        yield chunk
-      }
-      return
-    } catch (err) {
-      lastError = err
-      // If chunks were already yielded to the caller, never rotate mid-stream
-      // as that would repeat or scramble generated tokens.
-      if (firstChunkDelivered) throw err
-      if (!isSwitchableError(err)) throw err
+    let regionRetries = 0
+
+    while (true) {
+      try {
+        for await (const chunk of streamOnce(account, options)) {
+          firstChunkDelivered = true
+          yield chunk
+        }
+        return
+      } catch (err) {
+        lastError = err
+        // If chunks were already yielded to the caller, never rotate mid-stream
+        // as that would repeat or scramble generated tokens.
+        if (firstChunkDelivered) throw err
 
-      // Move slot to cooldown and quarantine (#172)
-      const cooled = markCooldown(account, nowMs(), cooldownMs, modelFamily(options && options.provider, options && options.model))
-      account.cooldownUntil = cooled.cooldownUntil
-      if (cooled.cooldownFamilies) account.cooldownFamilies = cooled.cooldownFamilies
+        // Transient region 400 error: retry same account up to 2 times before rotating (#391 / GH #9)
+        if (isRegionError(err) && regionRetries < 2 && (!options || !options.signal || !options.signal.aborted)) {
+          regionRetries++
+          await new Promise((r) => setTimeout(r, 400 * regionRetries))
+          if (options && options.signal && options.signal.aborted) throw err
+          continue
+        }
 
-      const status = Number(err && (err.status || err.statusCode) || 0)
-      const code = String(err && err.code || '')
-      const reason = (status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
-        ? REASON_REVOKED
-        : (status === 403 || code === 'HARD_LIMIT' || code === 'LICENSE_REQUIRED')
-          ? REASON_HARD_LIMIT
-          : REASON_RATE_LIMIT
+        if (!isSwitchableError(err)) throw err
 
-      const quarantined = putInQuarantine(account, reason, nowMs())
-      account.quarantineUntil = quarantined.quarantineUntil
-      account.quarantineReason = quarantined.quarantineReason
+        // Move slot to cooldown and quarantine (#172)
+        const cooled = markCooldown(account, nowMs(), cooldownMs, modelFamily(options && options.provider, options && options.model))
+        account.cooldownUntil = cooled.cooldownUntil
+        if (cooled.cooldownFamilies) account.cooldownFamilies = cooled.cooldownFamilies
 
-      if (onCooldown) onCooldown(account)
-      // Loop continues seamlessly to next slot if no chunk was delivered yet
+        const status = Number(err && (err.status || err.statusCode) || 0)
+        const code = String(err && err.code || '')
+        const reason = (status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
+          ? REASON_REVOKED
+          : (status === 403 || code === 'HARD_LIMIT' || code === 'LICENSE_REQUIRED')
+            ? REASON_HARD_LIMIT
+            : REASON_RATE_LIMIT
+
+        const quarantined = putInQuarantine(account, reason, nowMs())
+        account.quarantineUntil = quarantined.quarantineUntil
+        account.quarantineReason = quarantined.quarantineReason
+
+        if (onCooldown) onCooldown(account)
+        // Break inner retry loop to continue to next account in outer while (true) loop
+        break
+      }
     }
   }
 }

package/lib/usage.js

@@ -49,6 +49,24 @@ export function asUsageSnapshot(percent) {
   if (usedPercent == null) return null
   return { usedPercent }
 }
+
+export function parseResetAt(val) {
+  if (val == null) return null
+  if (typeof val === 'number' && Number.isFinite(val) && val > 0) {
+    return val < 1e11 ? Math.round(val * 1000) : Math.round(val)
+  }
+  if (typeof val === 'string' && val.trim()) {
+    const s = val.trim()
+    const n = Number(s)
+    if (Number.isFinite(n) && n > 0) {
+      return n < 1e11 ? Math.round(n * 1000) : Math.round(n)
+    }
+    const parsed = Date.parse(s)
+    if (Number.isFinite(parsed) && parsed > 0) return parsed
+  }
+  return null
+}
+
 // Named limit windows reported by vendors (five_hour, seven_day, primary...).
 // Label map is a data table: extend it when a vendor adds a window name.
 const WINDOW_LABELS = {
@@ -70,37 +88,73 @@ export function windowLabel(id) {
   return known || { zh: id, en: id }
 }
 
+function resolveWindowId(value, key) {
+  if (value && typeof value === 'object') {
+    const semantic = value.modelId ?? value.model ?? value.window ?? value.name ?? value.id ?? value.scope
+    if (typeof semantic === 'string' && semantic.trim() && !/^\d+$/.test(semantic.trim())) {
+      return { id: semantic.trim(), isModelBucket: Boolean(value.modelId || value.model) }
+    }
+  }
+  if (typeof key === 'string' && key.trim() && !/^\d+$/.test(key.trim())) {
+    return { id: key.trim(), isModelBucket: false }
+  }
+  return null
+}
+
 // Walk vendor usage JSON; every node carrying a utilization-style number
-// becomes a named window keyed by its JSON key.
+// becomes a named window keyed by its semantic identifier or JSON key.
 export function usageWindows(obj) {
   const out = []
   const seen = new Set()
   function walk(value, key, depth) {
-    if (!value || typeof value !== "object" || depth > 6) return
-    const pct = numberOrNull(
-      value.utilization ?? value.used_percent ?? value.usedPercent ?? value.creditUsagePercent ?? value.used_percentage,
-    )
-    if (pct != null && key && !seen.has(key)) {
-      seen.add(key)
-      const label = windowLabel(key)
-      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: pct })
-    }
-    const frac = numberOrNull(value.remainingFraction)
-    if (frac != null && key && !seen.has(key)) {
-      seen.add(key)
-      const label = windowLabel(key)
-      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: (1 - frac) * 100 })
-    }
-    const ufrac = numberOrNull(value.usedFraction)
-    if (ufrac != null && key && !seen.has(key)) {
-      seen.add(key)
-      const label = windowLabel(key)
-      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: ufrac * 100 })
+    if (!value || typeof value !== 'object' || depth > 6) return
+    const resolved = resolveWindowId(value, key)
+    if (resolved && !seen.has(resolved.id)) {
+      const pct = numberOrNull(
+        value.utilization ?? value.used_percent ?? value.usedPercent ?? value.creditUsagePercent ?? value.used_percentage,
+      )
+      const frac = numberOrNull(value.remainingFraction)
+      const ufrac = numberOrNull(value.usedFraction)
+      let usedPercent = null
+      if (pct != null) usedPercent = pct
+      else if (frac != null) usedPercent = (1 - frac) * 100
+      else if (ufrac != null) usedPercent = ufrac * 100
+
+      if (usedPercent != null) {
+        seen.add(resolved.id)
+        const label = windowLabel(resolved.id)
+        const rawReset = value.resetAt ?? value.reset_at ?? value.resetTime ?? value.resets_at ?? value.resetsAt ?? value.reset_time
+        const resetAt = parseResetAt(rawReset)
+        out.push({
+          id: resolved.id,
+          zh: label.zh,
+          en: label.en,
+          usedPercent,
+          ...(resetAt ? { resetAt } : {}),
+          isModelBucket: resolved.isModelBucket,
+        })
+      }
     }
     for (const [k, child] of Object.entries(value)) {
-      if (child && typeof child === "object") walk(child, k, depth + 1)
+      if (child && typeof child === 'object') walk(child, k, depth + 1)
     }
   }
-  walk(obj, "", 0)
-  return out.length ? out : null
+  walk(obj, '', 0)
+
+  // Separate model buckets from standard named windows
+  const standardWindows = out.filter((w) => !w.isModelBucket)
+  const modelBuckets = out.filter((w) => w.isModelBucket)
+
+  let keptModelBuckets = []
+  if (modelBuckets.length) {
+    // Only surface model buckets when usage > 0, keeping the tightest 1-2
+    const active = modelBuckets.filter((w) => w.usedPercent > 0)
+    if (active.length) {
+      active.sort((a, b) => b.usedPercent - a.usedPercent)
+      keptModelBuckets = active.slice(0, 2)
+    }
+  }
+
+  const result = [...standardWindows, ...keptModelBuckets].map(({ isModelBucket: _, ...rest }) => rest)
+  return result.length ? result : null
 }

package/lib/vault.js

@@ -9,7 +9,7 @@ export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
 /**
  * Encrypts slots configuration and credential blobs into a portable vault string.
  */
-export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions' }, passphrase) {
+export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'scrypt' }, passphrase) {
   const pass = String(passphrase || '').trim()
   if (!pass || pass.length < 4) {
     throw new Error('passphrase must be at least 4 characters')
@@ -24,7 +24,7 @@ export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscrip
     blobs: blobs && typeof blobs === 'object' ? blobs : {},
   }
 
-  const encrypted = encryptWithPassphrase(JSON.stringify(payload), pass)
+  const encrypted = encryptWithPassphrase(JSON.stringify(payload), pass, { algorithm })
   return {
     ok: true,
     vault: encrypted,
@@ -43,7 +43,7 @@ export function importVault(encryptedPayload, passphrase) {
   }
 
   const raw = String(encryptedPayload || '').trim()
-  if (!raw.startsWith('DSHE1:')) {
+  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:')) {
     throw new Error('invalid vault format: missing DSHE1 header')
   }
 

package/lib/vendors/copilot.js

@@ -42,6 +42,14 @@ export const COPILOT_MODELS = [
     maxTokens: 65536,
     inputModalities: ["text"],
     reasoning: { efforts: [{ id: "low", name: "Low" }, { id: "medium", name: "Medium" }, { id: "high", name: "High" }] }
+  },
+  {
+    id: "o1",
+    name: "o1 (Copilot)",
+    contextWindow: 200000,
+    maxTokens: 65536,
+    inputModalities: ["text", "image"],
+    reasoning: { efforts: [{ id: "low", name: "Low" }, { id: "medium", name: "Medium" }, { id: "high", name: "High" }] }
   }
 ]
 

package/lib/wire.js

@@ -190,7 +190,7 @@ export async function* openaiChatStream(body) {
       yield {
         type: 'tool-call-delta',
         index: block.index,
-        id: block.id,
+        id: String(block.id || `call_${block.index}`),
         ...(block.name ? { name: block.name } : {}),
         argumentsDelta: fragment,
       }
@@ -207,20 +207,24 @@ export { streamResponses as codexResponsesStream } from './responses-stream.js'
 export async function* anthropicStream(body) {
   let index = 0
   let textIndex = 0
+  const toolCallIds = new Map()
   for await (const data of iterateSse(body)) {
     const json = jsonSse(data)
     if (!json) continue
     if (json.type === 'content_block_start') {
       const block = json.content_block || {}
       if (block.type === 'text') {
-        textIndex = json.index || index++
+        textIndex = json.index ?? index++
         yield { type: 'block-start', index: textIndex, blockType: 'text' }
       } else if (block.type === 'tool_use') {
-        yield { type: 'block-start', index: json.index || index++, blockType: 'tool-call' }
+        const bIndex = json.index ?? index++
+        const toolId = String(block.id || `toolu_${bIndex}`)
+        toolCallIds.set(bIndex, toolId)
+        yield { type: 'block-start', index: bIndex, blockType: 'tool-call' }
         yield {
           type: 'tool-call-delta',
-          index: json.index || 0,
-          id: block.id,
+          index: bIndex,
+          id: toolId,
           name: block.name,
           argumentsDelta: '',
         }
@@ -228,16 +232,25 @@ export async function* anthropicStream(body) {
     } else if (json.type === 'content_block_delta') {
       const delta = json.delta || {}
       if (delta.type === 'text_delta' && delta.text) {
-        yield { type: 'text-delta', index: json.index || textIndex, text: delta.text }
+        yield { type: 'text-delta', index: json.index ?? textIndex, text: delta.text }
       } else if (delta.type === 'input_json_delta' && delta.partial_json) {
+        const bIndex = json.index ?? 0
+        const toolId = toolCallIds.get(bIndex) || `toolu_${bIndex}`
         yield {
           type: 'tool-call-delta',
-          index: json.index || 0,
+          index: bIndex,
+          id: toolId,
           argumentsDelta: delta.partial_json,
         }
       }
     } else if (json.type === 'message_delta' && json.usage) {
-      yield { type: 'usage', usage: json.usage }
+      yield {
+        type: 'usage',
+        usage: {
+          input: Number(json.usage.input_tokens ?? json.usage.input ?? 0) || 0,
+          output: Number(json.usage.output_tokens ?? json.usage.output ?? 0) || 0,
+        },
+      }
     }
   }
   yield { type: 'finish', reason: { kind: 'stop' } }
@@ -246,6 +259,8 @@ export async function* anthropicStream(body) {
 export async function* googleStream(body) {
   let index = 0
   let started = false
+  let callCount = 0
+  const functionCallIndexes = new Map()
   for await (const data of iterateSse(body)) {
     const json = jsonSse(data)
     const wrapped = json && json.response ? json.response : json
@@ -261,10 +276,23 @@ export async function* googleStream(body) {
         yield { type: 'text-delta', index, text: part.text }
       }
       if (part.functionCall) {
-        yield { type: 'block-start', index: index + 1, blockType: 'tool-call' }
+        const rawId = part.functionCall.id
+        let callIndex
+        let callId
+        if (rawId && functionCallIndexes.has(rawId)) {
+          callIndex = functionCallIndexes.get(rawId)
+          callId = String(rawId)
+        } else {
+          callCount++
+          callIndex = index + callCount
+          callId = String(rawId || `gemini_call_${callCount}`)
+          if (rawId) functionCallIndexes.set(rawId, callIndex)
+          yield { type: 'block-start', index: callIndex, blockType: 'tool-call' }
+        }
         yield {
           type: 'tool-call-delta',
-          index: index + 1,
+          index: callIndex,
+          id: callId,
           name: part.functionCall.name,
           argumentsDelta: JSON.stringify(part.functionCall.args || {}),
         }
@@ -274,8 +302,8 @@ export async function* googleStream(body) {
       yield {
         type: 'usage',
         usage: {
-          input: wrapped.usageMetadata.promptTokenCount,
-          output: wrapped.usageMetadata.candidatesTokenCount,
+          input: Number(wrapped.usageMetadata.promptTokenCount ?? 0) || 0,
+          output: Number(wrapped.usageMetadata.candidatesTokenCount ?? 0) || 0,
         },
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.25",
+  "version": "0.6.27",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",