@goodandready/dsh-subscriptions 0.6.27 → 0.6.29

package/lib/adapter-manager.js

@@ -46,6 +46,8 @@ export function createAdapterManager({
     getQuota: (ref) => store.getQuota(ref),
     refreshUsage: (provider) => store.refreshUsage(provider),
     saveBlob: (ref, blob) => store.saveBlob(ref, blob),
+    alertThresholds: () => live().alertThresholds,
+    webhookUrl: () => live().webhookUrl,
     recordHistory,
     fetchImpl: fetch,
     fetchForRef,

package/lib/adapter.js

@@ -4,6 +4,7 @@ import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
 import { modelCatalog } from './messages.js'
 import { streamWithRotation } from './stream-rotate.js'
+import { checkQuotaThresholds } from './alerts.js'
 import { pickFetch } from './proxy.js'
 import { quotaSnapshot, parseBody } from './ratelimit.js'
 import { toTokenUsage } from './wire.js'
@@ -112,6 +113,8 @@ export class SubscriptionAdapter extends LlmAdapter {
         cooldownMs: deps.cooldownMs(),
         switchAtRemaining: typeof deps.switchAtRemaining === 'function' ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0),
         options,
+        webhookUrl: typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl,
+        fetchImpl: deps.fetchImpl || fetch,
         onCooldown: (account) => {
           if (typeof deps.rememberCooldown === 'function') deps.rememberCooldown(account.ref, account.cooldownUntil, account.cooldownFamilies || null)
           if (typeof deps.recordSwitch === 'function') deps.recordSwitch(account.ref)
@@ -129,7 +132,21 @@ export class SubscriptionAdapter extends LlmAdapter {
             const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
-              if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
+              if (snap && typeof deps.rememberQuota === "function") {
+                deps.rememberQuota(account.ref, snap)
+                if (snap.usedPercent != null) {
+                  const th = typeof deps.alertThresholds === 'function' ? deps.alertThresholds() : deps.alertThresholds
+                  const wh = typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl
+                  checkQuotaThresholds({
+                    ref: account.ref,
+                    provider,
+                    usedPercent: snap.usedPercent,
+                    thresholds: th,
+                    webhookUrl: wh,
+                    fetchImpl: deps.fetchImpl || fetch,
+                  })
+                }
+              }
             } catch { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
@@ -139,7 +156,21 @@ export class SubscriptionAdapter extends LlmAdapter {
                   const b = parseBody(provider, j, Date.now())
                   if (b) {
                     const snap2 = quotaSnapshot(provider, res.headers, j, Date.now())
-                    if (snap2) deps.rememberQuota(account.ref, snap2)
+                    if (snap2) {
+                      deps.rememberQuota(account.ref, snap2)
+                      if (snap2.usedPercent != null) {
+                        const th = typeof deps.alertThresholds === 'function' ? deps.alertThresholds() : deps.alertThresholds
+                        const wh = typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl
+                        checkQuotaThresholds({
+                          ref: account.ref,
+                          provider,
+                          usedPercent: snap2.usedPercent,
+                          thresholds: th,
+                          webhookUrl: wh,
+                          fetchImpl: deps.fetchImpl || fetch,
+                        })
+                      }
+                    }
                   }
                 }
               } catch { /* ignore quota capture failure */ }

package/lib/alerts.js

@@ -1,3 +1,12 @@
+import { readFileSync } from 'node:fs'
+
+let pkgVersion = ''
+try {
+  pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || ''
+} catch {
+  // ignore package read errors
+}
+
 // #351: Proactive Quota Alerts & Webhook Dispatcher
 // Manages quota threshold warnings, session expiry notifications,
 // and webhook dispatch (e.g. Telegram/Discord or external monitoring).
@@ -70,7 +79,7 @@ export async function dispatchWebhookAlert(alert, webhookUrl, fetchImpl = fetch)
       method: 'POST',
       headers: {
         'content-type': 'application/json',
-        'user-agent': 'dsh-subscriptions/0.6.17',
+        'user-agent': pkgVersion ? `dsh-subscriptions/${pkgVersion}` : 'dsh-subscriptions',
       },
       body: JSON.stringify(payload),
     })

package/lib/client.js

@@ -149,7 +149,7 @@ window.__ModuleLoader__.load({
     '.dsub-slot-meta-row{display:flex;flex-wrap:wrap;align-items:center;gap:10px;margin-top:12px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2);font-size:12px}' +
     '.dsub-ref-tag{display:inline-flex;align-items:center;gap:5px;font-size:11.5px;color:var(--dsw-alias-label-secondary)}' +
     '.dsub-ref-tag code{padding:2px 6px;border-radius:4px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);font-family:ui-monospace,monospace;color:var(--dsw-alias-label-primary);font-size:11px}' +
-    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default,#3b82f6);background:color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 20%,transparent)}' +
+    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default);background:color-mix(in srgb,var(--dsw-alias-brand-default) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default) 20%,transparent)}' +
     '.dsub-btn-danger{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 40%,transparent)!important;color:var(--dsw-alias-state-error-primary)!important}' +
     '.dsub-btn-danger:hover:not(:disabled){background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent)!important}' +
     '.dsub-poolTitle{margin-top:16px;margin-bottom:8px;font-size:11.5px;font-weight:700;color:var(--dsw-alias-label-secondary);text-transform:uppercase;letter-spacing:.05em}' +
@@ -477,6 +477,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "save": "Save",
       "saved": "Saved",
       "loading": "Loading…",
+      "unavailable": "Settings are unavailable",
       "accountLabel": "Account",
       "plan": "Plan",
       "storedAs": "Stored as",
@@ -674,6 +675,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "save": "保存",
       "saved": "已保存",
       "loading": "加载中…",
+      "unavailable": "设置不可用",
       "accountLabel": "账户",
       "plan": "套餐方案",
       "storedAs": "存储标识",
@@ -2074,6 +2076,33 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       if (props && props.view === 'summary') {
         return React.createElement('div', { className: 'dsub-description' }, t('cardIntro'))
       }
+      // Check host snapshot status (#408): loading or unavailable
+      if (props && props.status === 'loading') {
+        return React.createElement(page ? 'div' : 'li', {
+          className: page ? 'dsub-page' : 'dsub-card',
+        },
+          React.createElement('div', { className: 'dsub-header', style: { cursor: 'default' } },
+            React.createElement('div', { className: 'dsub-headText' },
+              React.createElement('div', { className: 'dsub-name' }, t('title')),
+              React.createElement('div', { className: 'dsub-description' }, t('loading') || t('settingsLoading') || 'Loading…'),
+            ),
+          )
+        )
+      }
+      if (props && props.status === 'unavailable') {
+        return React.createElement(page ? 'div' : 'li', {
+          className: page ? 'dsub-page' : 'dsub-card',
+        },
+          React.createElement('div', { className: 'dsub-header', style: { cursor: 'default' } },
+            React.createElement('div', { className: 'dsub-headText' },
+              React.createElement('div', { className: 'dsub-name' }, t('title')),
+              React.createElement('div', { className: 'dsub-description', style: { color: 'var(--dsw-alias-state-warning-primary)' } },
+                t('unavailable') || t('settingsUnavailable') || 'Settings are unavailable',
+              ),
+            ),
+          )
+        )
+      }
       return React.createElement(page ? 'div' : 'li', {
         className: page ? 'dsub-page' : 'dsub-card' + (open ? ' dsub-cardOpen' : ''),
       },

package/lib/gemini-schema.js

@@ -1,3 +1,4 @@
+import { normalizeTools } from './tools-normalizer.js'
 const TYPE_MAP = {
   string: 'string',
   number: 'number',
@@ -33,7 +34,7 @@ export function toGeminiSchema(schema, depth) {
     else type = 'string'
   }
   const out = { type }
-  if (typed && typed.nullable) out.nullable = true
+  if ((typed && typed.nullable) || schema.nullable === true) out.nullable = true
   if (schema.description) out.description = String(schema.description)
   if (type === 'object') {
     const props = schema.properties
@@ -65,10 +66,11 @@ export function toGeminiSchema(schema, depth) {
 }
 
 export function geminiFunctionDeclarations(tools) {
-  if (!Array.isArray(tools) || !tools.length) return undefined
-  return tools.map((tool) => ({
+  const norm = normalizeTools(tools)
+  if (!norm) return undefined
+  return norm.map((tool) => ({
     name: tool.name,
-    description: tool.description || '',
-    parameters: toGeminiSchema(tool.parameters || { type: 'object' }),
+    description: tool.description,
+    parameters: toGeminiSchema(tool.parameters),
   }))
 }

package/lib/images.js

@@ -109,3 +109,128 @@ export async function generateOnce(options) {
   }
   return parseImages(payload)
 }
+
+// Multimodal Payload Normalization for Vision Models
+export function parseDataUri(uri) {
+  if (typeof uri !== 'string') return null
+  const m = /^data:([a-zA-Z0-9.+/-]+);base64,(.+)$/.exec(uri.trim())
+  if (!m) return null
+  return { mimeType: m[1], base64: m[2] }
+}
+
+export function normalizeImage(item) {
+  if (!item) return null
+
+  // 1. Direct string (data URI or URL)
+  if (typeof item === 'string') {
+    const dataUri = parseDataUri(item)
+    if (dataUri) {
+      return { mimeType: dataUri.mimeType, base64: dataUri.base64, url: item.trim() }
+    }
+    if (/^https?:\/\//i.test(item.trim())) {
+      return { mimeType: 'image/jpeg', base64: null, url: item.trim() }
+    }
+    return null
+  }
+
+  if (typeof item !== 'object') return null
+
+  // 2. Anthropic style: { type: 'image', source: { type: 'base64', media_type, data } }
+  if (item.source && item.source.type === 'base64' && item.source.data) {
+    const mimeType = item.source.media_type || 'image/jpeg'
+    const base64 = item.source.data
+    return {
+      mimeType,
+      base64,
+      url: `data:${mimeType};base64,${base64}`,
+    }
+  }
+
+  // 3. Gemini style: { inlineData: { mimeType, data } }
+  if (item.inlineData && item.inlineData.data) {
+    const mimeType = item.inlineData.mimeType || 'image/jpeg'
+    const base64 = item.inlineData.data
+    return {
+      mimeType,
+      base64,
+      url: `data:${mimeType};base64,${base64}`,
+    }
+  }
+
+  // 4. OpenAI style: { type: 'image_url', image_url: { url } } or { type: 'image', image: '...' }
+  const rawUrl = (item.image_url && (item.image_url.url || item.image_url)) ||
+                 item.image || item.url
+
+  if (typeof rawUrl === 'string') {
+    const dataUri = parseDataUri(rawUrl)
+    if (dataUri) {
+      return { mimeType: dataUri.mimeType, base64: dataUri.base64, url: rawUrl.trim() }
+    }
+    if (/^https?:\/\//i.test(rawUrl.trim())) {
+      return { mimeType: 'image/jpeg', base64: null, url: rawUrl.trim() }
+    }
+  }
+
+  return null
+}
+
+export function extractImages(content) {
+  if (!Array.isArray(content)) {
+    const norm = normalizeImage(content)
+    return norm ? [norm] : []
+  }
+  const images = []
+  for (const block of content) {
+    if (!block) continue
+    if (typeof block === 'string') {
+      const norm = normalizeImage(block)
+      if (norm) images.push(norm)
+      continue
+    }
+    if (block.type === 'image' || block.type === 'image_url' || block.inlineData || block.image_url || block.image) {
+      const norm = normalizeImage(block)
+      if (norm) images.push(norm)
+    }
+  }
+  return images
+}
+
+export function toOpenAiImage(norm) {
+  const url = norm.url || (norm.base64 ? `data:${norm.mimeType};base64,${norm.base64}` : null)
+  if (!url) return null
+  return {
+    type: 'image_url',
+    image_url: { url },
+  }
+}
+
+export function toAnthropicImage(norm) {
+  if (!norm.base64) return null
+  return {
+    type: 'image',
+    source: {
+      type: 'base64',
+      media_type: norm.mimeType || 'image/jpeg',
+      data: norm.base64,
+    },
+  }
+}
+
+export function toGeminiImage(norm) {
+  if (!norm.base64) return null
+  return {
+    inlineData: {
+      mimeType: norm.mimeType || 'image/jpeg',
+      data: norm.base64,
+    },
+  }
+}
+
+export function toCodexImage(norm) {
+  const url = norm.url || (norm.base64 ? `data:${norm.mimeType};base64,${norm.base64}` : null)
+  if (!url) return null
+  return {
+    type: 'input_image',
+    image_url: url,
+  }
+}

package/lib/messages.js

@@ -1,3 +1,5 @@
+import { extractImages, toOpenAiImage, toAnthropicImage, toGeminiImage, toCodexImage } from './images.js'
+import { normalizeTools } from './tools-normalizer.js'
 import { geminiFunctionDeclarations } from './gemini-schema.js'
 
 function flattenText(content) {
@@ -64,7 +66,18 @@ export function openaiMessages(options) {
     }
     const results = toolResults(message.content)
     const text = flattenText(message.content)
-    if (text || !results.length) out.push({ role: 'user', content: text })
+    const images = extractImages(message.content)
+    if (images.length) {
+      const parts = []
+      if (text) parts.push({ type: 'text', text })
+      for (const img of images) {
+        const blk = toOpenAiImage(img)
+        if (blk) parts.push(blk)
+      }
+      out.push({ role: 'user', content: parts })
+    } else if (text || !results.length) {
+      out.push({ role: 'user', content: text })
+    }
     for (const result of results) {
       out.push({
         role: 'tool',
@@ -77,14 +90,14 @@ export function openaiMessages(options) {
 }
 
 export function openaiTools(options) {
-  const tools = options.tools
-  if (!Array.isArray(tools) || !tools.length) return undefined
+  const tools = normalizeTools(options && options.tools)
+  if (!tools) return undefined
   return tools.map((tool) => ({
     type: 'function',
     function: {
       name: tool.name,
-      description: tool.description || '',
-      parameters: tool.parameters || { type: 'object' },
+      description: tool.description,
+      parameters: tool.parameters,
     },
   }))
 }
@@ -147,6 +160,18 @@ export function reconcileResponsesInput(items) {
   return result
 }
 
+export function normalizeSystemPrefix(parts) {
+  if (!Array.isArray(parts)) return ""
+  return parts
+    .map((p) => {
+      if (!p) return ""
+      const s = typeof p === "string" ? p : (p.text || String(p))
+      return s.replace(/\r\n/g, "\n").trim()
+    })
+    .filter(Boolean)
+    .join("\n\n")
+}
+
 export function codexResponsesBody(options, fallbackInstructions, vendorCfg) {
   const systemParts = []
   if (options.system) systemParts.push(options.system)
@@ -215,6 +240,15 @@ export function codexResponsesBody(options, fallbackInstructions, vendorCfg) {
     const results = toolResults(message.content)
     const text = flattenText(message.content)
     if (text) addText('user', text)
+    const images = extractImages(message.content)
+    for (const img of images) {
+      const blk = toCodexImage(img)
+      if (blk) {
+        if (pendingRole && pendingRole !== 'user') flush()
+        pendingRole = 'user'
+        pendingContent.push(blk)
+      }
+    }
     for (const result of results) {
       flush()
       const callId = String(result.toolCallId || result.tool_call_id || result.call_id || result.id || '')
@@ -239,7 +273,7 @@ export function codexResponsesBody(options, fallbackInstructions, vendorCfg) {
     description: tool.function.description,
     parameters: tool.function.parameters,
   }))
-  const instructions = systemParts.filter(Boolean).join('\n\n') || fallbackInstructions
+  const instructions = normalizeSystemPrefix(systemParts) || (fallbackInstructions ? fallbackInstructions.replace(/\r\n/g, "\n").trim() : undefined)
   return {
     model: options.model,
     stream: true,
@@ -265,77 +299,123 @@ export function anthropicPayload(options, extraSystem) {
   if (options.system) systemParts.push(options.system)
   const messages = []
   for (const message of options.messages || []) {
-    if (message.role === 'system') {
+    if (message.role === "system") {
       systemParts.push(flattenText(message.content))
       continue
     }
-    if (message.role === 'assistant') {
+    if (message.role === "assistant") {
       const blocks = []
       const text = flattenText(message.content)
-      if (text) blocks.push({ type: 'text', text })
+      if (text) blocks.push({ type: "text", text })
       const calls = [
         ...toolCalls(message.content),
         ...((message.tool_calls || message.toolCalls || []).map((c) => ({
           id: c.id || c.call_id,
           name: c.name || (c.function && c.function.name),
-          arguments: c.arguments || (c.function && c.function.arguments) || '{}',
+          arguments: c.arguments || (c.function && c.function.arguments) || "{}",
         }))),
       ]
       for (const call of calls) {
         if (!call.id) continue
         blocks.push({
-          type: 'tool_use',
+          type: "tool_use",
           id: call.id,
           name: call.name,
           input: safeJson(call.arguments),
         })
       }
-      messages.push({ role: 'assistant', content: blocks.length ? blocks : [{ type: 'text', text: '' }] })
+      messages.push({ role: "assistant", content: blocks.length ? blocks : [{ type: "text", text: "" }] })
       continue
     }
-    if (message.role === 'tool') {
-      const toolUseId = String(message.toolCallId || message.tool_call_id || message.tool_use_id || message.id || '')
-      const content = typeof message.content === 'string'
+    if (message.role === "tool") {
+      const toolUseId = String(message.toolCallId || message.tool_call_id || message.tool_use_id || message.id || "")
+      const content = typeof message.content === "string"
         ? message.content
-        : (flattenText(message.content) || JSON.stringify(message.content || ''))
+        : (flattenText(message.content) || JSON.stringify(message.content || ""))
       messages.push({
-        role: 'user',
+        role: "user",
         content: [{
-          type: 'tool_result',
+          type: "tool_result",
           tool_use_id: toolUseId,
-          content: content || '',
+          content: content || "",
         }],
       })
       continue
     }
     const blocks = []
     const text = flattenText(message.content)
-    if (text) blocks.push({ type: 'text', text })
+    if (text) blocks.push({ type: "text", text })
+    const images = extractImages(message.content)
+    for (const img of images) {
+      const blk = toAnthropicImage(img)
+      if (blk) blocks.push(blk)
+    }
     for (const result of toolResults(message.content)) {
-      const toolUseId = String(result.toolCallId || result.tool_call_id || result.tool_use_id || result.id || '')
-      const content = typeof result.content === 'string'
+      const toolUseId = String(result.toolCallId || result.tool_call_id || result.tool_use_id || result.id || "")
+      const content = typeof result.content === "string"
         ? result.content
-        : (flattenText(result.content) || (result.output != null ? (typeof result.output === 'string' ? result.output : JSON.stringify(result.output)) : ''))
+        : (flattenText(result.content) || (result.output != null ? (typeof result.output === "string" ? result.output : JSON.stringify(result.output)) : ""))
       blocks.push({
-        type: 'tool_result',
+        type: "tool_result",
         tool_use_id: toolUseId,
-        content: content || '',
+        content: content || "",
       })
     }
-    messages.push({ role: 'user', content: blocks.length ? blocks : [{ type: 'text', text: '' }] })
+    messages.push({ role: "user", content: blocks.length ? blocks : [{ type: "text", text: "" }] })
   }
-  const tools = Array.isArray(options.tools)
-    ? options.tools.map((tool) => ({
-      name: tool.name,
-      description: tool.description || '',
-      input_schema: tool.parameters || { type: 'object' },
-    }))
+
+  const useCacheControl = options.cacheControl !== false
+  const systemText = normalizeSystemPrefix(systemParts)
+  let system
+  if (systemText) {
+    if (useCacheControl) {
+      system = [{ type: "text", text: systemText, cache_control: { type: "ephemeral" } }]
+    } else {
+      system = systemText
+    }
+  }
+
+  const normTools = normalizeTools(options.tools)
+  const tools = normTools
+    ? normTools.map((tool, idx) => {
+      const item = {
+        name: tool.name,
+        description: tool.description,
+        input_schema: tool.parameters,
+      }
+      if (useCacheControl && idx === normTools.length - 1) {
+        item.cache_control = { type: "ephemeral" }
+      }
+      return item
+    })
     : undefined
+
+  if (useCacheControl) {
+    const userTurnIndices = []
+    for (let i = 0; i < messages.length; i++) {
+      if (messages[i].role === "user") {
+        userTurnIndices.push(i)
+      }
+    }
+    if (userTurnIndices.length >= 2) {
+      const targetIdx = userTurnIndices[userTurnIndices.length - 2]
+      const targetMsg = messages[targetIdx]
+      if (Array.isArray(targetMsg.content) && targetMsg.content.length > 0) {
+        const lastBlockIdx = targetMsg.content.length - 1
+        const lastBlock = targetMsg.content[lastBlockIdx]
+        targetMsg.content[lastBlockIdx] = {
+          ...lastBlock,
+          cache_control: { type: "ephemeral" },
+        }
+      }
+    }
+  }
+
   return {
     model: options.model,
     max_tokens: options.maxTokens || 8192,
     stream: true,
-    ...(systemParts.length ? { system: systemParts.join('\n\n') } : {}),
+    ...(system ? { system } : {}),
     messages,
     ...(tools && tools.length ? { tools } : {}),
     ...(options.temperature != null ? { temperature: options.temperature } : {}),
@@ -371,6 +451,11 @@ export function googleContents(options) {
     const parts = []
     const text = flattenText(message.content)
     if (text) parts.push({ text })
+    const images = extractImages(message.content)
+    for (const img of images) {
+      const blk = toGeminiImage(img)
+      if (blk) parts.push(blk)
+    }
     const calls = [
       ...toolCalls(message.content),
       ...((message.tool_calls || message.toolCalls || []).map((c) => ({
@@ -400,7 +485,10 @@ export function googleContents(options) {
   const tools = declarations ? [{ functionDeclarations: declarations }] : undefined
   return {
     contents,
-    ...(systemParts.length ? { systemInstruction: { parts: systemParts } } : {}),
+    ...(() => {
+      const systemText = normalizeSystemPrefix(systemParts)
+      return systemText ? { systemInstruction: { parts: [{ text: systemText }] } } : {}
+    })(),
     ...(tools ? { tools } : {}),
     generationConfig: {
       ...(options.temperature != null ? { temperature: options.temperature } : {}),

package/lib/routes.js

@@ -24,6 +24,10 @@ export function registerRoutes(ctx, state) {
 
   ctx.effect(() => registerPluginUpdater(ctx, {
     endpoint: '/dsh-subscriptions/update',
+    aliases: [
+      '/api/@goodandready/dsh-subscriptions/update',
+      '/api/dsh-subscriptions/update',
+    ],
     packageName: '@goodandready/dsh-subscriptions',
     manifestUrl: new URL('../package.json', import.meta.url),
   }), 'dsh-subscriptions: /update')

package/lib/runaway-guard.js

@@ -0,0 +1,105 @@
+export class RunawayDetector {
+  constructor(options = {}) {
+    this.maxIdenticalConsecutive = options.maxIdenticalConsecutive || 30
+    this.maxPatternRepetitions = options.maxPatternRepetitions || 6
+    this.minPatternLength = options.minPatternLength || 4
+    this.maxPatternLength = options.maxPatternLength || 80
+    this.history = ''
+    this.lastChunk = null
+    this.identicalCount = 0
+    this.tripped = false
+    this.reason = null
+  }
+
+  feed(text) {
+    if (this.tripped || !text || typeof text !== 'string') return false
+
+    // 1. Check identical consecutive text chunks
+    if (this.lastChunk === text) {
+      this.identicalCount++
+      if (this.identicalCount >= this.maxIdenticalConsecutive) {
+        this.tripped = true
+        this.reason = `identical_chunk_loop (${this.identicalCount} repetitions of "${text.slice(0, 16)}")`
+        return true
+      }
+    } else {
+      this.lastChunk = text
+      this.identicalCount = 1
+    }
+
+    // 2. Sliding window n-gram repetition detection
+    const maxHistLen = this.maxPatternLength * this.maxPatternRepetitions + 128
+    this.history += text
+    if (this.history.length > maxHistLen * 2) {
+      this.history = this.history.slice(-maxHistLen)
+    }
+
+    const hLen = this.history.length
+    for (let pLen = this.minPatternLength; pLen <= this.maxPatternLength; pLen++) {
+      const requiredLen = pLen * this.maxPatternRepetitions
+      if (hLen < requiredLen) break
+
+      const pattern = this.history.slice(hLen - pLen)
+      let matches = 0
+      for (let i = 1; i < this.maxPatternRepetitions; i++) {
+        const seg = this.history.slice(hLen - (i + 1) * pLen, hLen - i * pLen)
+        if (seg === pattern) {
+          matches++
+        } else {
+          break
+        }
+      }
+      if (matches >= this.maxPatternRepetitions - 1) {
+        this.tripped = true
+        this.reason = `pattern_repetition_loop (${pLen} chars repeated ${this.maxPatternRepetitions} times: "${pattern.slice(0, 20)}...")`
+        return true
+      }
+    }
+
+    return false
+  }
+
+  isTripped() {
+    return this.tripped
+  }
+
+  getReason() {
+    return this.reason
+  }
+}
+
+export async function* withRunawayGuard(stream, options = {}) {
+  if (options && options.enabled === false) {
+    yield* stream
+    return
+  }
+
+  const detector = new RunawayDetector(options)
+
+  for await (const chunk of stream) {
+    if (chunk && chunk.type === 'finish') {
+      yield chunk
+      return
+    }
+
+    const text = (chunk && typeof chunk === 'object')
+      ? (typeof chunk.text === 'string' ? chunk.text : null)
+      : null
+
+    if (text && (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta' || !chunk.type)) {
+      if (detector.feed(text)) {
+        yield {
+          type: 'finish',
+          reason: {
+            kind: 'stop',
+            message: 'runaway_loop_detected',
+            detail: detector.getReason(),
+          },
+        }
+        return
+      }
+    }
+
+    yield chunk
+  }
+}

package/lib/stream-rotate.js

@@ -1,5 +1,7 @@
 import { pickAccount, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED } from './quarantine.js'
+import { notifySessionExpired } from './alerts.js'
+import { withRunawayGuard } from './runaway-guard.js'
 
 export async function* streamWithRotation({
   accounts,
@@ -11,6 +13,8 @@ export async function* streamWithRotation({
   onCooldown,
   cascadeFallback, // #349: optional cross-vendor cascading fallback generator
   offlineFallback, // #174: optional fallback generator if all accounts exhausted
+  webhookUrl,
+  fetchImpl = fetch,
 }) {
   const pool = (accounts || []).map((account) => ({ ...account }))
   let lastError = null
@@ -49,7 +53,8 @@ export async function* streamWithRotation({
 
     while (true) {
       try {
-        for await (const chunk of streamOnce(account, options)) {
+        const guardedStream = withRunawayGuard(streamOnce(account, options), options && options.runawayGuard)
+        for await (const chunk of guardedStream) {
           firstChunkDelivered = true
           yield chunk
         }
@@ -87,6 +92,19 @@ export async function* streamWithRotation({
         account.quarantineUntil = quarantined.quarantineUntil
         account.quarantineReason = quarantined.quarantineReason
 
+        if (reason === REASON_REVOKED) {
+          try {
+            notifySessionExpired({
+              ref: account.ref,
+              provider: options && options.provider,
+              message: err && err.message,
+              webhookUrl: webhookUrl || (options && options.webhookUrl),
+              fetchImpl,
+              nowMs: nowMs(),
+            })
+          } catch { /* fire-and-forget alert */ }
+        }
+
         if (onCooldown) onCooldown(account)
         // Break inner retry loop to continue to next account in outer while (true) loop
         break

package/lib/tools-normalizer.js

@@ -0,0 +1,118 @@
+export function sanitizeToolName(name) {
+  if (typeof name !== 'string' || !name.trim()) return 'tool_fn'
+  const sanitized = name.trim().replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64)
+  return sanitized || 'tool_fn'
+}
+
+export function sanitizeDescription(desc) {
+  if (typeof desc === 'string') return desc.trim()
+  if (desc == null) return ''
+  return String(desc).trim()
+}
+
+export function normalizeJsonSchema(schema, depth = 0) {
+  if (depth > 12) return { type: 'string' }
+  if (!schema || typeof schema !== 'object') {
+    return { type: 'object' }
+  }
+  if (Array.isArray(schema)) {
+    return normalizeJsonSchema(schema[0] || { type: 'object' }, depth + 1)
+  }
+
+  const out = {}
+
+  let type = schema.type
+  let nullable = false
+  if (Array.isArray(type)) {
+    nullable = type.includes('null')
+    type = type.find((t) => t && t !== 'null') || 'string'
+  }
+  if (typeof type === 'string') {
+    out.type = type.toLowerCase()
+  } else if (schema.properties) {
+    out.type = 'object'
+  } else if (schema.items) {
+    out.type = 'array'
+  } else {
+    out.type = depth === 0 ? 'object' : 'string'
+  }
+
+  if (nullable) {
+    out.nullable = true
+  }
+
+  if (schema.description) {
+    out.description = String(schema.description)
+  }
+
+  if (out.type === 'object') {
+    if (schema.properties && typeof schema.properties === 'object' && !Array.isArray(schema.properties)) {
+      out.properties = {}
+      for (const [key, val] of Object.entries(schema.properties)) {
+        if (typeof key === 'string' && key) {
+          out.properties[key] = normalizeJsonSchema(val, depth + 1)
+        }
+      }
+    }
+
+    if (Array.isArray(schema.required)) {
+      const propKeys = new Set(Object.keys(out.properties))
+      const reqs = schema.required
+        .filter((k) => typeof k === 'string' && k.length > 0)
+        .filter((k) => propKeys.size === 0 || propKeys.has(k))
+      if (reqs.length > 0) {
+        out.required = [...new Set(reqs)]
+      }
+    }
+
+    if (typeof schema.additionalProperties === 'boolean') {
+      out.additionalProperties = schema.additionalProperties
+    }
+  } else if (out.type === 'array') {
+    if (schema.items) {
+      out.items = normalizeJsonSchema(
+        Array.isArray(schema.items) ? schema.items[0] : schema.items,
+        depth + 1,
+      )
+    } else {
+      out.items = { type: 'string' }
+    }
+  }
+
+  if (Array.isArray(schema.enum) && schema.enum.length > 0) {
+    const cleaned = [...new Set(
+      schema.enum
+        .map((item) => (item != null ? String(item).trim() : ''))
+        .filter((item) => item.length > 0),
+    )]
+    if (cleaned.length > 0) {
+      out.enum = cleaned
+    }
+  }
+
+  return out
+}
+
+export function normalizeTools(tools) {
+  if (!Array.isArray(tools) || !tools.length) return undefined
+  const validTools = []
+
+  for (const tool of tools) {
+    if (!tool || typeof tool !== 'object') continue
+    const rawName = tool.name || (tool.function && tool.function.name)
+    if (!rawName) continue
+
+    const name = sanitizeToolName(rawName)
+    const description = sanitizeDescription(tool.description || (tool.function && tool.function.description))
+    const rawParams = tool.parameters || tool.input_schema || (tool.function && tool.function.parameters)
+    const parameters = normalizeJsonSchema(rawParams)
+
+    validTools.push({
+      name,
+      description,
+      parameters,
+    })
+  }
+
+  return validTools.length ? validTools : undefined
+}

package/lib/updater.js

@@ -4,7 +4,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { writeJson } from './http.js'
+import { isTrustedSettingsRequest, writeJson } from './http.js'
 
 const UPDATE_HEADER = 'x-dsh-plugin-update'
 const UPDATE_TIMEOUT_MS = 10 * 60_000
@@ -25,24 +25,11 @@ export function isLoopback(value) {
 
 export function isTrustedUpdateRequest(request) {
   const customHeader = header(request, UPDATE_HEADER)
-  if (customHeader !== '1') {
-    // In browser fetch, allow if sec-fetch-site is same-origin or same-site
-    const site = header(request, 'sec-fetch-site')
-    if (site === 'cross-site') return false
+  if (customHeader === '1') {
+    const remote = request.socket?.remoteAddress
+    if (remote && isLoopback(remote)) return true
   }
-  const remote = request.socket?.remoteAddress
-  if (remote && !isLoopback(remote)) return false
-  const origin = header(request, 'origin')
-  const host = header(request, 'host')
-  if (origin && host) {
-    try {
-      const url = new URL(origin)
-      if (url.host !== host && !isLoopback(url.hostname)) return false
-    } catch {
-      return false
-    }
-  }
-  return true
+  return isTrustedSettingsRequest(request)
 }
 
 function validProfileName(value) {
@@ -206,10 +193,11 @@ export async function installExactPackage(target, packageSpec, options) {
 
 export function registerPluginUpdater(ctx, options) {
   let installing = false
-  return ctx.webServer.register({
-    kind: 'exact',
-    path: options.endpoint,
-    handler: async (request, response) => {
+  const endpoints = Array.isArray(options.endpoint)
+    ? options.endpoint
+    : [options.endpoint, ...(Array.isArray(options.aliases) ? options.aliases : [])]
+
+  const handler = async (request, response) => {
       try {
         const target = getRuntime()
         if (request.method === 'GET' || request.method === 'HEAD') {
@@ -255,6 +243,17 @@ export function registerPluginUpdater(ctx, options) {
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
         writeJson(response, 503, { ok: false, error: { code: 'update_failed', message: String(error?.message || error) } })
       }
-    },
-  })
+  }
+
+  const unregisters = endpoints.map((ep) => ctx.webServer.register({
+    kind: 'exact',
+    path: ep,
+    handler,
+  }))
+
+  return () => {
+    for (const un of unregisters) {
+      if (typeof un === 'function') un()
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.27",
+  "version": "0.6.29",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",