@goodandready/dsh-subscriptions 0.6.28 → 0.6.29

package/lib/adapter-manager.js

@@ -46,6 +46,8 @@ export function createAdapterManager({
     getQuota: (ref) => store.getQuota(ref),
     refreshUsage: (provider) => store.refreshUsage(provider),
     saveBlob: (ref, blob) => store.saveBlob(ref, blob),
+    alertThresholds: () => live().alertThresholds,
+    webhookUrl: () => live().webhookUrl,
     recordHistory,
     fetchImpl: fetch,
     fetchForRef,

package/lib/adapter.js

@@ -4,6 +4,7 @@ import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
 import { modelCatalog } from './messages.js'
 import { streamWithRotation } from './stream-rotate.js'
+import { checkQuotaThresholds } from './alerts.js'
 import { pickFetch } from './proxy.js'
 import { quotaSnapshot, parseBody } from './ratelimit.js'
 import { toTokenUsage } from './wire.js'
@@ -112,6 +113,8 @@ export class SubscriptionAdapter extends LlmAdapter {
         cooldownMs: deps.cooldownMs(),
         switchAtRemaining: typeof deps.switchAtRemaining === 'function' ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0),
         options,
+        webhookUrl: typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl,
+        fetchImpl: deps.fetchImpl || fetch,
         onCooldown: (account) => {
           if (typeof deps.rememberCooldown === 'function') deps.rememberCooldown(account.ref, account.cooldownUntil, account.cooldownFamilies || null)
           if (typeof deps.recordSwitch === 'function') deps.recordSwitch(account.ref)
@@ -129,7 +132,21 @@ export class SubscriptionAdapter extends LlmAdapter {
             const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
-              if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
+              if (snap && typeof deps.rememberQuota === "function") {
+                deps.rememberQuota(account.ref, snap)
+                if (snap.usedPercent != null) {
+                  const th = typeof deps.alertThresholds === 'function' ? deps.alertThresholds() : deps.alertThresholds
+                  const wh = typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl
+                  checkQuotaThresholds({
+                    ref: account.ref,
+                    provider,
+                    usedPercent: snap.usedPercent,
+                    thresholds: th,
+                    webhookUrl: wh,
+                    fetchImpl: deps.fetchImpl || fetch,
+                  })
+                }
+              }
             } catch { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
@@ -139,7 +156,21 @@ export class SubscriptionAdapter extends LlmAdapter {
                   const b = parseBody(provider, j, Date.now())
                   if (b) {
                     const snap2 = quotaSnapshot(provider, res.headers, j, Date.now())
-                    if (snap2) deps.rememberQuota(account.ref, snap2)
+                    if (snap2) {
+                      deps.rememberQuota(account.ref, snap2)
+                      if (snap2.usedPercent != null) {
+                        const th = typeof deps.alertThresholds === 'function' ? deps.alertThresholds() : deps.alertThresholds
+                        const wh = typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl
+                        checkQuotaThresholds({
+                          ref: account.ref,
+                          provider,
+                          usedPercent: snap2.usedPercent,
+                          thresholds: th,
+                          webhookUrl: wh,
+                          fetchImpl: deps.fetchImpl || fetch,
+                        })
+                      }
+                    }
                   }
                 }
               } catch { /* ignore quota capture failure */ }

package/lib/alerts.js

@@ -1,3 +1,12 @@
+import { readFileSync } from 'node:fs'
+
+let pkgVersion = ''
+try {
+  pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || ''
+} catch {
+  // ignore package read errors
+}
+
 // #351: Proactive Quota Alerts & Webhook Dispatcher
 // Manages quota threshold warnings, session expiry notifications,
 // and webhook dispatch (e.g. Telegram/Discord or external monitoring).
@@ -70,7 +79,7 @@ export async function dispatchWebhookAlert(alert, webhookUrl, fetchImpl = fetch)
       method: 'POST',
       headers: {
         'content-type': 'application/json',
-        'user-agent': 'dsh-subscriptions/0.6.17',
+        'user-agent': pkgVersion ? `dsh-subscriptions/${pkgVersion}` : 'dsh-subscriptions',
       },
       body: JSON.stringify(payload),
     })

package/lib/client.js

@@ -149,7 +149,7 @@ window.__ModuleLoader__.load({
     '.dsub-slot-meta-row{display:flex;flex-wrap:wrap;align-items:center;gap:10px;margin-top:12px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2);font-size:12px}' +
     '.dsub-ref-tag{display:inline-flex;align-items:center;gap:5px;font-size:11.5px;color:var(--dsw-alias-label-secondary)}' +
     '.dsub-ref-tag code{padding:2px 6px;border-radius:4px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);font-family:ui-monospace,monospace;color:var(--dsw-alias-label-primary);font-size:11px}' +
-    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default,#3b82f6);background:color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 20%,transparent)}' +
+    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default);background:color-mix(in srgb,var(--dsw-alias-brand-default) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default) 20%,transparent)}' +
     '.dsub-btn-danger{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 40%,transparent)!important;color:var(--dsw-alias-state-error-primary)!important}' +
     '.dsub-btn-danger:hover:not(:disabled){background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent)!important}' +
     '.dsub-poolTitle{margin-top:16px;margin-bottom:8px;font-size:11.5px;font-weight:700;color:var(--dsw-alias-label-secondary);text-transform:uppercase;letter-spacing:.05em}' +
@@ -477,6 +477,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "save": "Save",
       "saved": "Saved",
       "loading": "Loading…",
+      "unavailable": "Settings are unavailable",
       "accountLabel": "Account",
       "plan": "Plan",
       "storedAs": "Stored as",
@@ -674,6 +675,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "save": "保存",
       "saved": "已保存",
       "loading": "加载中…",
+      "unavailable": "设置不可用",
       "accountLabel": "账户",
       "plan": "套餐方案",
       "storedAs": "存储标识",
@@ -2074,6 +2076,33 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       if (props && props.view === 'summary') {
         return React.createElement('div', { className: 'dsub-description' }, t('cardIntro'))
       }
+      // Check host snapshot status (#408): loading or unavailable
+      if (props && props.status === 'loading') {
+        return React.createElement(page ? 'div' : 'li', {
+          className: page ? 'dsub-page' : 'dsub-card',
+        },
+          React.createElement('div', { className: 'dsub-header', style: { cursor: 'default' } },
+            React.createElement('div', { className: 'dsub-headText' },
+              React.createElement('div', { className: 'dsub-name' }, t('title')),
+              React.createElement('div', { className: 'dsub-description' }, t('loading') || t('settingsLoading') || 'Loading…'),
+            ),
+          )
+        )
+      }
+      if (props && props.status === 'unavailable') {
+        return React.createElement(page ? 'div' : 'li', {
+          className: page ? 'dsub-page' : 'dsub-card',
+        },
+          React.createElement('div', { className: 'dsub-header', style: { cursor: 'default' } },
+            React.createElement('div', { className: 'dsub-headText' },
+              React.createElement('div', { className: 'dsub-name' }, t('title')),
+              React.createElement('div', { className: 'dsub-description', style: { color: 'var(--dsw-alias-state-warning-primary)' } },
+                t('unavailable') || t('settingsUnavailable') || 'Settings are unavailable',
+              ),
+            ),
+          )
+        )
+      }
       return React.createElement(page ? 'div' : 'li', {
         className: page ? 'dsub-page' : 'dsub-card' + (open ? ' dsub-cardOpen' : ''),
       },

package/lib/routes.js

@@ -24,6 +24,10 @@ export function registerRoutes(ctx, state) {
 
   ctx.effect(() => registerPluginUpdater(ctx, {
     endpoint: '/dsh-subscriptions/update',
+    aliases: [
+      '/api/@goodandready/dsh-subscriptions/update',
+      '/api/dsh-subscriptions/update',
+    ],
     packageName: '@goodandready/dsh-subscriptions',
     manifestUrl: new URL('../package.json', import.meta.url),
   }), 'dsh-subscriptions: /update')

package/lib/stream-rotate.js

@@ -1,5 +1,6 @@
 import { pickAccount, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED } from './quarantine.js'
+import { notifySessionExpired } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
 
 export async function* streamWithRotation({
@@ -12,6 +13,8 @@ export async function* streamWithRotation({
   onCooldown,
   cascadeFallback, // #349: optional cross-vendor cascading fallback generator
   offlineFallback, // #174: optional fallback generator if all accounts exhausted
+  webhookUrl,
+  fetchImpl = fetch,
 }) {
   const pool = (accounts || []).map((account) => ({ ...account }))
   let lastError = null
@@ -89,6 +92,19 @@ export async function* streamWithRotation({
         account.quarantineUntil = quarantined.quarantineUntil
         account.quarantineReason = quarantined.quarantineReason
 
+        if (reason === REASON_REVOKED) {
+          try {
+            notifySessionExpired({
+              ref: account.ref,
+              provider: options && options.provider,
+              message: err && err.message,
+              webhookUrl: webhookUrl || (options && options.webhookUrl),
+              fetchImpl,
+              nowMs: nowMs(),
+            })
+          } catch { /* fire-and-forget alert */ }
+        }
+
         if (onCooldown) onCooldown(account)
         // Break inner retry loop to continue to next account in outer while (true) loop
         break

package/lib/updater.js

@@ -4,7 +4,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { writeJson } from './http.js'
+import { isTrustedSettingsRequest, writeJson } from './http.js'
 
 const UPDATE_HEADER = 'x-dsh-plugin-update'
 const UPDATE_TIMEOUT_MS = 10 * 60_000
@@ -25,24 +25,11 @@ export function isLoopback(value) {
 
 export function isTrustedUpdateRequest(request) {
   const customHeader = header(request, UPDATE_HEADER)
-  if (customHeader !== '1') {
-    // In browser fetch, allow if sec-fetch-site is same-origin or same-site
-    const site = header(request, 'sec-fetch-site')
-    if (site === 'cross-site') return false
+  if (customHeader === '1') {
+    const remote = request.socket?.remoteAddress
+    if (remote && isLoopback(remote)) return true
   }
-  const remote = request.socket?.remoteAddress
-  if (remote && !isLoopback(remote)) return false
-  const origin = header(request, 'origin')
-  const host = header(request, 'host')
-  if (origin && host) {
-    try {
-      const url = new URL(origin)
-      if (url.host !== host && !isLoopback(url.hostname)) return false
-    } catch {
-      return false
-    }
-  }
-  return true
+  return isTrustedSettingsRequest(request)
 }
 
 function validProfileName(value) {
@@ -206,10 +193,11 @@ export async function installExactPackage(target, packageSpec, options) {
 
 export function registerPluginUpdater(ctx, options) {
   let installing = false
-  return ctx.webServer.register({
-    kind: 'exact',
-    path: options.endpoint,
-    handler: async (request, response) => {
+  const endpoints = Array.isArray(options.endpoint)
+    ? options.endpoint
+    : [options.endpoint, ...(Array.isArray(options.aliases) ? options.aliases : [])]
+
+  const handler = async (request, response) => {
       try {
         const target = getRuntime()
         if (request.method === 'GET' || request.method === 'HEAD') {
@@ -255,6 +243,17 @@ export function registerPluginUpdater(ctx, options) {
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
         writeJson(response, 503, { ok: false, error: { code: 'update_failed', message: String(error?.message || error) } })
       }
-    },
-  })
+  }
+
+  const unregisters = endpoints.map((ep) => ctx.webServer.register({
+    kind: 'exact',
+    path: ep,
+    handler,
+  }))
+
+  return () => {
+    for (const un of unregisters) {
+      if (typeof un === 'function') un()
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.28",
+  "version": "0.6.29",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",