@goodandready/dsh-subscriptions 0.6.28 → 0.6.30

package/lib/adapter-manager.js

@@ -46,6 +46,8 @@ export function createAdapterManager({
     getQuota: (ref) => store.getQuota(ref),
     refreshUsage: (provider) => store.refreshUsage(provider),
     saveBlob: (ref, blob) => store.saveBlob(ref, blob),
+    alertThresholds: () => live().alertThresholds,
+    webhookUrl: () => live().webhookUrl,
     recordHistory,
     fetchImpl: fetch,
     fetchForRef,

package/lib/adapter.js

@@ -4,6 +4,7 @@ import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
 import { modelCatalog } from './messages.js'
 import { streamWithRotation } from './stream-rotate.js'
+import { checkQuotaThresholds } from './alerts.js'
 import { pickFetch } from './proxy.js'
 import { quotaSnapshot, parseBody } from './ratelimit.js'
 import { toTokenUsage } from './wire.js'
@@ -112,6 +113,8 @@ export class SubscriptionAdapter extends LlmAdapter {
         cooldownMs: deps.cooldownMs(),
         switchAtRemaining: typeof deps.switchAtRemaining === 'function' ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0),
         options,
+        webhookUrl: typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl,
+        fetchImpl: deps.fetchImpl || fetch,
         onCooldown: (account) => {
           if (typeof deps.rememberCooldown === 'function') deps.rememberCooldown(account.ref, account.cooldownUntil, account.cooldownFamilies || null)
           if (typeof deps.recordSwitch === 'function') deps.recordSwitch(account.ref)
@@ -129,7 +132,21 @@ export class SubscriptionAdapter extends LlmAdapter {
             const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
-              if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
+              if (snap && typeof deps.rememberQuota === "function") {
+                deps.rememberQuota(account.ref, snap)
+                if (snap.usedPercent != null) {
+                  const th = typeof deps.alertThresholds === 'function' ? deps.alertThresholds() : deps.alertThresholds
+                  const wh = typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl
+                  checkQuotaThresholds({
+                    ref: account.ref,
+                    provider,
+                    usedPercent: snap.usedPercent,
+                    thresholds: th,
+                    webhookUrl: wh,
+                    fetchImpl: deps.fetchImpl || fetch,
+                  })
+                }
+              }
             } catch { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
@@ -139,7 +156,21 @@ export class SubscriptionAdapter extends LlmAdapter {
                   const b = parseBody(provider, j, Date.now())
                   if (b) {
                     const snap2 = quotaSnapshot(provider, res.headers, j, Date.now())
-                    if (snap2) deps.rememberQuota(account.ref, snap2)
+                    if (snap2) {
+                      deps.rememberQuota(account.ref, snap2)
+                      if (snap2.usedPercent != null) {
+                        const th = typeof deps.alertThresholds === 'function' ? deps.alertThresholds() : deps.alertThresholds
+                        const wh = typeof deps.webhookUrl === 'function' ? deps.webhookUrl() : deps.webhookUrl
+                        checkQuotaThresholds({
+                          ref: account.ref,
+                          provider,
+                          usedPercent: snap2.usedPercent,
+                          thresholds: th,
+                          webhookUrl: wh,
+                          fetchImpl: deps.fetchImpl || fetch,
+                        })
+                      }
+                    }
                   }
                 }
               } catch { /* ignore quota capture failure */ }

package/lib/alerts.js

@@ -1,3 +1,12 @@
+import { readFileSync } from 'node:fs'
+
+let pkgVersion = ''
+try {
+  pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || ''
+} catch {
+  // ignore package read errors
+}
+
 // #351: Proactive Quota Alerts & Webhook Dispatcher
 // Manages quota threshold warnings, session expiry notifications,
 // and webhook dispatch (e.g. Telegram/Discord or external monitoring).
@@ -70,7 +79,7 @@ export async function dispatchWebhookAlert(alert, webhookUrl, fetchImpl = fetch)
       method: 'POST',
       headers: {
         'content-type': 'application/json',
-        'user-agent': 'dsh-subscriptions/0.6.17',
+        'user-agent': pkgVersion ? `dsh-subscriptions/${pkgVersion}` : 'dsh-subscriptions',
       },
       body: JSON.stringify(payload),
     })

package/lib/client.js

@@ -149,7 +149,7 @@ window.__ModuleLoader__.load({
     '.dsub-slot-meta-row{display:flex;flex-wrap:wrap;align-items:center;gap:10px;margin-top:12px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2);font-size:12px}' +
     '.dsub-ref-tag{display:inline-flex;align-items:center;gap:5px;font-size:11.5px;color:var(--dsw-alias-label-secondary)}' +
     '.dsub-ref-tag code{padding:2px 6px;border-radius:4px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);font-family:ui-monospace,monospace;color:var(--dsw-alias-label-primary);font-size:11px}' +
-    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default,#3b82f6);background:color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default,#3b82f6) 20%,transparent)}' +
+    '.dsub-speed-tag{display:inline-flex;align-items:center;gap:4px;font-size:11.5px;color:var(--dsw-alias-brand-default);background:color-mix(in srgb,var(--dsw-alias-brand-default) 8%,transparent);padding:2px 8px;border-radius:6px;font-weight:500;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-default) 20%,transparent)}' +
     '.dsub-btn-danger{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 40%,transparent)!important;color:var(--dsw-alias-state-error-primary)!important}' +
     '.dsub-btn-danger:hover:not(:disabled){background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent)!important}' +
     '.dsub-poolTitle{margin-top:16px;margin-bottom:8px;font-size:11.5px;font-weight:700;color:var(--dsw-alias-label-secondary);text-transform:uppercase;letter-spacing:.05em}' +
@@ -299,12 +299,12 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       grok: {
         title: "xAI Grok",
         stepsEn: [
-          "1. Run grok-cli or hermes login on server.",
+          "1. Run grok CLI login on the server.",
           "2. Click \"📥 From CLI\" (~/.grok/auth.json).",
           "3. Or paste your xAI API Key and click \"Save token\".",
         ],
         stepsZh: [
-          "1. 在服务器上运行 grok-cli 或 hermes 登录。",
+          "1. 在服务器上运行 grok CLI 登录。",
           "2. 点击 \"📥 从 CLI 导入\" (~/.grok/auth.json)。",
           "3. 或将 xAI API 密钥粘贴到输入框并点击 \"保存令牌\"。",
         ],
@@ -477,6 +477,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "save": "Save",
       "saved": "Saved",
       "loading": "Loading…",
+      "unavailable": "Settings are unavailable",
       "accountLabel": "Account",
       "plan": "Plan",
       "storedAs": "Stored as",
@@ -528,8 +529,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupImportTitle": "Import Encrypted Backup",
       "backupExportAction": "Export",
       "backupImportAction": "Import",
-      "backupPassphrase": "Vault Passphrase (min 4 chars)",
-      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM and PBKDF2.",
+      "backupPassphrase": "Vault Passphrase (min 12 chars)",
+      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM. ⚠️ Contains sensitive OAuth refresh tokens; use a strong password (min 12 chars).",
+      "vaultTokenWarning": "⚠️ Contains sensitive OAuth refresh tokens",
       "backupImportHint": "Restore encrypted subscription accounts and credentials from a vault payload.",
       "backupPayloadPlaceholder": "Paste DSHE... encrypted string here",
       "backupExportOk": "Backup exported successfully",
@@ -674,6 +676,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "save": "保存",
       "saved": "已保存",
       "loading": "加载中…",
+      "unavailable": "设置不可用",
       "accountLabel": "账户",
       "plan": "套餐方案",
       "storedAs": "存储标识",
@@ -725,8 +728,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupImportTitle": "导入加密备份",
       "backupExportAction": "导出",
       "backupImportAction": "导入",
-      "backupPassphrase": "凭据库密码（至少 4 位）",
-      "backupExportHint": "使用 AES-256-GCM 与 PBKDF2 安全加密导出所有订阅账户与配置。",
+      "backupPassphrase": "凭据库密码（至少 12 位）",
+      "backupExportHint": "使用 AES-256-GCM 安全加密导出所有订阅账户与配置。⚠️ 包含敏感的 OAuth 刷新令牌，请使用至少 12 位的强密码保护。",
+      "vaultTokenWarning": "⚠️ 包含敏感的 OAuth 刷新令牌",
       "backupImportHint": "从已加密的备份内容中导入并恢复订阅账户与凭据。",
       "backupPayloadPlaceholder": "在此粘贴 DSHE... 加密内容",
       "backupExportOk": "备份导出成功",
@@ -1674,7 +1678,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                 backupModal === 'export' ? React.createElement('button', {
                   type: 'button',
                   className: 'dsub-mini',
-                  disabled: backupLoading || !backupPass || backupPass.length < 4,
+                  disabled: backupLoading || !backupPass || backupPass.length < 12,
                   onClick: doExportBackup,
                 }, backupLoading ? '…' : t('backupExportAction')) : React.createElement('button', {
                   type: 'button',
@@ -2074,6 +2078,33 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       if (props && props.view === 'summary') {
         return React.createElement('div', { className: 'dsub-description' }, t('cardIntro'))
       }
+      // Check host snapshot status (#408): loading or unavailable
+      if (props && props.status === 'loading') {
+        return React.createElement(page ? 'div' : 'li', {
+          className: page ? 'dsub-page' : 'dsub-card',
+        },
+          React.createElement('div', { className: 'dsub-header', style: { cursor: 'default' } },
+            React.createElement('div', { className: 'dsub-headText' },
+              React.createElement('div', { className: 'dsub-name' }, t('title')),
+              React.createElement('div', { className: 'dsub-description' }, t('loading') || t('settingsLoading') || 'Loading…'),
+            ),
+          )
+        )
+      }
+      if (props && props.status === 'unavailable') {
+        return React.createElement(page ? 'div' : 'li', {
+          className: page ? 'dsub-page' : 'dsub-card',
+        },
+          React.createElement('div', { className: 'dsub-header', style: { cursor: 'default' } },
+            React.createElement('div', { className: 'dsub-headText' },
+              React.createElement('div', { className: 'dsub-name' }, t('title')),
+              React.createElement('div', { className: 'dsub-description', style: { color: 'var(--dsw-alias-state-warning-primary)' } },
+                t('unavailable') || t('settingsUnavailable') || 'Settings are unavailable',
+              ),
+            ),
+          )
+        )
+      }
       return React.createElement(page ? 'div' : 'li', {
         className: page ? 'dsub-page' : 'dsub-card' + (open ? ' dsub-cardOpen' : ''),
       },

package/lib/crypto.js

@@ -1,19 +1,31 @@
 import { scryptSync, pbkdf2Sync, createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
 
-// AES-256-GCM with PBKDF2 (100,000 iterations, SHA-256) (DSHE2:) or scrypt (DSHE1:).
-// Backward-compatible across both key derivation algorithms.
+// AES-256-GCM with PBKDF2 (600,000 iterations, SHA-256) (DSHE2:),
+// hardened scrypt (N=131072) (DSHE3:), or legacy scrypt (DSHE1:).
+// Backward-compatible across all key derivation algorithms.
 export function encryptWithPassphrase(plainText, passphrase, { algorithm = "scrypt" } = {}) {
   const salt = randomBytes(16)
   const isPbkdf2 = algorithm === "pbkdf2"
-  const key = isPbkdf2
-    ? pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
-    : scryptSync(String(passphrase), salt, 32)
+  const isHardenedScrypt = algorithm === "scrypt-v2" || algorithm === "scrypt-hardened"
+  let key
+  let prefix
+
+  if (isPbkdf2) {
+    key = pbkdf2Sync(String(passphrase), salt, 600000, 32, "sha256")
+    prefix = "DSHE2:"
+  } else if (isHardenedScrypt) {
+    key = scryptSync(String(passphrase), salt, 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 })
+    prefix = "DSHE3:"
+  } else {
+    key = scryptSync(String(passphrase), salt, 32)
+    prefix = "DSHE1:"
+  }
+
   const iv = randomBytes(12)
   const cipher = createCipheriv("aes-256-gcm", key, iv)
   const encrypted = Buffer.concat([cipher.update(String(plainText), "utf8"), cipher.final()])
   const tag = cipher.getAuthTag()
   // format: magic + salt + iv + tag + data
-  const prefix = isPbkdf2 ? "DSHE2:" : "DSHE1:"
   return prefix + Buffer.concat([salt, iv, tag, encrypted]).toString("base64")
 }
 
@@ -24,13 +36,28 @@ export function decryptWithPassphrase(payload, passphrase) {
   let iv
   let tag
   let data
-  if (raw.startsWith("DSHE2:")) {
+  if (raw.startsWith("DSHE3:")) {
+    const buf = Buffer.from(raw.slice(6), "base64")
+    salt = buf.subarray(0, 16)
+    iv = buf.subarray(16, 28)
+    tag = buf.subarray(28, 44)
+    data = buf.subarray(44)
+    key = scryptSync(String(passphrase), salt, 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 })
+  } else if (raw.startsWith("DSHE2:")) {
     const buf = Buffer.from(raw.slice(6), "base64")
     salt = buf.subarray(0, 16)
     iv = buf.subarray(16, 28)
     tag = buf.subarray(28, 44)
     data = buf.subarray(44)
-    key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    // Try 600,000 iterations first (#414), fallback to legacy 100,000 iterations
+    try {
+      key = pbkdf2Sync(String(passphrase), salt, 600000, 32, "sha256")
+      const decipher = createDecipheriv("aes-256-gcm", key, iv)
+      decipher.setAuthTag(tag)
+      return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8")
+    } catch {
+      key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    }
   } else if (raw.startsWith("DSHE1:")) {
     const buf = Buffer.from(raw.slice(6), "base64")
     salt = buf.subarray(0, 16)

package/lib/history.js

@@ -6,15 +6,21 @@ import { homedir } from 'node:os'
 // ~/.dsh/storages/dsh-subscriptions/history.json (JSON array, newest first).
 // All IO is best-effort: a write failure must never crash the harness.
 
-export const DEFAULT_HISTORY_DIR = join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+export function resolveHistoryDir(customDir) {
+  if (customDir) return customDir
+  if (process.env.DSH_HISTORY_DIR) return process.env.DSH_HISTORY_DIR
+  if (process.env.DSH_STORAGE_DIR) return process.env.DSH_STORAGE_DIR
+  if (process.env.DSH_HOME) return join(process.env.DSH_HOME, 'storages', 'dsh-subscriptions')
+  return join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+}
 
 export class HistoryStore {
-  constructor(dir = DEFAULT_HISTORY_DIR, ttlMs = 7 * 24 * 60 * 60 * 1000, debounceMs = 0, maxEntries = 1000) {
-    this.dir = dir
+  constructor(dir = resolveHistoryDir(), ttlMs = 7 * 24 * 60 * 60 * 1000, debounceMs = 0, maxEntries = 1000) {
+    this.dir = resolveHistoryDir(dir)
     this.ttlMs = ttlMs
     this.debounceMs = debounceMs
     this.maxEntries = maxEntries
-    this.path = join(dir, 'history.json')
+    this.path = join(this.dir, 'history.json')
     this.rows = []
     this._persistTimer = null
     this._load()

package/lib/import-auth.js

@@ -2,7 +2,6 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
-import { discoverCodingAgentConfigs } from './importers/coding-agents.js'
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -46,10 +45,9 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 2. Grok CLI / Hermes
+  // 2. Grok CLI
   const grokPaths = [
     homeFile('.grok', 'auth.json'),
-    homeFile('.hermes', 'auth.json'),
   ]
   for (const p of grokPaths) {
     const grok = await readJson(p)
@@ -198,24 +196,7 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 10. Coding Agents (Aider / Roo-Code)
-  const agentConfigs = await discoverCodingAgentConfigs()
-  if (agentConfigs.aider) {
-    detected.aider = {
-      provider: 'aider',
-      path: agentConfigs.aider.path,
-      email: 'Aider Configured Agent',
-      hasRefreshToken: false,
-    }
-  }
-  if (agentConfigs.roocode) {
-    detected.roocode = {
-      provider: 'roocode',
-      path: agentConfigs.roocode.path,
-      email: 'Roo-Code Configured Agent',
-      hasRefreshToken: false,
-    }
-  }
+
 
   return detected
 }

package/lib/index.js

@@ -16,7 +16,7 @@ import { OllamaAdapter, ollamaAlive, ollamaModels, ollamaBase } from './ollama.j
 import { createResetCreditService } from './reset-credits.js'
 import { maskEmail, maskLabel } from './mask.js'
 import { proxyFetch } from './proxy.js'
-import { HistoryStore, DEFAULT_HISTORY_DIR } from './history.js'
+import { HistoryStore, resolveHistoryDir } from './history.js'
 import { createDiagnosticsReport } from './diagnostics.js'
 import { createAccountsView } from './accounts-view.js'
 import { createAdapterManager } from './adapter-manager.js'
@@ -185,7 +185,8 @@ export function apply(ctx, rawConfig) {
       bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
-  const history = new HistoryStore(DEFAULT_HISTORY_DIR, 7 * 24 * 60 * 60 * 1000, 1000)
+  const historyDir = ctx?.historyDir || ctx?.storageDir || resolveHistoryDir()
+  const history = new HistoryStore(historyDir, 7 * 24 * 60 * 60 * 1000, 1000)
   if (typeof ctx?.on === 'function') {
     ctx.on('dispose', () => history.dispose())
   }

package/lib/routes.js

@@ -24,6 +24,10 @@ export function registerRoutes(ctx, state) {
 
   ctx.effect(() => registerPluginUpdater(ctx, {
     endpoint: '/dsh-subscriptions/update',
+    aliases: [
+      '/api/@goodandready/dsh-subscriptions/update',
+      '/api/dsh-subscriptions/update',
+    ],
     packageName: '@goodandready/dsh-subscriptions',
     manifestUrl: new URL('../package.json', import.meta.url),
   }), 'dsh-subscriptions: /update')

package/lib/stream-rotate.js

@@ -1,5 +1,6 @@
 import { pickAccount, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED } from './quarantine.js'
+import { notifySessionExpired } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
 
 export async function* streamWithRotation({
@@ -12,6 +13,8 @@ export async function* streamWithRotation({
   onCooldown,
   cascadeFallback, // #349: optional cross-vendor cascading fallback generator
   offlineFallback, // #174: optional fallback generator if all accounts exhausted
+  webhookUrl,
+  fetchImpl = fetch,
 }) {
   const pool = (accounts || []).map((account) => ({ ...account }))
   let lastError = null
@@ -89,6 +92,19 @@ export async function* streamWithRotation({
         account.quarantineUntil = quarantined.quarantineUntil
         account.quarantineReason = quarantined.quarantineReason
 
+        if (reason === REASON_REVOKED) {
+          try {
+            notifySessionExpired({
+              ref: account.ref,
+              provider: options && options.provider,
+              message: err && err.message,
+              webhookUrl: webhookUrl || (options && options.webhookUrl),
+              fetchImpl,
+              nowMs: nowMs(),
+            })
+          } catch { /* fire-and-forget alert */ }
+        }
+
         if (onCooldown) onCooldown(account)
         // Break inner retry loop to continue to next account in outer while (true) loop
         break

package/lib/updater.js

@@ -4,7 +4,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { writeJson } from './http.js'
+import { isTrustedSettingsRequest, writeJson } from './http.js'
 
 const UPDATE_HEADER = 'x-dsh-plugin-update'
 const UPDATE_TIMEOUT_MS = 10 * 60_000
@@ -25,24 +25,11 @@ export function isLoopback(value) {
 
 export function isTrustedUpdateRequest(request) {
   const customHeader = header(request, UPDATE_HEADER)
-  if (customHeader !== '1') {
-    // In browser fetch, allow if sec-fetch-site is same-origin or same-site
-    const site = header(request, 'sec-fetch-site')
-    if (site === 'cross-site') return false
+  if (customHeader === '1') {
+    const remote = request.socket?.remoteAddress
+    if (remote && isLoopback(remote)) return true
   }
-  const remote = request.socket?.remoteAddress
-  if (remote && !isLoopback(remote)) return false
-  const origin = header(request, 'origin')
-  const host = header(request, 'host')
-  if (origin && host) {
-    try {
-      const url = new URL(origin)
-      if (url.host !== host && !isLoopback(url.hostname)) return false
-    } catch {
-      return false
-    }
-  }
-  return true
+  return isTrustedSettingsRequest(request)
 }
 
 function validProfileName(value) {
@@ -206,10 +193,11 @@ export async function installExactPackage(target, packageSpec, options) {
 
 export function registerPluginUpdater(ctx, options) {
   let installing = false
-  return ctx.webServer.register({
-    kind: 'exact',
-    path: options.endpoint,
-    handler: async (request, response) => {
+  const endpoints = Array.isArray(options.endpoint)
+    ? options.endpoint
+    : [options.endpoint, ...(Array.isArray(options.aliases) ? options.aliases : [])]
+
+  const handler = async (request, response) => {
       try {
         const target = getRuntime()
         if (request.method === 'GET' || request.method === 'HEAD') {
@@ -255,6 +243,17 @@ export function registerPluginUpdater(ctx, options) {
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
         writeJson(response, 503, { ok: false, error: { code: 'update_failed', message: String(error?.message || error) } })
       }
-    },
-  })
+  }
+
+  const unregisters = endpoints.map((ep) => ctx.webServer.register({
+    kind: 'exact',
+    path: ep,
+    handler,
+  }))
+
+  return () => {
+    for (const un of unregisters) {
+      if (typeof un === 'function') un()
+    }
+  }
 }

package/lib/vault.js

@@ -11,8 +11,8 @@ export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
  */
 export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'scrypt' }, passphrase) {
   const pass = String(passphrase || '').trim()
-  if (!pass || pass.length < 4) {
-    throw new Error('passphrase must be at least 4 characters')
+  if (!pass || pass.length < 12) {
+    throw new Error('passphrase must be at least 12 characters')
   }
 
   const payload = {
@@ -43,7 +43,7 @@ export function importVault(encryptedPayload, passphrase) {
   }
 
   const raw = String(encryptedPayload || '').trim()
-  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:')) {
+  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:') && !raw.startsWith('DSHE3:')) {
     throw new Error('invalid vault format: missing DSHE1 header')
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.28",
+  "version": "0.6.30",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -37,7 +37,7 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
   "scripts": {
-    "test": "eslint lib/ test/ && node --test test/*.test.mjs",
+    "test": "eslint lib/ test/ && node --import ./test/_setup.mjs --test test/*.test.mjs",
     "typecheck": "tsc -p tsconfig.checkjs.json"
   },
   "dsh": {

package/lib/importers/coding-agents.js

@@ -1,37 +0,0 @@
-import { readFile } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-export async function discoverCodingAgentConfigs() {
-  const configs = {}
-
-  // 1. Aider (.aider.conf.yml)
-  try {
-    const p = join(homedir(), '.aider.conf.yml')
-    const text = await readFile(p, 'utf8')
-    configs.aider = {
-      name: 'Aider Config',
-      path: p,
-      found: true,
-      raw: text
-    }
-  } catch {
-    // not present
-  }
-
-  // 2. Roo-Code / Roo-Cline settings
-  try {
-    const p = join(homedir(), '.roo-code', 'settings.json')
-    const text = await readFile(p, 'utf8')
-    configs.roocode = {
-      name: 'Roo-Code Config',
-      path: p,
-      found: true,
-      raw: text
-    }
-  } catch {
-    // not present
-  }
-
-  return configs
-}