@goodandready/dsh-subscriptions 0.6.29 → 0.6.30

package/lib/client.js

@@ -299,12 +299,12 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       grok: {
         title: "xAI Grok",
         stepsEn: [
-          "1. Run grok-cli or hermes login on server.",
+          "1. Run grok CLI login on the server.",
           "2. Click \"📥 From CLI\" (~/.grok/auth.json).",
           "3. Or paste your xAI API Key and click \"Save token\".",
         ],
         stepsZh: [
-          "1. 在服务器上运行 grok-cli 或 hermes 登录。",
+          "1. 在服务器上运行 grok CLI 登录。",
           "2. 点击 \"📥 从 CLI 导入\" (~/.grok/auth.json)。",
           "3. 或将 xAI API 密钥粘贴到输入框并点击 \"保存令牌\"。",
         ],
@@ -529,8 +529,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupImportTitle": "Import Encrypted Backup",
       "backupExportAction": "Export",
       "backupImportAction": "Import",
-      "backupPassphrase": "Vault Passphrase (min 4 chars)",
-      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM and PBKDF2.",
+      "backupPassphrase": "Vault Passphrase (min 12 chars)",
+      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM. ⚠️ Contains sensitive OAuth refresh tokens; use a strong password (min 12 chars).",
+      "vaultTokenWarning": "⚠️ Contains sensitive OAuth refresh tokens",
       "backupImportHint": "Restore encrypted subscription accounts and credentials from a vault payload.",
       "backupPayloadPlaceholder": "Paste DSHE... encrypted string here",
       "backupExportOk": "Backup exported successfully",
@@ -727,8 +728,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupImportTitle": "导入加密备份",
       "backupExportAction": "导出",
       "backupImportAction": "导入",
-      "backupPassphrase": "凭据库密码（至少 4 位）",
-      "backupExportHint": "使用 AES-256-GCM 与 PBKDF2 安全加密导出所有订阅账户与配置。",
+      "backupPassphrase": "凭据库密码（至少 12 位）",
+      "backupExportHint": "使用 AES-256-GCM 安全加密导出所有订阅账户与配置。⚠️ 包含敏感的 OAuth 刷新令牌，请使用至少 12 位的强密码保护。",
+      "vaultTokenWarning": "⚠️ 包含敏感的 OAuth 刷新令牌",
       "backupImportHint": "从已加密的备份内容中导入并恢复订阅账户与凭据。",
       "backupPayloadPlaceholder": "在此粘贴 DSHE... 加密内容",
       "backupExportOk": "备份导出成功",
@@ -1676,7 +1678,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                 backupModal === 'export' ? React.createElement('button', {
                   type: 'button',
                   className: 'dsub-mini',
-                  disabled: backupLoading || !backupPass || backupPass.length < 4,
+                  disabled: backupLoading || !backupPass || backupPass.length < 12,
                   onClick: doExportBackup,
                 }, backupLoading ? '…' : t('backupExportAction')) : React.createElement('button', {
                   type: 'button',

package/lib/crypto.js

@@ -1,19 +1,31 @@
 import { scryptSync, pbkdf2Sync, createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
 
-// AES-256-GCM with PBKDF2 (100,000 iterations, SHA-256) (DSHE2:) or scrypt (DSHE1:).
-// Backward-compatible across both key derivation algorithms.
+// AES-256-GCM with PBKDF2 (600,000 iterations, SHA-256) (DSHE2:),
+// hardened scrypt (N=131072) (DSHE3:), or legacy scrypt (DSHE1:).
+// Backward-compatible across all key derivation algorithms.
 export function encryptWithPassphrase(plainText, passphrase, { algorithm = "scrypt" } = {}) {
   const salt = randomBytes(16)
   const isPbkdf2 = algorithm === "pbkdf2"
-  const key = isPbkdf2
-    ? pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
-    : scryptSync(String(passphrase), salt, 32)
+  const isHardenedScrypt = algorithm === "scrypt-v2" || algorithm === "scrypt-hardened"
+  let key
+  let prefix
+
+  if (isPbkdf2) {
+    key = pbkdf2Sync(String(passphrase), salt, 600000, 32, "sha256")
+    prefix = "DSHE2:"
+  } else if (isHardenedScrypt) {
+    key = scryptSync(String(passphrase), salt, 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 })
+    prefix = "DSHE3:"
+  } else {
+    key = scryptSync(String(passphrase), salt, 32)
+    prefix = "DSHE1:"
+  }
+
   const iv = randomBytes(12)
   const cipher = createCipheriv("aes-256-gcm", key, iv)
   const encrypted = Buffer.concat([cipher.update(String(plainText), "utf8"), cipher.final()])
   const tag = cipher.getAuthTag()
   // format: magic + salt + iv + tag + data
-  const prefix = isPbkdf2 ? "DSHE2:" : "DSHE1:"
   return prefix + Buffer.concat([salt, iv, tag, encrypted]).toString("base64")
 }
 
@@ -24,13 +36,28 @@ export function decryptWithPassphrase(payload, passphrase) {
   let iv
   let tag
   let data
-  if (raw.startsWith("DSHE2:")) {
+  if (raw.startsWith("DSHE3:")) {
+    const buf = Buffer.from(raw.slice(6), "base64")
+    salt = buf.subarray(0, 16)
+    iv = buf.subarray(16, 28)
+    tag = buf.subarray(28, 44)
+    data = buf.subarray(44)
+    key = scryptSync(String(passphrase), salt, 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 })
+  } else if (raw.startsWith("DSHE2:")) {
     const buf = Buffer.from(raw.slice(6), "base64")
     salt = buf.subarray(0, 16)
     iv = buf.subarray(16, 28)
     tag = buf.subarray(28, 44)
     data = buf.subarray(44)
-    key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    // Try 600,000 iterations first (#414), fallback to legacy 100,000 iterations
+    try {
+      key = pbkdf2Sync(String(passphrase), salt, 600000, 32, "sha256")
+      const decipher = createDecipheriv("aes-256-gcm", key, iv)
+      decipher.setAuthTag(tag)
+      return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8")
+    } catch {
+      key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    }
   } else if (raw.startsWith("DSHE1:")) {
     const buf = Buffer.from(raw.slice(6), "base64")
     salt = buf.subarray(0, 16)

package/lib/history.js

@@ -6,15 +6,21 @@ import { homedir } from 'node:os'
 // ~/.dsh/storages/dsh-subscriptions/history.json (JSON array, newest first).
 // All IO is best-effort: a write failure must never crash the harness.
 
-export const DEFAULT_HISTORY_DIR = join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+export function resolveHistoryDir(customDir) {
+  if (customDir) return customDir
+  if (process.env.DSH_HISTORY_DIR) return process.env.DSH_HISTORY_DIR
+  if (process.env.DSH_STORAGE_DIR) return process.env.DSH_STORAGE_DIR
+  if (process.env.DSH_HOME) return join(process.env.DSH_HOME, 'storages', 'dsh-subscriptions')
+  return join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+}
 
 export class HistoryStore {
-  constructor(dir = DEFAULT_HISTORY_DIR, ttlMs = 7 * 24 * 60 * 60 * 1000, debounceMs = 0, maxEntries = 1000) {
-    this.dir = dir
+  constructor(dir = resolveHistoryDir(), ttlMs = 7 * 24 * 60 * 60 * 1000, debounceMs = 0, maxEntries = 1000) {
+    this.dir = resolveHistoryDir(dir)
     this.ttlMs = ttlMs
     this.debounceMs = debounceMs
     this.maxEntries = maxEntries
-    this.path = join(dir, 'history.json')
+    this.path = join(this.dir, 'history.json')
     this.rows = []
     this._persistTimer = null
     this._load()

package/lib/import-auth.js

@@ -2,7 +2,6 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
-import { discoverCodingAgentConfigs } from './importers/coding-agents.js'
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -46,10 +45,9 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 2. Grok CLI / Hermes
+  // 2. Grok CLI
   const grokPaths = [
     homeFile('.grok', 'auth.json'),
-    homeFile('.hermes', 'auth.json'),
   ]
   for (const p of grokPaths) {
     const grok = await readJson(p)
@@ -198,24 +196,7 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 10. Coding Agents (Aider / Roo-Code)
-  const agentConfigs = await discoverCodingAgentConfigs()
-  if (agentConfigs.aider) {
-    detected.aider = {
-      provider: 'aider',
-      path: agentConfigs.aider.path,
-      email: 'Aider Configured Agent',
-      hasRefreshToken: false,
-    }
-  }
-  if (agentConfigs.roocode) {
-    detected.roocode = {
-      provider: 'roocode',
-      path: agentConfigs.roocode.path,
-      email: 'Roo-Code Configured Agent',
-      hasRefreshToken: false,
-    }
-  }
+
 
   return detected
 }

package/lib/index.js

@@ -16,7 +16,7 @@ import { OllamaAdapter, ollamaAlive, ollamaModels, ollamaBase } from './ollama.j
 import { createResetCreditService } from './reset-credits.js'
 import { maskEmail, maskLabel } from './mask.js'
 import { proxyFetch } from './proxy.js'
-import { HistoryStore, DEFAULT_HISTORY_DIR } from './history.js'
+import { HistoryStore, resolveHistoryDir } from './history.js'
 import { createDiagnosticsReport } from './diagnostics.js'
 import { createAccountsView } from './accounts-view.js'
 import { createAdapterManager } from './adapter-manager.js'
@@ -185,7 +185,8 @@ export function apply(ctx, rawConfig) {
       bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
-  const history = new HistoryStore(DEFAULT_HISTORY_DIR, 7 * 24 * 60 * 60 * 1000, 1000)
+  const historyDir = ctx?.historyDir || ctx?.storageDir || resolveHistoryDir()
+  const history = new HistoryStore(historyDir, 7 * 24 * 60 * 60 * 1000, 1000)
   if (typeof ctx?.on === 'function') {
     ctx.on('dispose', () => history.dispose())
   }

package/lib/vault.js

@@ -11,8 +11,8 @@ export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
  */
 export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'scrypt' }, passphrase) {
   const pass = String(passphrase || '').trim()
-  if (!pass || pass.length < 4) {
-    throw new Error('passphrase must be at least 4 characters')
+  if (!pass || pass.length < 12) {
+    throw new Error('passphrase must be at least 12 characters')
   }
 
   const payload = {
@@ -43,7 +43,7 @@ export function importVault(encryptedPayload, passphrase) {
   }
 
   const raw = String(encryptedPayload || '').trim()
-  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:')) {
+  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:') && !raw.startsWith('DSHE3:')) {
     throw new Error('invalid vault format: missing DSHE1 header')
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.29",
+  "version": "0.6.30",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -37,7 +37,7 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
   "scripts": {
-    "test": "eslint lib/ test/ && node --test test/*.test.mjs",
+    "test": "eslint lib/ test/ && node --import ./test/_setup.mjs --test test/*.test.mjs",
     "typecheck": "tsc -p tsconfig.checkjs.json"
   },
   "dsh": {

package/lib/importers/coding-agents.js

@@ -1,37 +0,0 @@
-import { readFile } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-export async function discoverCodingAgentConfigs() {
-  const configs = {}
-
-  // 1. Aider (.aider.conf.yml)
-  try {
-    const p = join(homedir(), '.aider.conf.yml')
-    const text = await readFile(p, 'utf8')
-    configs.aider = {
-      name: 'Aider Config',
-      path: p,
-      found: true,
-      raw: text
-    }
-  } catch {
-    // not present
-  }
-
-  // 2. Roo-Code / Roo-Cline settings
-  try {
-    const p = join(homedir(), '.roo-code', 'settings.json')
-    const text = await readFile(p, 'utf8')
-    configs.roocode = {
-      name: 'Roo-Code Config',
-      path: p,
-      found: true,
-      raw: text
-    }
-  } catch {
-    // not present
-  }
-
-  return configs
-}