@goodandready/dsh-subscriptions 0.6.29 → 0.6.31

package/README.md

@@ -262,7 +262,7 @@ Supports Anthropic's adaptive thinking (`thinking: { type: "adaptive" }`) and re
 
 ## 🚀 One-Click Plugin Updater & Stability Hardening (Added in v0.6.9)
 
-- **Host One-Click Updater**: Automatic in-place updater mounted at `/dsh-subscriptions/update`, checking the npm registry for newer releases and executing single-flight installation via the host DSH CLI (`dsh plugin add --config.minimumReleaseAge=0`).
+- **Host One-Click Updater**: Automatic in-place updater mounted at `/dsh-subscriptions/update`, checking the npm registry for newer releases and executing single-flight installation via the host DSH CLI (`dsh plugin add`).
 - **Security & Origin Protection**: Updater endpoints enforce strict loopback address checks (supporting IPv4 `127.0.0.1`, IPv6 `::1`, `localhost`), `x-dsh-plugin-update` header verification, and same-origin validation to prevent unauthorized updates.
 - **Header Badge & UI Action**: The settings header bar displays current plugin version, an update warning badge when a new release is detected, and an instant "Update" button with live restart countdown.
 - **Network Timeout Hardening**: Quota balance and smoke test probes now enforce guaranteed 15-second abort timeouts (`AbortSignal.timeout(15_000)`), preventing hanging sockets during vendor outages.

package/README.ru.md

@@ -235,7 +235,7 @@ dsh-subscriptions:
 
 ## 🚀 Обновление в один клик и повышение стабильности (Добавлено в v0.6.9)
 
-- **Встроенный апдейтер в один клик**: Фоновая проверка новых версий в npm registry и обновление на месте по маршруту `/dsh-subscriptions/update` через хостовый CLI DSH (`dsh plugin add --config.minimumReleaseAge=0`).
+- **Встроенный апдейтер в один клик**: Фоновая проверка новых версий в npm registry и обновление на месте по маршруту `/dsh-subscriptions/update` через хостовый CLI DSH (`dsh plugin add`).
 - **Безопасность и защита эндпоинта**: Строгая верификация loopback-адресов (поддержка IPv4 `127.0.0.1`, IPv6 `::1`, `localhost`), валидация заголовка `x-dsh-plugin-update` и защита от CSRF/cross-origin запросов.
 - **Индикатор в шапке и кнопка обновления**: В строке состояния панели отображается текущая версия, бейдж наличия обновления и кнопка быстрого обновления («Update → vX.Y.Z») с уведомлением о перезапуске службы.
 - **Сетевые таймауты и устойчивость**: Ограничение времени ожидания запросов баланса и smoke-тестов до 15 секунд (`AbortSignal.timeout(15_000)`), предотвращающее зависание сокетов при недоступности внешних API.

package/README.zh.md

@@ -157,7 +157,7 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 ## 🚀 一键插件自更新与稳定性强化 (v0.6.9 新增)
 
-- **宿主端一键更新**: 挂载于 `/dsh-subscriptions/update` 的就地更新机制，自动对比 npm registry 最新版本并通过宿主 DSH CLI 执行单飞安装 (`dsh plugin add --config.minimumReleaseAge=0`)。
+- **宿主端一键更新**: 挂载于 `/dsh-subscriptions/update` 的就地更新机制，自动对比 npm registry 最新版本并通过宿主 DSH CLI 执行单飞安装 (`dsh plugin add`)。
 - **安全与来源防护**: 更新接口严格校验环回地址（支持 IPv4 `127.0.0.1`、IPv6 `::1`、`localhost`）、`x-dsh-plugin-update` 请求头及同源策略，阻断未授权跨站调用。
 - **状态栏徽章与更新按钮**: 设置面板顶部状态栏显示当前插件版本，有新版本时提示告警徽章并提供一键更新按钮与重启提示。
 - **网络超时熔断**: 配额检测与冒烟测试增加 15 秒超时信号保护 (`AbortSignal.timeout(15_000)`)，防止外部服务商接口故障导致请求挂起。

package/lib/client.js

@@ -299,12 +299,12 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       grok: {
         title: "xAI Grok",
         stepsEn: [
-          "1. Run grok-cli or hermes login on server.",
+          "1. Run grok CLI login on the server.",
           "2. Click \"📥 From CLI\" (~/.grok/auth.json).",
           "3. Or paste your xAI API Key and click \"Save token\".",
         ],
         stepsZh: [
-          "1. 在服务器上运行 grok-cli 或 hermes 登录。",
+          "1. 在服务器上运行 grok CLI 登录。",
           "2. 点击 \"📥 从 CLI 导入\" (~/.grok/auth.json)。",
           "3. 或将 xAI API 密钥粘贴到输入框并点击 \"保存令牌\"。",
         ],
@@ -529,8 +529,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupImportTitle": "Import Encrypted Backup",
       "backupExportAction": "Export",
       "backupImportAction": "Import",
-      "backupPassphrase": "Vault Passphrase (min 4 chars)",
-      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM and PBKDF2.",
+      "backupPassphrase": "Vault Passphrase (min 12 chars)",
+      "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM. ⚠️ Contains sensitive OAuth refresh tokens; use a strong password (min 12 chars).",
+      "vaultTokenWarning": "⚠️ Contains sensitive OAuth refresh tokens",
       "backupImportHint": "Restore encrypted subscription accounts and credentials from a vault payload.",
       "backupPayloadPlaceholder": "Paste DSHE... encrypted string here",
       "backupExportOk": "Backup exported successfully",
@@ -727,8 +728,9 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupImportTitle": "导入加密备份",
       "backupExportAction": "导出",
       "backupImportAction": "导入",
-      "backupPassphrase": "凭据库密码（至少 4 位）",
-      "backupExportHint": "使用 AES-256-GCM 与 PBKDF2 安全加密导出所有订阅账户与配置。",
+      "backupPassphrase": "凭据库密码（至少 12 位）",
+      "backupExportHint": "使用 AES-256-GCM 安全加密导出所有订阅账户与配置。⚠️ 包含敏感的 OAuth 刷新令牌，请使用至少 12 位的强密码保护。",
+      "vaultTokenWarning": "⚠️ 包含敏感的 OAuth 刷新令牌",
       "backupImportHint": "从已加密的备份内容中导入并恢复订阅账户与凭据。",
       "backupPayloadPlaceholder": "在此粘贴 DSHE... 加密内容",
       "backupExportOk": "备份导出成功",
@@ -1676,7 +1678,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                 backupModal === 'export' ? React.createElement('button', {
                   type: 'button',
                   className: 'dsub-mini',
-                  disabled: backupLoading || !backupPass || backupPass.length < 4,
+                  disabled: backupLoading || !backupPass || backupPass.length < 12,
                   onClick: doExportBackup,
                 }, backupLoading ? '…' : t('backupExportAction')) : React.createElement('button', {
                   type: 'button',

package/lib/crypto.js

@@ -1,19 +1,31 @@
 import { scryptSync, pbkdf2Sync, createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
 
-// AES-256-GCM with PBKDF2 (100,000 iterations, SHA-256) (DSHE2:) or scrypt (DSHE1:).
-// Backward-compatible across both key derivation algorithms.
+// AES-256-GCM with PBKDF2 (600,000 iterations, SHA-256) (DSHE2:),
+// hardened scrypt (N=131072) (DSHE3:), or legacy scrypt (DSHE1:).
+// Backward-compatible across all key derivation algorithms.
 export function encryptWithPassphrase(plainText, passphrase, { algorithm = "scrypt" } = {}) {
   const salt = randomBytes(16)
   const isPbkdf2 = algorithm === "pbkdf2"
-  const key = isPbkdf2
-    ? pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
-    : scryptSync(String(passphrase), salt, 32)
+  const isHardenedScrypt = algorithm === "scrypt-v2" || algorithm === "scrypt-hardened"
+  let key
+  let prefix
+
+  if (isPbkdf2) {
+    key = pbkdf2Sync(String(passphrase), salt, 600000, 32, "sha256")
+    prefix = "DSHE2:"
+  } else if (isHardenedScrypt) {
+    key = scryptSync(String(passphrase), salt, 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 })
+    prefix = "DSHE3:"
+  } else {
+    key = scryptSync(String(passphrase), salt, 32)
+    prefix = "DSHE1:"
+  }
+
   const iv = randomBytes(12)
   const cipher = createCipheriv("aes-256-gcm", key, iv)
   const encrypted = Buffer.concat([cipher.update(String(plainText), "utf8"), cipher.final()])
   const tag = cipher.getAuthTag()
   // format: magic + salt + iv + tag + data
-  const prefix = isPbkdf2 ? "DSHE2:" : "DSHE1:"
   return prefix + Buffer.concat([salt, iv, tag, encrypted]).toString("base64")
 }
 
@@ -24,13 +36,28 @@ export function decryptWithPassphrase(payload, passphrase) {
   let iv
   let tag
   let data
-  if (raw.startsWith("DSHE2:")) {
+  if (raw.startsWith("DSHE3:")) {
+    const buf = Buffer.from(raw.slice(6), "base64")
+    salt = buf.subarray(0, 16)
+    iv = buf.subarray(16, 28)
+    tag = buf.subarray(28, 44)
+    data = buf.subarray(44)
+    key = scryptSync(String(passphrase), salt, 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 })
+  } else if (raw.startsWith("DSHE2:")) {
     const buf = Buffer.from(raw.slice(6), "base64")
     salt = buf.subarray(0, 16)
     iv = buf.subarray(16, 28)
     tag = buf.subarray(28, 44)
     data = buf.subarray(44)
-    key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    // Try 600,000 iterations first (#414), fallback to legacy 100,000 iterations
+    try {
+      key = pbkdf2Sync(String(passphrase), salt, 600000, 32, "sha256")
+      const decipher = createDecipheriv("aes-256-gcm", key, iv)
+      decipher.setAuthTag(tag)
+      return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8")
+    } catch {
+      key = pbkdf2Sync(String(passphrase), salt, 100000, 32, "sha256")
+    }
   } else if (raw.startsWith("DSHE1:")) {
     const buf = Buffer.from(raw.slice(6), "base64")
     salt = buf.subarray(0, 16)

package/lib/history.js

@@ -6,15 +6,21 @@ import { homedir } from 'node:os'
 // ~/.dsh/storages/dsh-subscriptions/history.json (JSON array, newest first).
 // All IO is best-effort: a write failure must never crash the harness.
 
-export const DEFAULT_HISTORY_DIR = join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+export function resolveHistoryDir(customDir) {
+  if (customDir) return customDir
+  if (process.env.DSH_HISTORY_DIR) return process.env.DSH_HISTORY_DIR
+  if (process.env.DSH_STORAGE_DIR) return process.env.DSH_STORAGE_DIR
+  if (process.env.DSH_HOME) return join(process.env.DSH_HOME, 'storages', 'dsh-subscriptions')
+  return join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+}
 
 export class HistoryStore {
-  constructor(dir = DEFAULT_HISTORY_DIR, ttlMs = 7 * 24 * 60 * 60 * 1000, debounceMs = 0, maxEntries = 1000) {
-    this.dir = dir
+  constructor(dir = resolveHistoryDir(), ttlMs = 7 * 24 * 60 * 60 * 1000, debounceMs = 0, maxEntries = 1000) {
+    this.dir = resolveHistoryDir(dir)
     this.ttlMs = ttlMs
     this.debounceMs = debounceMs
     this.maxEntries = maxEntries
-    this.path = join(dir, 'history.json')
+    this.path = join(this.dir, 'history.json')
     this.rows = []
     this._persistTimer = null
     this._load()

package/lib/import-auth.js

@@ -2,7 +2,6 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
-import { discoverCodingAgentConfigs } from './importers/coding-agents.js'
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -46,10 +45,9 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 2. Grok CLI / Hermes
+  // 2. Grok CLI
   const grokPaths = [
     homeFile('.grok', 'auth.json'),
-    homeFile('.hermes', 'auth.json'),
   ]
   for (const p of grokPaths) {
     const grok = await readJson(p)
@@ -198,24 +196,7 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 10. Coding Agents (Aider / Roo-Code)
-  const agentConfigs = await discoverCodingAgentConfigs()
-  if (agentConfigs.aider) {
-    detected.aider = {
-      provider: 'aider',
-      path: agentConfigs.aider.path,
-      email: 'Aider Configured Agent',
-      hasRefreshToken: false,
-    }
-  }
-  if (agentConfigs.roocode) {
-    detected.roocode = {
-      provider: 'roocode',
-      path: agentConfigs.roocode.path,
-      email: 'Roo-Code Configured Agent',
-      hasRefreshToken: false,
-    }
-  }
+
 
   return detected
 }

package/lib/index.js

@@ -16,7 +16,7 @@ import { OllamaAdapter, ollamaAlive, ollamaModels, ollamaBase } from './ollama.j
 import { createResetCreditService } from './reset-credits.js'
 import { maskEmail, maskLabel } from './mask.js'
 import { proxyFetch } from './proxy.js'
-import { HistoryStore, DEFAULT_HISTORY_DIR } from './history.js'
+import { HistoryStore, resolveHistoryDir } from './history.js'
 import { createDiagnosticsReport } from './diagnostics.js'
 import { createAccountsView } from './accounts-view.js'
 import { createAdapterManager } from './adapter-manager.js'
@@ -185,7 +185,8 @@ export function apply(ctx, rawConfig) {
       bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
-  const history = new HistoryStore(DEFAULT_HISTORY_DIR, 7 * 24 * 60 * 60 * 1000, 1000)
+  const historyDir = ctx?.historyDir || ctx?.storageDir || resolveHistoryDir()
+  const history = new HistoryStore(historyDir, 7 * 24 * 60 * 60 * 1000, 1000)
   if (typeof ctx?.on === 'function') {
     ctx.on('dispose', () => history.dispose())
   }

package/lib/updater.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
@@ -162,12 +162,82 @@ export async function getUpdaterStatus(options, target = getRuntime()) {
   }
 }
 
-export async function installExactPackage(target, packageSpec, options) {
+export function readLockPid(lockPath) {
+  try {
+    if (!existsSync(lockPath)) return undefined
+    const stat = statSync(lockPath)
+    if (stat.isDirectory()) return undefined
+    const content = readFileSync(lockPath, "utf8").trim()
+    if (!content) return undefined
+    try {
+      const parsed = JSON.parse(content)
+      if (parsed && typeof parsed.pid === "number") return parsed.pid
+    } catch {}
+    const num = parseInt(content, 10)
+    if (!isNaN(num) && num > 0) return num
+    const match = /\b(\d{1,8})\b/.exec(content)
+    if (match) return Number(match[1])
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function isPidAlive(pid) {
+  if (typeof pid !== "number" || isNaN(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (err) {
+    return err?.code === "EPERM"
+  }
+}
+
+export function checkAndCleanLock(profileDir, childPid) {
+  const lockPath = resolve(profileDir, "package.json.lock")
+  if (!existsSync(lockPath)) return { locked: false }
+  const pid = readLockPid(lockPath)
+  if (pid !== undefined) {
+    if (isPidAlive(pid)) {
+      if (childPid !== undefined && pid === childPid) {
+        try {
+          rmSync(lockPath, { recursive: true, force: true })
+          return { locked: false, cleaned: true }
+        } catch {
+          return { locked: true, pid }
+        }
+      }
+      return { locked: true, pid }
+    }
+    try {
+      rmSync(lockPath, { recursive: true, force: true })
+      return { locked: false, cleaned: true }
+    } catch {
+      return { locked: true, pid }
+    }
+  }
+  if (childPid !== undefined) {
+    try {
+      rmSync(lockPath, { recursive: true, force: true })
+      return { locked: false, cleaned: true }
+    } catch {}
+  }
+  return { locked: true }
+}
+
+export async function installExactPackage(target, packageSpec, options = {}) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  const lockStatus = checkAndCleanLock(target.profileDir)
+  if (lockStatus.locked) {
+    const error = new Error('Another plugin installation is currently in progress.')
+    error.status = 409
+    error.code = 'ELOCKED'
+    throw error
+  }
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
+      packageSpec,
       `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
     ], {
       cwd: target.profileDir,
@@ -178,13 +248,24 @@ export async function installExactPackage(target, packageSpec, options) {
     let detail = ''
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    let timedOut = false
+    const timeoutMs = options.timeoutMs ?? UPDATE_TIMEOUT_MS
     const timer = setTimeout(() => {
-      child.kill()
+      timedOut = true
+      try { child.kill('SIGTERM') } catch {}
+      setTimeout(() => {
+        try { child.kill('SIGKILL') } catch {}
+        checkAndCleanLock(target.profileDir, child.pid)
+      }, 500).unref?.()
       reject(new Error('Update timed out; use the normal DSH update flow.'))
-    }, UPDATE_TIMEOUT_MS)
+    }, timeoutMs)
     child.once('error', error => { clearTimeout(timer); reject(error) })
-    child.once('exit', code => {
+    child.once('exit', (code) => {
       clearTimeout(timer)
+      if (timedOut) {
+        checkAndCleanLock(target.profileDir, child.pid)
+        return
+      }
       if (code === 0) resolvePromise()
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
     })
@@ -218,6 +299,11 @@ export function registerPluginUpdater(ctx, options) {
           writeJson(response, 409, { ok: false, error: { code: 'busy', message: 'This plugin is already updating.' } })
           return
         }
+        const profileLock = checkAndCleanLock(target.profileDir)
+        if (profileLock.locked) {
+          writeJson(response, 409, { ok: false, error: { code: 'busy', message: 'Another plugin installation is currently in progress in this profile.' } })
+          return
+        }
         installing = true
         try {
           const before = await getUpdaterStatus(options, target)
@@ -240,6 +326,10 @@ export function registerPluginUpdater(ctx, options) {
           installing = false
         }
       } catch (error) {
+        if (error?.status === 409 || error?.code === 'ELOCKED') {
+          writeJson(response, 409, { ok: false, error: { code: 'busy', message: error.message || 'Another plugin installation is currently in progress.' } })
+          return
+        }
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
         writeJson(response, 503, { ok: false, error: { code: 'update_failed', message: String(error?.message || error) } })
       }

package/lib/vault.js

@@ -11,8 +11,8 @@ export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
  */
 export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'scrypt' }, passphrase) {
   const pass = String(passphrase || '').trim()
-  if (!pass || pass.length < 4) {
-    throw new Error('passphrase must be at least 4 characters')
+  if (!pass || pass.length < 12) {
+    throw new Error('passphrase must be at least 12 characters')
   }
 
   const payload = {
@@ -43,7 +43,7 @@ export function importVault(encryptedPayload, passphrase) {
   }
 
   const raw = String(encryptedPayload || '').trim()
-  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:')) {
+  if (!raw.startsWith('DSHE1:') && !raw.startsWith('DSHE2:') && !raw.startsWith('DSHE3:')) {
     throw new Error('invalid vault format: missing DSHE1 header')
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.29",
+  "version": "0.6.31",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -37,7 +37,7 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
   "scripts": {
-    "test": "eslint lib/ test/ && node --test test/*.test.mjs",
+    "test": "eslint lib/ test/ && node --import ./test/_setup.mjs --test test/*.test.mjs",
     "typecheck": "tsc -p tsconfig.checkjs.json"
   },
   "dsh": {

package/lib/importers/coding-agents.js

@@ -1,37 +0,0 @@
-import { readFile } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-export async function discoverCodingAgentConfigs() {
-  const configs = {}
-
-  // 1. Aider (.aider.conf.yml)
-  try {
-    const p = join(homedir(), '.aider.conf.yml')
-    const text = await readFile(p, 'utf8')
-    configs.aider = {
-      name: 'Aider Config',
-      path: p,
-      found: true,
-      raw: text
-    }
-  } catch {
-    // not present
-  }
-
-  // 2. Roo-Code / Roo-Cline settings
-  try {
-    const p = join(homedir(), '.roo-code', 'settings.json')
-    const text = await readFile(p, 'utf8')
-    configs.roocode = {
-      name: 'Roo-Code Config',
-      path: p,
-      found: true,
-      raw: text
-    }
-  } catch {
-    // not present
-  }
-
-  return configs
-}