@goodandready/dsh-subscriptions 0.6.35 → 0.6.37

package/lib/accounts-view.js

@@ -5,7 +5,7 @@ import {
   antigravityIdentityHeaders,
 } from './code-assist.js'
 
-export async function enrichAntigravityAccount(slot, info, store, fetch) {
+async function enrichAntigravityAccount(slot, info, store, fetch) {
   if (!info.configured || slot.provider !== 'antigravity') return info
   let blob
   try { blob = await store.loadBlob(slot.ref) } catch { return info }

package/lib/client.js

@@ -2180,16 +2180,6 @@ const cssId = 'dsh-subscriptions/settings.module.css'
             ))
             if (typeof un2 === 'function') cleanups.push(un2)
 
-            const un3 = ctx.slots.inject('settings.plugin.item', () => ctx.slots.register(
-              {
-                name: 'settings.plugin.item',
-                key: NS,
-                locale: NS,
-                inject: () => ({ ctx: ctx }),
-              },
-              PluginCard,
-            ))
-            if (typeof un3 === 'function') cleanups.push(un3)
           }
         } catch {
           // Slot system not available — expected on headless / non-web profiles.

package/lib/config-schema.js

@@ -1,6 +1,14 @@
 import z from '@deepseek-ai/schemastery'
 import { PROVIDERS } from './refs.js'
 
+// Defensive polyfill for environments / runners with schemastery < 3.18.4
+const proto = z?.Schema?.prototype || (typeof z?.number === "function" ? Object.getPrototypeOf(z.number()) : null)
+if (proto && typeof proto.volatile !== "function") {
+  proto.volatile = function volatile() {
+    return typeof this.extra === "function" ? this.extra("volatile", true) : this
+  }
+}
+
 export const Slot = z.object({
   provider: z.string().default('codex')
     .description('One of: codex, claude, grok, antigravity.'),

package/lib/diagnostics.js

@@ -2,7 +2,7 @@ import { maskText } from './mask.js'
 import { normalizeSlots } from './accounts.js'
 import { PROVIDERS } from './refs.js'
 
-export function scrubReport(v) {
+function scrubReport(v) {
   if (typeof v === 'string') return maskText(v)
   if (Array.isArray(v)) return v.map(scrubReport)
   if (v && typeof v === 'object') {

package/lib/http.js

@@ -131,7 +131,49 @@ export function queryOf(req) {
 /**
  * Fetch with connect/overall timeout using AbortSignal.any.
  */
-export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000 } = {}) {
+
+export function isSameOrigin(url1, url2) {
+  try {
+    const u1 = new URL(url1)
+    const u2 = new URL(url2)
+    return u1.origin.toLowerCase() === u2.origin.toLowerCase()
+  } catch {
+    return false
+  }
+}
+
+export function sanitizeRequestHeaders(url, init = {}, options = {}) {
+  const headers = { ...(init.headers || {}) }
+  if (!url) return headers
+  try {
+    const parsed = new URL(url)
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      delete headers.authorization
+      delete headers.Authorization
+      delete headers.cookie
+      delete headers.Cookie
+      return headers
+    }
+    const allowedOrigins = options.allowedOrigins || []
+    if (allowedOrigins.length > 0) {
+      const targetOrigin = parsed.origin.toLowerCase()
+      const isAllowed = allowedOrigins.some(o => {
+        try { return new URL(o).origin.toLowerCase() === targetOrigin } catch { return false }
+      })
+      if (!isAllowed) {
+        delete headers.authorization
+        delete headers.Authorization
+        delete headers.cookie
+        delete headers.Cookie
+      }
+    }
+  } catch {}
+  return headers
+}
+
+export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins } = {}) {
+  const safeHeaders = sanitizeRequestHeaders(url, init, { allowedOrigins })
+  init = { ...init, headers: safeHeaders }
   const impl = fetchImpl || fetch
   if (!timeoutMs || timeoutMs <= 0) return impl(url, init)
   const controller = new AbortController()

package/lib/import-auth.js

@@ -232,7 +232,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
       accessToken: tok,
       refreshToken: tok,
       githubToken: tok,
-      expiresAt: Date.now() + 30 * 86400 * 1000,
+      expiresAt: 0,
       email,
       label: email,
     }

package/lib/index.js

@@ -151,7 +151,7 @@ export function apply(ctx, rawConfig) {
       if (!settingsSvc) return
       const served = describeRow()
       if (served && served.value) {
-        try { cachedConfig = plainConfig(Config(plainConfig(served.value))) } catch { /* keep current */ }
+        try { syncSnapshot(plainConfig(Config(plainConfig(served.value)))) } catch { /* keep current */ }
       }
       if (typeof sctx.effect === 'function') {
         sctx.effect(() => () => { settingsSvc = null })
@@ -168,7 +168,7 @@ export function apply(ctx, rawConfig) {
   const onSettingsChanged = () => {
     try {
       const row = describeRow()
-      if (row && row.value) cachedConfig = plainConfig(Config(plainConfig(row.value)))
+      if (row && row.value) syncSnapshot(plainConfig(Config(plainConfig(row.value))))
       else syncSnapshot()
       reconcileSlots().catch(() => {})
     } catch { /* keep existing snapshot on error */ }
@@ -198,12 +198,16 @@ export function apply(ctx, rawConfig) {
     return proxyFetch(slot.proxyUrl)
   }
 
-  function redirectFor(ref, provider) {
+  function redirectFor(provider, ref, reqOrigin) {
+    if (typeof provider === "object" && provider !== null) {
+      const opts = provider
+      provider = opts.provider
+      ref = opts.ref
+      reqOrigin = opts.origin
+    }
     if (live().useWebCallback) {
-      const origin = (ctx.webServer && typeof ctx.webServer.url === 'string')
-        ? ctx.webServer.url
-        : ''
-      return webCallbackUri(origin, ref)
+      const origin = reqOrigin || ((ctx.webServer && typeof ctx.webServer.url === "string") ? ctx.webServer.url : "")
+      return webCallbackUri(origin)
     }
     return getVendor(provider).redirectUri(vendorConfig(provider, live()))
   }
@@ -359,20 +363,17 @@ export function apply(ctx, rawConfig) {
   }
 
   async function completeOAuth({ provider, index, code, state }) {
-    if (!isProvider(provider)) throw new Error('unknown provider')
-    const n = Number(index)
-    const ref = oauthRef(provider, n)
+    if (!state) throw new Error('missing oauth state')
     sweepPending(Date.now())
-    let row = state ? pending.get(state) : null
-    if (!row) {
-      for (const item of pending.values()) {
-        if (item.provider === provider && item.index === n) row = item
-      }
-    }
-    if (!row || !row.verifier) throw new Error('login session expired; start Connect again')
-    if (row.provider !== provider || row.index !== n) throw new Error('state does not match this account')
-    const cfg = { ...vendorConfig(provider, live()), redirectUri: row.redirectUri }
-    const blob = await getVendor(provider).exchangeCode(cfg, {
+    const row = pending.get(state)
+    if (!row || !row.verifier) throw new Error('login session expired or invalid state; start Connect again')
+    if (provider && row.provider !== provider) throw new Error('state provider mismatch')
+    if (index !== undefined && index !== null && Number(index) !== row.index) throw new Error('state index mismatch')
+    const actualProvider = row.provider
+    const n = row.index
+    const ref = oauthRef(actualProvider, n)
+    const cfg = { ...vendorConfig(actualProvider, live()), redirectUri: row.redirectUri }
+    const blob = await getVendor(actualProvider).exchangeCode(cfg, {
       verifier: row.verifier,
       challenge: row.challenge,
       state: row.state,
@@ -384,7 +385,7 @@ export function apply(ctx, rawConfig) {
     pending.delete(row.state)
     await syncAdapter()
     refreshModels().catch(() => {})
-    return { ref, label: pmL(blob.label || blob.email) || displayName(provider) }
+    return { ref, label: pmL(blob.label || blob.email) || displayName(actualProvider) }
   }
 
   // Privacy masking

package/lib/jwt.js

@@ -1,4 +1,4 @@
-export function decodeJwtPayload(token) {
+function decodeJwtPayload(token) {
   const raw = String(token || '')
   const parts = raw.split('.')
   if (parts.length < 2) return null

package/lib/messages.js

@@ -102,7 +102,7 @@ export function openaiTools(options) {
   }))
 }
 
-export function reconcileResponsesInput(items) {
+function reconcileResponsesInput(items) {
   const result = []
   const callsSeen = new Set()
   const outputsSeen = new Set()

package/lib/routes/accounts.js

@@ -4,7 +4,7 @@ import { Config, plainConfig, publicConfig } from '../config-schema.js'
 import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
-import { isProvider, oauthRef } from '../refs.js'
+import { isProvider, oauthRef, parseOauthRef } from '../refs.js'
 
 export function registerAccountsRoutes(ctx, state) {
   const {
@@ -143,8 +143,13 @@ export function registerAccountsRoutes(ctx, state) {
       } catch {
         body = null
       }
-      if (!body || !body.provider) {
-        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'missing provider' } })
+      if (!body || !body.provider || !isProvider(body.provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'unknown or missing provider' } })
+        return
+      }
+      const idxNum = Number(body.index) || 1
+      if (!Number.isInteger(idxNum) || idxNum < 1 || idxNum > 99) {
+        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'invalid account index' } })
         return
       }
       try {
@@ -164,7 +169,7 @@ export function registerAccountsRoutes(ctx, state) {
           syncCustomVendors()
         }
         const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
-        const ref = slot ? slot.ref : `${prov.toUpperCase()}_OAUTH_${idx}`
+        const ref = slot ? slot.ref : oauthRef(prov, idx)
         await store.saveBlob(ref, blob)
         await syncAdapter()
         refreshModels().catch(() => {})
@@ -201,11 +206,12 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
         return
       }
-      const passphrase = payload.passphrase
-      if (!passphrase || typeof passphrase !== 'string') {
-        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase is required' } })
+      const passphrase = String(payload.passphrase || '').trim()
+      if (!passphrase || passphrase.length < 12) {
+        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase must be at least 12 characters' } })
         return
       }
+      const algorithm = payload.algorithm === 'pbkdf2' || payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'scrypt'
       try {
         const accounts = []
         for (const slot of normalizeSlots(live().slots)) {
@@ -219,7 +225,7 @@ export function registerAccountsRoutes(ctx, state) {
           return
         }
         const bundle = JSON.stringify({ v: 1, exportedAt: Date.now(), accounts })
-        const encrypted = encryptWithPassphrase(bundle, passphrase)
+        const encrypted = encryptWithPassphrase(bundle, passphrase, { algorithm })
         writeJson(res, 200, { ok: true, payload: encrypted, count: accounts.length })
       } catch (e) {
         writeJson(res, 500, { ok: false, error: { code: 'export', message: String(e && e.message || e) } })
@@ -265,6 +271,7 @@ export function registerAccountsRoutes(ctx, state) {
       let imported = 0
       for (const row of bundle.accounts) {
         try {
+          if (!row || typeof row.ref !== 'string' || !parseOauthRef(row.ref) || !row.blob) continue
           await store.saveBlob(row.ref, row.blob)
           imported++
         } catch { /* skip broken */ }
@@ -301,6 +308,10 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
         return
       }
+      if (!Number.isInteger(index) || index < 1 || index > 99) {
+        writeJson(res, 400, { ok: false, error: { code: 'index', message: 'account index must be an integer between 1 and 99' } })
+        return
+      }
       if (!refreshToken && !apiKey) {
         writeJson(res, 400, { ok: false, error: { code: 'token', message: 'refreshToken or apiKey is required' } })
         return

package/lib/routes/oauth.js

@@ -39,7 +39,7 @@ export function registerOauthRoutes(ctx, state) {
         return
       }
       const origin = requestOrigin(req)
-      const redirectUri = redirectFor(provider, live(), origin)
+      const redirectUri = redirectFor(provider, `${provider}:${index}`, origin)
       const pkce = await createPkce()
       pending.set(pkce.state, {
         provider,

package/lib/routes/status.js

@@ -1,3 +1,4 @@
+// #374: Sensitive GET routes protected by same-origin check
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig } from '../config-schema.js'

package/lib/vendors/claude.js

@@ -133,7 +133,7 @@ export async function listModels(blob, cfg) {
 // Advertise adaptive thinking + effort only for models whose capability table
 // declares the chosen level; anything else (unsupported family, 'off', no
 // selection) leaves the request untouched so behavior stays opt-in.
-export function applyClaudeThinking(payload, options) {
+function applyClaudeThinking(payload, options) {
   const effort = options && String(options.reasoningEffort || '')
   if (!effort || effort === 'off') return payload
   const levels = effortLevelsForModel(payload && payload.model)

package/lib/vendors/codex.js

@@ -14,7 +14,7 @@ const USAGE = 'https://chatgpt.com/backend-api/wham/usage'
 // code_verifier server-side; we finish with the normal PKCE exchange.
 const DEVICE_USERCODE_URL = 'https://auth.openai.com/api/accounts/deviceauth/usercode'
 const DEVICE_TOKEN_URL = 'https://auth.openai.com/api/accounts/deviceauth/token'
-export const DEVICE_AUTH_URL = 'https://auth.openai.com/codex/device'
+const DEVICE_AUTH_URL = 'https://auth.openai.com/codex/device'
 const DEVICE_REDIRECT_URI = 'https://auth.openai.com/deviceauth/callback'
 const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke'
 const INSTRUCTIONS = 'You are a coding assistant using a ChatGPT Codex subscription.'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.35",
+  "version": "0.6.37",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -70,6 +70,7 @@
   "devDependencies": {
     "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
     "@types/node": "^22.20.2",
-    "typescript": "^7.0.2"
+    "typescript": "^7.0.2",
+    "@deepseek-ai/schemastery": "^3.18.4"
   }
 }