@goodandready/dsh-subscriptions 0.6.37 → 0.6.38

package/lib/accounts.js

@@ -13,7 +13,6 @@ export function normalizeSlots(slots) {
   const out = []
   const seen = new Set()
   for (const slot of Array.isArray(slots) ? slots : []) {
-    // User-editable config: a null or non-object entry must be skipped, not crash the plugin.
     if (!slot || typeof slot !== 'object') continue
     if (!isProvider(slot.provider)) continue
     const index = Number(slot.index)
@@ -22,10 +21,13 @@ export function normalizeSlots(slots) {
     if (seen.has(ref)) continue
     seen.add(ref)
     out.push({
+      ...slot,
       provider: slot.provider,
       index,
       label: String(slot.label || ''),
       ref,
+      ...(slot.proxyUrl ? { proxyUrl: String(slot.proxyUrl) } : {}),
+      ...(slot.expiresAt ? { expiresAt: Number(slot.expiresAt) } : {}),
     })
   }
   return out
@@ -94,16 +96,27 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   }
 
   async function saveBlob(ref, blob) {
+    if (!ref || typeof ref !== "string") throw new Error("invalid ref for saveBlob")
     const prev = writeQueues.get(ref) || Promise.resolve()
     const next = prev.catch(() => {}).then(async () => {
-      await credentials.set(credentialRef(ref), serializeBlob(blob))
+      try {
+        await credentials.set(credentialRef(ref), serializeBlob(blob))
+      } catch (err) {
+        const wrapErr = new Error(`failed to persist credentials for ${ref}: ${err && err.message || err}`)
+        wrapErr.code = "CREDENTIAL_SAVE_FAILED"
+        wrapErr.cause = err
+        throw wrapErr
+      }
     })
     writeQueues.set(ref, next)
     await next
   }
 
   async function clearRef(ref) {
-    await credentials.unset(credentialRef(ref))
+    if (!ref || typeof ref !== "string") return
+    try {
+      await credentials.unset(credentialRef(ref))
+    } catch { /* best-effort unset */ }
     cooldowns.delete(ref)
     quotas.delete(ref)
     quarantines.delete(ref)
@@ -202,6 +215,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   }
 
   async function ensureFresh(provider, blob, ref) {
+    if (!blob || typeof blob !== 'object') return blob
+    if (blob.apiKeyOnly || (blob.apiKey && (!blob.refreshToken || blob.refreshToken === blob.apiKey))) return blob
     if (!blob.refreshToken) return blob
     if (blob.expiresAt && blob.expiresAt - SKEW_MS > Date.now()) return blob
     const lockKey = ref || (provider + ":" + (blob.accountId || blob.email || (blob.refreshToken && blob.refreshToken.slice(-16)) || "anon"))

package/lib/adapter-manager.js

@@ -202,6 +202,8 @@ export function createAdapterManager({
   }
 
   let lastModelRefresh = 0
+  const providerModelCache = new Map()
+
   async function refreshModels() {
     if (Date.now() - lastModelRefresh < 60 * 1000) return
     lastModelRefresh = Date.now()
@@ -214,7 +216,10 @@ export function createAdapterManager({
         if (!blob) continue
         const fresh = await store.ensureFresh(provider, blob, slot.ref)
         const cfg = vendorConfig(provider, live())
-        await getVendor(provider).listModels(fresh, cfg, fetch).catch(() => {})
+        const liveModels = await getVendor(provider).listModels(fresh, cfg, fetch).catch(() => null)
+        if (Array.isArray(liveModels) && liveModels.length) {
+          providerModelCache.set(provider, liveModels)
+        }
       } catch { /* best-effort */ }
     }
   }

package/lib/adapter.js

@@ -45,20 +45,24 @@ export class SubscriptionAdapter extends LlmAdapter {
   async listModels(provider) {
     const accounts = await this.deps.listAccounts(provider)
     const targetAccount = accounts.find((a) => a.hasToken)
-    if (!targetAccount) return []
-    const cfg = this.deps.vendorConfig(provider)
-    const fetchImpl = pickFetch(this.deps, targetAccount.ref)
     let models = null
-    try {
-      const blob = await this.deps.ensureFresh(
-        provider,
-        await this.deps.loadBlob(targetAccount.ref),
-        targetAccount.ref,
-      )
-      const live = await getVendor(provider).listModels(blob, cfg, fetchImpl)
-      if (Array.isArray(live) && live.length) models = live
-    } catch { /* use built-in catalog */ }
-    if (!models) models = modelCatalog(provider, cfg.models)
+    if (targetAccount) {
+      const cfg = this.deps.vendorConfig(provider)
+      const fetchImpl = pickFetch(this.deps, targetAccount.ref)
+      try {
+        const blob = await this.deps.ensureFresh(
+          provider,
+          await this.deps.loadBlob(targetAccount.ref),
+          targetAccount.ref,
+        )
+        const live = await getVendor(provider).listModels(blob, cfg, fetchImpl)
+        if (Array.isArray(live) && live.length) models = live
+      } catch { /* use built-in catalog */ }
+    }
+    if (!models) {
+      const cfg = this.deps.vendorConfig(provider)
+      models = modelCatalog(provider, cfg ? cfg.models : undefined)
+    }
     // #94: optionally hide test/preview/beta/legacy ids from the picker.
     if (typeof this.deps.hideDeprecatedModels === 'function' && this.deps.hideDeprecatedModels()) {
       models = models.filter((m) => !isDeprecatedId(String((m && m.id) || '')))

package/lib/blob.js

@@ -1,30 +1,33 @@
 function asString(value) {
-  return value == null ? '' : String(value)
+  return value == null ? "" : String(value)
 }
 
 export function serializeBlob(obj) {
-  const accessToken = asString(obj && obj.accessToken)
-  const refreshToken = asString(obj && obj.refreshToken)
-  if (!accessToken && !refreshToken) {
-    throw new Error('oauth blob needs accessToken or refreshToken')
+  if (!obj || typeof obj !== "object") throw new Error("invalid oauth blob")
+  const accessToken = asString(obj.accessToken)
+  const refreshToken = asString(obj.refreshToken)
+  if (!accessToken && !refreshToken && !obj.apiKey) {
+    throw new Error("oauth blob needs accessToken or refreshToken")
   }
   return JSON.stringify({
+    ...obj,
     accessToken,
     refreshToken,
-    expiresAt: Number(obj && obj.expiresAt) || 0,
-    label: asString(obj && obj.label),
-    email: asString(obj && obj.email),
-    accountId: asString(obj && obj.accountId),
-    projectId: asString(obj && obj.projectId),
-    ...(Array.isArray(obj && obj.usage) ? { usage: obj.usage } : {}),
-    ...((obj && obj.usageAt) ? { usageAt: Number(obj.usageAt) } : {}),
+    expiresAt: Number(obj.expiresAt) || 0,
+    label: asString(obj.label),
+    email: asString(obj.email),
+    accountId: asString(obj.accountId),
+    projectId: asString(obj.projectId),
+    ...(Array.isArray(obj.usage) ? { usage: obj.usage } : {}),
+    ...(obj.usageAt ? { usageAt: Number(obj.usageAt) } : {}),
   })
 }
 
 export function parseBlob(text) {
-  const obj = typeof text === 'string' ? JSON.parse(text) : text
-  if (!obj || typeof obj !== 'object') throw new Error('invalid oauth blob')
+  const obj = typeof text === "string" ? JSON.parse(text) : text
+  if (!obj || typeof obj !== "object") throw new Error("invalid oauth blob")
   return {
+    ...obj,
     accessToken: asString(obj.accessToken),
     refreshToken: asString(obj.refreshToken),
     expiresAt: Number(obj.expiresAt) || 0,
@@ -36,4 +39,3 @@ export function parseBlob(text) {
     ...(obj.usageAt ? { usageAt: Number(obj.usageAt) } : {}),
   }
 }
-

package/lib/config-schema.js

@@ -149,3 +149,55 @@ export function publicConfig(cfg) {
 
   return clone
 }
+
+export function restoreMaskedSecrets(incoming, existing) {
+  if (!incoming || typeof incoming !== "object") return incoming
+  if (!existing || typeof existing !== "object") return incoming
+
+  const out = { ...incoming }
+
+  for (const key of Object.keys(out)) {
+    if ((key.endsWith("ClientSecret") || key.endsWith("Secret")) && typeof out[key] === "string") {
+      if (out[key].includes("••••")) {
+        out[key] = existing[key] || ""
+      }
+    }
+  }
+
+  if (Array.isArray(out.slots) && Array.isArray(existing.slots)) {
+    out.slots = out.slots.map((s) => {
+      if (!s || typeof s !== "object" || typeof s.proxyUrl !== "string" || !s.proxyUrl.includes("••••")) return s
+      const match = existing.slots.find((e) => e && e.provider === s.provider && Number(e.index) === Number(s.index))
+      if (match && match.proxyUrl) {
+        return { ...s, proxyUrl: match.proxyUrl }
+      }
+      return s
+    })
+  }
+
+  if (Array.isArray(out.customVendors) && Array.isArray(existing.customVendors)) {
+    out.customVendors = out.customVendors.map((cv) => {
+      if (!cv || typeof cv !== "object") return cv
+      const match = existing.customVendors.find((e) => e && e.id === cv.id)
+      if (!match) return cv
+      const copy = { ...cv }
+      for (const f of ["apiKey", "token", "secret", "clientSecret"]) {
+        if (typeof copy[f] === "string" && copy[f].includes("••••")) {
+          copy[f] = match[f] || ""
+        }
+      }
+      if (copy.headers && typeof copy.headers === "object" && match.headers && typeof match.headers === "object") {
+        const h = { ...copy.headers }
+        for (const hk of Object.keys(h)) {
+          if (typeof h[hk] === "string" && h[hk].includes("••••")) {
+            h[hk] = match.headers[hk] || ""
+          }
+        }
+        copy.headers = h
+      }
+      return copy
+    })
+  }
+
+  return out
+}

package/lib/routes/status.js

@@ -1,7 +1,7 @@
 // #374: Sensitive GET routes protected by same-origin check
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
-import { Config, plainConfig, publicConfig } from '../config-schema.js'
+import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
@@ -65,7 +65,8 @@ export function registerStatusRoutes(ctx, state) {
         return
       }
       // #379: revision conflict detection (CAS)
-      const baseRev = payload?.revision != null ? Number(payload.revision) : (req.headers?.['if-match'] ? Number(req.headers['if-match']) : null)
+      const rawRev = payload?.revision ?? payload?.config?.revision ?? req.headers?.['if-match']
+      const baseRev = rawRev != null ? Number(rawRev) : null
       if (baseRev != null && !Number.isNaN(baseRev) && baseRev !== currentRevision) {
         writeJson(res, 409, {
           ok: false,
@@ -80,13 +81,16 @@ export function registerStatusRoutes(ctx, state) {
 
       if (payload && typeof payload.config === 'object') payload = payload.config
       try {
+        payload = restoreMaskedSecrets(payload, live())
         if (Array.isArray(payload.slots)) payload.slots = stripLegacySlots(payload.slots)
         const parsed = plainConfig(Config(payload))
         const dropped = droppedCredentialRefs(live().slots, parsed.slots)
         await getSettingsApi().replace(parsed)
         currentRevision++
         syncCustomVendors()
-        for (const ref of dropped) await store.clearRef(ref)
+        for (const ref of dropped) {
+          try { await store.clearRef(ref) } catch { /* best-effort cleanup */ }
+        }
         await syncAdapter()
         writeJson(res, 200, await configResponse())
       } catch (e) {

package/lib/vendors/claude.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from '../http.js'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { anthropicPayload, modelCatalog } from '../messages.js'
 import { jsonTokenRequest, anthropicStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
@@ -119,15 +120,50 @@ export async function refresh(cfg, blob, fetchImpl) {
   return decorate(tokenBlobFromOAuth(json, { label: blob.label, email: blob.email }), fetchImpl)
 }
 
-export async function listModels(blob, cfg) {
-  const raw = cfg.models && cfg.models.length ? cfg.models : defaults().models
-  const entries = raw.map((entry) => {
-    const model = typeof entry === 'string' ? { id: entry, name: entry } : { ...entry }
+export async function listModels(blob, cfg, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const rawDefault = (cfg && cfg.models && cfg.models.length) ? cfg.models : defaults().models
+  const defaultCatalog = modelCatalog(id, rawDefault.map((entry) => {
+    const model = typeof entry === "string" ? { id: entry, name: entry } : { ...entry }
     const levels = effortLevelsForModel(model.id || model.name)
     if (!levels) return model
     return { ...model, reasoning: { efforts: levels.map((level) => ({ id: level, name: level })) } }
-  })
-  return modelCatalog(id, entries)
+  }))
+
+  if (!blob || !blob.accessToken) return defaultCatalog
+
+  try {
+    const headers = {
+      "Accept": "application/json",
+      "anthropic-version": "2023-06-01",
+    }
+    if (blob.accessToken.startsWith("sk-ant-")) {
+      headers["x-api-key"] = blob.accessToken
+    } else {
+      headers["Authorization"] = `Bearer ${blob.accessToken}`
+    }
+
+    const res = await fetchWithTimeout(impl, "https://api.anthropic.com/v1/models", { headers }, { timeoutMs: 15000 })
+    if (!res.ok) return defaultCatalog
+    const json = await readJson(res)
+    const items = json && json.data
+    if (!Array.isArray(items) || !items.length) return defaultCatalog
+    const rows = []
+    for (const item of items) {
+      const modelId = item.id || item.display_name
+      if (!modelId) continue
+      const levels = effortLevelsForModel(modelId)
+      rows.push({
+        id: modelId,
+        name: item.display_name || modelId,
+        ...(levels ? { reasoning: { efforts: levels.map((level) => ({ id: level, name: level })) } } : {}),
+      })
+    }
+    if (!rows.length) return defaultCatalog
+    return modelCatalog(id, rows)
+  } catch {
+    return defaultCatalog
+  }
 }
 
 // Advertise adaptive thinking + effort only for models whose capability table

package/lib/vendors/copilot.js

@@ -1,5 +1,6 @@
 import { LlmError } from "@deepseek-ai/dsh-llm"
-import { openaiMessages, openaiTools } from "../messages.js"
+import { openaiMessages, openaiTools, modelCatalog } from "../messages.js"
+import { fetchWithTimeout } from "../http.js"
 import { openaiChatStream, readJson, httpError } from "../wire.js"
 import { asUsageSnapshot } from "../usage.js"
 
@@ -68,8 +69,50 @@ export function authorizeUrl() {
   return "https://github.com/login/device"
 }
 
-export async function listModels() {
-  return COPILOT_MODELS
+export async function listModels(blob, cfg, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const fallback = modelCatalog(id, (cfg && cfg.models) || COPILOT_MODELS)
+  if (!blob) return fallback
+  const githubToken = blob.refreshToken || blob.githubToken
+  let copilotToken = blob.accessToken
+  try {
+    if ((!copilotToken || !blob.expiresAt || blob.expiresAt < Date.now() + 60000) && githubToken) {
+      const exchange = await exchangeCopilotToken(githubToken, impl)
+      if (exchange && exchange.token) {
+        copilotToken = exchange.token
+        blob.accessToken = exchange.token
+        if (exchange.expires_at) blob.expiresAt = exchange.expires_at * 1000
+      }
+    }
+    if (!copilotToken) return fallback
+    const res = await fetchWithTimeout(impl, "https://api.githubcopilot.com/models", {
+      headers: {
+        Authorization: `Bearer ${copilotToken}`,
+        Accept: "application/json",
+        "User-Agent": "GitHubCopilotChat/0.24.0",
+      },
+    }, { timeoutMs: 15000 })
+    if (!res.ok) return fallback
+    const json = await readJson(res)
+    const items = json && (json.data || json.models || json)
+    if (!Array.isArray(items) || !items.length) return fallback
+    const rows = []
+    for (const item of items) {
+      const modelId = item.id || item.name
+      if (!modelId) continue
+      if (item.capabilities && item.capabilities.type && item.capabilities.type !== "chat") continue
+      rows.push({
+        id: modelId,
+        name: item.name || modelId,
+        ...(item.capabilities && item.capabilities.limits && item.capabilities.limits.max_prompt_tokens ? { contextWindow: item.capabilities.limits.max_prompt_tokens } : {}),
+        ...(item.capabilities && item.capabilities.supports && item.capabilities.supports.vision ? { inputModalities: ["text", "image"] } : {}),
+      })
+    }
+    if (!rows.length) return fallback
+    return modelCatalog(id, rows)
+  } catch {
+    return fallback
+  }
 }
 
 export function getTelemetryHeaders(sessionId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.37",
+  "version": "0.6.38",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",