@goodandready/dsh-subscriptions 0.6.40 → 0.6.43

package/lib/http.js

@@ -81,7 +81,7 @@ export function isTrustedSettingsRequest(request) {
   if (secFetchSite === 'cross-site') return false
 
   // 2. If origin header is present, it must match host
-  const host = headers.host || headers['x-forwarded-host']
+  const host = String(Array.isArray(headers.host) ? headers.host[0] : (headers.host || headers['x-forwarded-host'] || ''))
   const origin = headers.origin
   if (origin) {
     try {
@@ -167,17 +167,36 @@ export function sanitizeRequestHeaders(url, init = {}, options = {}) {
         delete headers.Cookie
       }
     }
-  } catch {}
+  } catch (err) {
+    void err
+    return headers
+  }
   return headers
 }
 
-export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins } = {}) {
+export function isTimeoutError(err) {
+  if (!err) return false
+  return err.name === 'TimeoutError'
+    || err.code === 'ETIMEDOUT'
+    || (err.name === 'AbortError' && String(err.message || '').toLowerCase().includes('timeout'))
+    || String(err.message || '').toLowerCase().includes('aborted due to timeout')
+    || String(err.message || '').toLowerCase().includes('timed out')
+    || String(err.message || '').toLowerCase().includes('operation was aborted')
+}
+
+/**
+ * @param {any} fetchImpl
+ * @param {string} url
+ * @param {any} [init]
+ * @param {{ timeoutMs?: number, allowedOrigins?: string[], stream?: boolean }} [options]
+ */
+export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins, stream = false } = {}) {
   const safeHeaders = sanitizeRequestHeaders(url, init, { allowedOrigins })
   init = { ...init, headers: safeHeaders }
   const impl = fetchImpl || fetch
   if (!timeoutMs || timeoutMs <= 0) return impl(url, init)
   const controller = new AbortController()
-  const timer = setTimeout(() => {
+  let timer = setTimeout(() => {
     controller.abort(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
   }, timeoutMs)
 
@@ -186,9 +205,74 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
     : controller.signal
 
   try {
-    return await impl(url, { ...init, signal })
-  } finally {
+    const res = await impl(url, { ...init, signal })
+    if (stream) {
+      clearTimeout(timer)
+      return res
+    }
+    const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
+    const origText = typeof res.text === 'function' ? res.text.bind(res) : null
+    if (origJson) {
+      res.json = () => {
+        if (controller.signal.aborted) {
+          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+        }
+        return new Promise((resolve, reject) => {
+          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+          controller.signal.addEventListener('abort', onAbort, { once: true })
+          origJson().then(
+            (val) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              resolve(val)
+            },
+            (err) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              if (controller.signal.aborted) {
+                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+              } else {
+                reject(err)
+              }
+            }
+          )
+        })
+      }
+    }
+    if (origText) {
+      res.text = () => {
+        if (controller.signal.aborted) {
+          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+        }
+        return new Promise((resolve, reject) => {
+          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+          controller.signal.addEventListener('abort', onAbort, { once: true })
+          origText().then(
+            (val) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              resolve(val)
+            },
+            (err) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              if (controller.signal.aborted) {
+                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+              } else {
+                reject(err)
+              }
+            }
+          )
+        })
+      }
+    }
+    return res
+  } catch (err) {
     clearTimeout(timer)
+    if (controller.signal.aborted && !isTimeoutError(err)) {
+      throw new DOMException('The operation was aborted due to timeout', 'TimeoutError')
+    }
+    throw err
   }
 }
 

package/lib/import-auth.js

@@ -39,6 +39,7 @@ async function discoverLocalCliSessionsInner() {
     const tok = codex.tokens || codex
     detected.codex = {
       provider: 'codex',
+      source: 'file',
       path: homeFile('.codex', 'auth.json'),
       email: codex.email || codex.account || '',
       hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
@@ -54,6 +55,7 @@ async function discoverLocalCliSessionsInner() {
     if (grok && (grok.access_token || grok.token || (grok.tokens && grok.tokens.access_token))) {
       detected.grok = {
         provider: 'grok',
+        source: 'file',
         path: p,
         email: grok.email || grok.account || '',
         hasRefreshToken: !!(grok.refresh_token || (grok.tokens && grok.tokens.refresh_token)),
@@ -73,6 +75,7 @@ async function discoverLocalCliSessionsInner() {
     if (tok && (tok.access_token || tok.accessToken)) {
       detected.antigravity = {
         provider: 'antigravity',
+        source: 'file',
         path: p,
         email: agy.email || tok.account || '',
         hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
@@ -86,6 +89,7 @@ async function discoverLocalCliSessionsInner() {
   if (kimi && (kimi.access_token || kimi.token)) {
     detected.kimi = {
       provider: 'kimi',
+      source: 'file',
       path: homeFile('.kimi-code', 'credentials', 'kimi-code.json'),
       email: kimi.email || kimi.account || '',
       hasRefreshToken: !!(kimi.refresh_token || kimi.refreshToken),
@@ -103,6 +107,7 @@ async function discoverLocalCliSessionsInner() {
     if (glm && (glm.apiKey || glm.api_key || (glm.provider && glm.provider.apiKey))) {
       detected.glm = {
         provider: 'glm',
+        source: 'file',
         path: p,
         email: 'ZCode CLI Account',
         hasRefreshToken: false,
@@ -111,20 +116,31 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 6. Cursor Token (env, CLI config or IDE state)
+  // 6. Cursor Token (CLI config, auth.json, or env)
   const cursorCliConfig = await readJson(homeFile('.cursor', 'cli-config.json'))
-  if (process.env.CURSOR_ACCESS_TOKEN) {
+  const cursorAuthConfig = await readJson(homeFile('.cursor', 'auth.json'))
+  if (cursorCliConfig && (cursorCliConfig.authInfo || cursorCliConfig.serverConfigCache)) {
     detected.cursor = {
       provider: 'cursor',
-      path: 'CURSOR_ACCESS_TOKEN env',
-      email: 'Cursor IDE User',
+      source: 'file',
+      path: homeFile('.cursor', 'cli-config.json'),
+      email: (cursorCliConfig.authInfo && cursorCliConfig.authInfo.email) || 'Cursor CLI User',
       hasRefreshToken: false,
     }
-  } else if (cursorCliConfig && (cursorCliConfig.authInfo || cursorCliConfig.serverConfigCache)) {
+  } else if (cursorAuthConfig && (cursorAuthConfig.accessToken || cursorAuthConfig.access_token || (cursorAuthConfig.authInfo && cursorAuthConfig.authInfo.authId))) {
     detected.cursor = {
       provider: 'cursor',
-      path: homeFile('.cursor', 'cli-config.json'),
-      email: (cursorCliConfig.authInfo && cursorCliConfig.authInfo.email) || 'Cursor CLI User',
+      source: 'file',
+      path: homeFile('.cursor', 'auth.json'),
+      email: (cursorAuthConfig.authInfo && cursorAuthConfig.authInfo.email) || cursorAuthConfig.email || 'Cursor User',
+      hasRefreshToken: false,
+    }
+  } else if (process.env.CURSOR_ACCESS_TOKEN) {
+    detected.cursor = {
+      provider: 'cursor',
+      source: 'env',
+      path: 'CURSOR_ACCESS_TOKEN',
+      email: 'Cursor IDE User',
       hasRefreshToken: false,
     }
   }
@@ -139,6 +155,7 @@ async function discoverLocalCliSessionsInner() {
     if (k && (k.accessToken || k.access_token || k.token)) {
       detected.kiro = {
         provider: 'kiro',
+        source: 'file',
         path: p,
         email: k.email || k.account || 'AWS Kiro User',
         hasRefreshToken: !!(k.refreshToken || k.refresh_token),
@@ -149,7 +166,8 @@ async function discoverLocalCliSessionsInner() {
   if (!detected.kiro && process.env.KIRO_API_KEY) {
     detected.kiro = {
       provider: 'kiro',
-      path: 'KIRO_API_KEY env',
+      source: 'env',
+      path: 'KIRO_API_KEY',
       email: 'AWS Kiro API Key',
       hasRefreshToken: false,
     }
@@ -158,12 +176,15 @@ async function discoverLocalCliSessionsInner() {
   // 8. Claude CLI Direct Import
   const claudeCreds = await readClaudeCredentials(activeHome)
   if (claudeCreds) {
-    detected['claude-cli'] = {
+    const claudeEntry = {
       provider: 'claude',
+      source: 'file',
       path: homeFile('.claude', 'credentials.json'),
-      email: 'Claude Code CLI User',
+      email: claudeCreds.email || 'Claude Code CLI User',
       hasRefreshToken: !!claudeCreds.refreshToken,
     }
+    detected.claude = claudeEntry
+    detected['claude-cli'] = claudeEntry
   }
 
   // 9. GitHub Copilot token
@@ -179,6 +200,7 @@ async function discoverLocalCliSessionsInner() {
       if (tok) {
         detected.copilot = {
           provider: 'copilot',
+          source: 'file',
           path: p,
           email: gh.user || 'GitHub Copilot User',
           hasRefreshToken: false,
@@ -190,37 +212,37 @@ async function discoverLocalCliSessionsInner() {
   if (!detected.copilot && (process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN)) {
     detected.copilot = {
       provider: 'copilot',
-      path: 'GITHUB_COPILOT_TOKEN env',
+      source: 'env',
+      path: process.env.GITHUB_COPILOT_TOKEN ? 'GITHUB_COPILOT_TOKEN' : 'GH_TOKEN',
       email: 'GitHub Copilot User',
       hasRefreshToken: false,
     }
   }
 
-
-
   return detected
 }
 
 export async function loadLocalCliBlob(provider, options = {}) {
+  const canonical = (provider === 'claude-cli') ? 'claude' : provider
   const discovered = await discoverLocalCliSessions(options)
-  const info = discovered[provider]
+  const info = discovered[canonical] || discovered[provider]
   if (!info) throw new Error(`no local CLI session found for ${provider}`)
 
-  if (provider === 'claude-cli' || (provider === 'claude' && info.provider === 'claude')) {
+  if (canonical === 'claude') {
     const creds = await readClaudeCredentials(options && options.home)
     if (!creds) throw new Error('Claude CLI credentials not found')
     return {
       accessToken: creds.accessToken,
-      refreshToken: creds.refreshToken,
+      refreshToken: creds.refreshToken || '',
       expiresAt: creds.expiresAt,
-      email: 'Claude Code CLI User'
+      email: creds.email || 'Claude Code CLI User',
     }
   }
 
-  if (provider === 'copilot') {
+  if (canonical === 'copilot') {
     let tok = process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN || ''
     let email = 'GitHub Copilot User'
-    if (info.path && info.path !== 'GITHUB_COPILOT_TOKEN env') {
+    if (info.source === 'file' && info.path) {
       const cp = await readJson(info.path)
       if (cp) {
         const gh = cp['github.com'] || cp
@@ -228,6 +250,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
         email = gh.user || email
       }
     }
+    if (!tok) throw new Error('no Copilot token found')
     return {
       accessToken: tok,
       refreshToken: tok,
@@ -238,10 +261,54 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
+  if (canonical === 'cursor') {
+    if (info.source === 'env' || !info.path || info.path.includes('env') || info.path === 'CURSOR_ACCESS_TOKEN') {
+      const token = process.env.CURSOR_ACCESS_TOKEN
+      if (!token) throw new Error('CURSOR_ACCESS_TOKEN environment variable not set')
+      return {
+        accessToken: token,
+        refreshToken: '',
+        expiresAt: Date.now() + 30 * 86400 * 1000,
+        email: 'Cursor IDE User',
+      }
+    }
+    const raw = await readJson(info.path)
+    if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
+    const token = (raw && (raw.accessToken || raw.access_token || (raw.authInfo && raw.authInfo.authId))) || process.env.CURSOR_ACCESS_TOKEN || ''
+    return {
+      accessToken: token,
+      refreshToken: '',
+      expiresAt: Date.now() + 30 * 86400 * 1000,
+      email: (raw && raw.authInfo && raw.authInfo.email) || raw.email || 'Cursor User',
+    }
+  }
+
+  if (canonical === 'kiro') {
+    if (info.source === 'env' || !info.path || info.path.includes('env') || info.path === 'KIRO_API_KEY') {
+      const token = process.env.KIRO_API_KEY
+      if (!token) throw new Error('KIRO_API_KEY environment variable not set')
+      return {
+        accessToken: token,
+        refreshToken: '',
+        expiresAt: Date.now() + 30 * 86400 * 1000,
+        email: 'AWS Kiro API Key',
+      }
+    }
+    const raw = await readJson(info.path)
+    if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
+    const token = (raw && (raw.accessToken || raw.access_token || raw.token)) || process.env.KIRO_API_KEY || ''
+    return {
+      accessToken: token,
+      refreshToken: (raw && (raw.refreshToken || raw.refresh_token)) || '',
+      expiresAt: (raw && raw.expiresAt) || (Date.now() + 30 * 86400 * 1000),
+      email: (raw && raw.email) || 'AWS Kiro User',
+    }
+  }
+
   const raw = await readJson(info.path)
   if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
 
-  if (provider === 'codex') {
+  if (canonical === 'codex') {
     const tok = raw.tokens || raw
     return {
       accessToken: tok.access_token || tok.accessToken || '',
@@ -252,7 +319,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'grok') {
+  if (canonical === 'grok') {
     const tok = raw.tokens || raw
     return {
       accessToken: tok.access_token || tok.token || '',
@@ -262,7 +329,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'antigravity') {
+  if (canonical === 'antigravity') {
     const tok = raw.token || raw
     return {
       accessToken: tok.access_token || tok.accessToken || '',
@@ -273,7 +340,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'kimi') {
+  if (canonical === 'kimi') {
     return {
       accessToken: raw.access_token || raw.token || '',
       refreshToken: raw.refresh_token || '',
@@ -282,7 +349,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'glm') {
+  if (canonical === 'glm') {
     const apiKey = raw.apiKey || raw.api_key || (raw.provider && raw.provider.apiKey) || ''
     return {
       accessToken: apiKey,
@@ -292,25 +359,5 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'cursor') {
-    const token = process.env.CURSOR_ACCESS_TOKEN || (raw && (raw.accessToken || raw.access_token || (raw.authInfo && raw.authInfo.authId))) || ''
-    return {
-      accessToken: token,
-      refreshToken: '',
-      expiresAt: Date.now() + 30 * 86400 * 1000,
-      email: (raw && raw.authInfo && raw.authInfo.email) || 'Cursor User',
-    }
-  }
-
-  if (provider === 'kiro') {
-    const token = process.env.KIRO_API_KEY || (raw && (raw.accessToken || raw.access_token || raw.token)) || ''
-    return {
-      accessToken: token,
-      refreshToken: (raw && (raw.refreshToken || raw.refresh_token)) || '',
-      expiresAt: (raw && raw.expiresAt) || (Date.now() + 30 * 86400 * 1000),
-      email: (raw && raw.email) || 'AWS Kiro User',
-    }
-  }
-
   throw new Error(`unsupported local CLI import for provider ${provider}`)
 }

package/lib/oauth.js

@@ -1,3 +1,15 @@
+/**
+ * @param {{
+ *   authUrl: string,
+ *   clientId: string,
+ *   redirectUri: string,
+ *   challenge: string,
+ *   state: string,
+ *   extra?: Record<string, any>,
+ *   scope?: string,
+ * }} params
+ * @returns {string}
+ */
 export function buildAuthorizeUrl({
   authUrl,
   clientId,

package/lib/routes/accounts.js

@@ -143,7 +143,9 @@ export function registerAccountsRoutes(ctx, state) {
       } catch {
         body = null
       }
-      if (!body || !body.provider || !isProvider(body.provider)) {
+      const rawProv = body && body.provider
+      const prov = (rawProv === 'claude-cli') ? 'claude' : rawProv
+      if (!prov || !isProvider(prov)) {
         writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'unknown or missing provider' } })
         return
       }
@@ -153,9 +155,8 @@ export function registerAccountsRoutes(ctx, state) {
         return
       }
       try {
-        const blob = await loadLocalCliBlob(body.provider)
-        const prov = body.provider
-        const idx = Number(body.index) || 1
+        const blob = await loadLocalCliBlob(prov)
+        const idx = idxNum
         const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
         const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
         if (!exists && getSettingsApi()) {

package/lib/routes/status.js

@@ -2,7 +2,7 @@
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
-import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, fetchWithTimeout, isTimeoutError } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
@@ -257,10 +257,8 @@ export function registerStatusRoutes(ctx, state) {
       }
       let capturedQuota = null
       const probeFetch = async (url, init = {}) => {
-        const timeoutSignal = AbortSignal.timeout(15_000)
-        const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
         const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-        const res2 = await doFetch(url, { ...init, signal })
+        const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -272,12 +270,14 @@ export function registerStatusRoutes(ctx, state) {
         const latencyMs = Date.now() - t0;
         writeJson(res, 200, { ok: true, provider, index: index, ref, latencyMs, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
       } catch (e) {
+        const isTimeout = isTimeoutError(e)
         writeJson(res, 200, {
           ok: false, provider, index: index, ref,
           latencyMs: Date.now() - t0,
           email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: capturedQuota || info.quota || null,
-          error: { code: e && e.code ? e.code : 'VENDOR', message: String(e && e.message || e).slice(0, 300) },
+          isTimeout,
+          error: { code: isTimeout ? 'TIMEOUT' : (e && e.code ? e.code : 'VENDOR'), message: String(e && e.message || e).slice(0, 300) },
         })
       }
     }),
@@ -384,10 +384,8 @@ export function registerStatusRoutes(ctx, state) {
       if (typeof vendor.check === 'function') {
         let capturedQuota = null
         const probeFetch = async (url, init = {}) => {
-          const timeoutSignal = AbortSignal.timeout(15_000)
-          const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
           const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-          const res2 = await doFetch(url, { ...init, signal })
+          const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/runaway-guard.js

@@ -68,6 +68,11 @@ export class RunawayDetector {
   }
 }
 
+/**
+ * @param {AsyncIterable<any>} stream
+ * @param {Record<string, any>} [options]
+ * @returns {AsyncGenerator<any, void, unknown>}
+ */
 export async function* withRunawayGuard(stream, options = {}) {
   if (options && options.enabled === false) {
     yield* stream
@@ -79,7 +84,7 @@ export async function* withRunawayGuard(stream, options = {}) {
   for await (const chunk of stream) {
     if (chunk && chunk.type === 'finish') {
       yield chunk
-      return
+      continue
     }
 
     const text = (chunk && typeof chunk === 'object')
@@ -88,6 +93,13 @@ export async function* withRunawayGuard(stream, options = {}) {
 
     if (text && (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta' || !chunk.type)) {
       if (detector.feed(text)) {
+        if (options && typeof options === 'object') {
+          options.tripped = true
+          options.trippedReason = detector.getReason()
+          if (typeof options.onRunaway === 'function') {
+            options.onRunaway(detector.getReason())
+          }
+        }
         yield {
           type: 'finish',
           reason: {

package/lib/session-pin.js

@@ -2,10 +2,8 @@ const sessionPins = new Map()
 const DEFAULT_TTL_MS = 30 * 60 * 1000 // 30 mins
 
 /**
- * Bind a session id to an account ref for ttlMs (default 30 minutes).
- * @param {string|undefined} sessionId
- * @param {string|undefined} accountRef
- * @param {number} [ttlMs]
+ * Prune expired session pin entries.
+ * @param {number} [now]
  * @returns {void}
  */
 export function pruneSessionPins(now = Date.now()) {
@@ -16,6 +14,13 @@ export function pruneSessionPins(now = Date.now()) {
   }
 }
 
+/**
+ * Bind a session id to an account ref for ttlMs (default 30 minutes).
+ * @param {string|undefined} sessionId
+ * @param {string|undefined} accountRef
+ * @param {number} [ttlMs]
+ * @returns {void}
+ */
 export function pinSession(sessionId, accountRef, ttlMs = DEFAULT_TTL_MS) {
   if (!sessionId || !accountRef) return
   if (sessionPins.size >= 50) {

package/lib/sse.js

@@ -1,3 +1,8 @@
+/**
+ * @param {any} body
+ * @param {{ idleTimeoutMs?: number, signal?: AbortSignal }} [options]
+ * @returns {AsyncGenerator<string, void, unknown>}
+ */
 export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {}) {
   const reader = body && typeof body.getReader === 'function' ? body.getReader() : null
   const decoder = new TextDecoder()
@@ -38,7 +43,7 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
     const timeoutPromise = new Promise((_, reject) => {
       if (!idleTimeoutMs || idleTimeoutMs <= 0) return
       timer = setTimeout(() => {
-        const err = new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`)
+        const err = /** @type {Error & { code?: string }} */ (new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`))
         err.code = 'TIMEOUT'
         reject(err)
       }, idleTimeoutMs)

package/lib/stream-rotate.js

@@ -41,7 +41,7 @@ export async function* streamWithRotation({
         return
       }
       if (lastError) throw lastError
-      const err = new Error('no usable subscription account for this provider')
+      const err = /** @type {Error & { code?: string }} */ (new Error('no usable subscription account for this provider'))
       err.code = 'RATE_LIMIT'
       throw err
     }
@@ -53,7 +53,18 @@ export async function* streamWithRotation({
 
     while (true) {
       try {
-        const guardedStream = withRunawayGuard(streamOnce(account, options), options && options.runawayGuard)
+        const runawayState = options && options._runawayState ? options._runawayState : { tripped: false, reason: null }
+        const runawayOpts = {
+          ...(options && options.runawayGuard),
+          onRunaway: (reason) => {
+            runawayState.tripped = true
+            runawayState.reason = reason
+          },
+        }
+        const guardedStream = withRunawayGuard(
+          streamOnce(account, { ...options, _runawayState: runawayState }),
+          runawayOpts
+        )
         for await (const chunk of guardedStream) {
           firstChunkDelivered = true
           yield chunk

package/lib/vendor-factory.js

@@ -13,8 +13,8 @@ import { codexResponsesBody, modelCatalog } from "./messages.js"
 import { formTokenRequest, jsonTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError } from "./wire.js"
 import { emailFromToken } from "./jwt.js"
 
-function defaultModels(models) {
-  return modelCatalog("custom", (models || []).map((row) => (typeof row === "string" ? { id: row, name: row } : row)))
+function defaultModels(providerId, models) {
+  return modelCatalog(providerId, (models || []).map((row) => (typeof row === "string" ? { id: row, name: row } : row)))
 }
 
 /**
@@ -69,7 +69,8 @@ export function createVendorFromProfile(profile) {
         code_verifier: pkce.verifier,
       }
       const req = tokenStyle === "json" ? jsonTokenRequest : formTokenRequest
-      const json = await req(profile.tokenUrl, params, fetchImpl)
+      const tokenFetch = (u, i, o) => fetchWithTimeout(fetchImpl || fetch, u, i, { timeoutMs: 30000, ...(o || {}) })
+      const json = await req(profile.tokenUrl, params, tokenFetch)
       const blob = tokenBlobFromOAuth(json)
       return { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || name }
     },
@@ -80,11 +81,12 @@ export function createVendorFromProfile(profile) {
         refresh_token: blob.refreshToken,
       }
       const req = tokenStyle === "json" ? jsonTokenRequest : formTokenRequest
-      const json = await req(profile.tokenUrl, params, fetchImpl)
+      const tokenFetch = (u, i, o) => fetchWithTimeout(fetchImpl || fetch, u, i, { timeoutMs: 30000, ...(o || {}) })
+      const json = await req(profile.tokenUrl, params, tokenFetch)
       return tokenBlobFromOAuth(json, { label: blob.label, email: blob.email })
     },
     async listModels(blob, cfg, fetchImpl) {
-      const catalog = defaultModels(cfg.models || profile.models || [])
+      const catalog = defaultModels(id, cfg.models || profile.models || [])
       if (!profile.modelsPath) return catalog
       try {
         const res = await fetchWithTimeout(fetchImpl || fetch, `${base}${profile.modelsPath}`, {
@@ -112,7 +114,7 @@ export function createVendorFromProfile(profile) {
     async* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
       const body = codexResponsesBody(options, "")
       if (!body.instructions) delete body.instructions
-      const res = await (fetchImpl || fetch)(`${base}/responses`, {
+      const res = await fetchWithTimeout(fetchImpl || fetch, `${base}/responses`, {
         method: "POST",
         headers: {
           ...headers,
@@ -122,7 +124,7 @@ export function createVendorFromProfile(profile) {
         },
         body: JSON.stringify(body),
         signal,
-      })
+      }, { timeoutMs: 60000, stream: true })
       if (!res.ok) throw httpError(res.status, await res.text())
       yield* codexResponsesStream(res.body)
     },