@goodandready/dsh-subscriptions 0.6.41 → 0.6.43

package/lib/accounts.js

@@ -1,5 +1,5 @@
 import { needsWarmupProbe, enterProbing, resolveWarmupSuccess, resolveWarmupFailure, STATUS_QUARANTINE, STATUS_PROBING } from "./quarantine.js"
-import { fetchWithTimeout } from "./http.js"
+import { fetchWithTimeout, isTimeoutError } from "./http.js"
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { oauthRef, isProvider } from './refs.js'
 import { parseBlob, serializeBlob } from './blob.js'
@@ -75,7 +75,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   const doFetch = fetchImpl || fetch
   // #88: per-account proxy fetch for token refresh / usage (falls back to doFetch).
   const rawFetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
-  const fetchFor = (ref) => (url, init, opts) => fetchWithTimeout(rawFetchFor(ref), url, init, { timeoutMs: 25000, ...(opts || {}) })
+  const fetchFor = (ref, defaultTimeoutMs = 25000) => (url, init, opts) => fetchWithTimeout(rawFetchFor(ref), url, init, { timeoutMs: defaultTimeoutMs, ...(opts || {}) })
 
   async function resolveRaw(ref) {
     try {
@@ -89,7 +89,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   async function loadBlob(ref) {
     const raw = await resolveRaw(ref)
     if (!raw) {
-      const err = new Error(`no token for ${ref}`)
+      const err = /** @type {Error & { code?: string }} */ (new Error(`no token for ${ref}`))
       err.code = 'AUTH'
       throw err
     }
@@ -103,7 +103,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
       try {
         await credentials.set(credentialRef(ref), serializeBlob(blob))
       } catch (err) {
-        const wrapErr = new Error(`failed to persist credentials for ${ref}: ${err && err.message || err}`)
+        const wrapErr = /** @type {Error & { code?: string, cause?: any }} */ (new Error(`failed to persist credentials for ${ref}: ${err && err.message || err}`))
         wrapErr.code = "CREDENTIAL_SAVE_FAILED"
         wrapErr.cause = err
         throw wrapErr
@@ -171,6 +171,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
       healthBadge: healthBadge(computeHealthScore(health.get(ref) || null)),
       usagePercent: usage.has(ref) ? usage.get(ref) : null,
       refreshError: refreshFailures.get(ref)?.error || '',
+      isTimeout: !!refreshFailures.get(ref)?.isTimeout,
       validationUrl: base.validationUrl || '',
       validationMessage: base.validationMessage || '',
       accountNotice: base.accountNotice || '',
@@ -227,7 +228,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         const curConfig = getConfig()
         const cfg = vendorConfig(provider, curConfig)
         const next = await executeWithRetry(
-          () => getVendor(provider).refresh(cfg, blob, fetchFor(ref)),
+          () => getVendor(provider).refresh(cfg, blob, fetchFor(ref, 30000)),
           {
             maxRetries: 2,
             initialDelayMs: 300,
@@ -250,7 +251,11 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         if (ref) refreshFailures.delete(ref)
         return merged
       } catch (e) {
-        if (ref) refreshFailures.set(ref, { at: Date.now(), error: String(e && e.message || e) })
+        const isTimeout = isTimeoutError(e)
+        const errMsg = isTimeout
+          ? `Network timeout refreshing token: ${e.message || 'timed out'}`
+          : String(e && e.message || e)
+        if (ref) refreshFailures.set(ref, { at: Date.now(), error: errMsg, isTimeout })
         throw e
       } finally {
         refreshLocks.delete(lockKey)
@@ -287,7 +292,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
           try {
             usageFetched.set(slot.ref, Date.now())
             const blob = await ensureFresh(provider, parseBlob(raw), slot.ref)
-            const snap = await vendor.usage(blob, cfg, fetchFor(slot.ref))
+            const usageTimeout = Number(curConfig?.usageTimeoutMs) || 15000
+            const snap = await vendor.usage(blob, cfg, fetchFor(slot.ref, usageTimeout))
             if (!snap) return
             if (Number.isFinite(Number(snap.usedPercent))) {
               usage.set(slot.ref, Number(snap.usedPercent))
@@ -322,8 +328,12 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
                 }
               } catch { /* persistence best-effort */ }
             }
-          } catch {
+          } catch (err) {
             usageFetched.set(slot.ref, Date.now())
+            const isTimeout = isTimeoutError(err)
+            if (isTimeout && !refreshFailures.has(slot.ref)) {
+              refreshFailures.set(slot.ref, { at: Date.now(), error: `Network timeout fetching usage: ${err.message || 'timed out'}`, isTimeout: true })
+            }
           } finally {
             slotUsageLocks.delete(slot.ref)
           }

package/lib/adapter.js

@@ -53,14 +53,16 @@ export class SubscriptionAdapter extends LlmAdapter {
     let models = null
     if (targetAccount) {
       const cfg = this.deps.vendorConfig(provider)
-      const fetchImpl = pickFetch(this.deps, targetAccount.ref)
+      const baseFetch = pickFetch(this.deps, targetAccount.ref)
+      const listModelsFetch = (url, init, opts) =>
+        fetchWithTimeout(baseFetch, url, init, { timeoutMs: 15000, ...(opts || {}) })
       try {
         const blob = await this.deps.ensureFresh(
           provider,
           await this.deps.loadBlob(targetAccount.ref),
           targetAccount.ref,
         )
-        const live = await getVendor(provider).listModels(blob, cfg, fetchImpl)
+        const live = await getVendor(provider).listModels(blob, cfg, listModelsFetch)
         if (Array.isArray(live) && live.length) models = live
       } catch { /* use built-in catalog */ }
     }
@@ -200,7 +202,7 @@ export class SubscriptionAdapter extends LlmAdapter {
           // ponytail: capture x-ratelimit headers without touching vendors
           const baseFetch = pickFetch(deps, account.ref)
           const quotaFetch = async (url, init) => {
-            const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
+            const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 60000, stream: true })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
               if (snap && typeof deps.rememberQuota === "function") {
@@ -221,7 +223,9 @@ export class SubscriptionAdapter extends LlmAdapter {
             } catch { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
-                const txt = await res.clone().text()
+                const textPromise = res.clone().text()
+                const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 5000))
+                const txt = await Promise.race([textPromise, timeoutPromise])
                 let j=null; try { j = JSON.parse(txt) } catch { j = null }
                 if (j) {
                   const b = parseBody(provider, j, Date.now())

package/lib/backoff.js

@@ -1,9 +1,21 @@
+/**
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @param {{
+ *   maxRetries?: number,
+ *   initialDelayMs?: number,
+ *   maxDelayMs?: number,
+ *   factor?: number,
+ *   isRetryable?: (err: any) => boolean,
+ * }} [options]
+ * @returns {Promise<T>}
+ */
 export async function executeWithRetry(fn, {
   maxRetries = 3,
   initialDelayMs = 200,
   maxDelayMs = 3000,
   factor = 2,
-  isRetryable = () => true
+  isRetryable = (_err) => true
 } = {}) {
   let attempt = 0
   let delay = initialDelayMs

package/lib/code-assist.js

@@ -204,6 +204,7 @@ export function streamEnvelope({ projectId, model, request, userAgent, sessionId
   const session = sessionId || randomUUID()
   const body = { ...(request || {}) }
   if (!body.session_id) body.session_id = session
+  /** @type {Record<string, any>} */
   const envelope = {
     ...(projectId ? { project: projectId } : {}),
     model,

package/lib/google-validation.js

@@ -98,7 +98,7 @@ export function validationFromHttpError(status, bodyText) {
 }
 
 export function validationRequiredError(details) {
-  const err = new Error(`${details.message} Verify at ${details.validationUrl}`)
+  const err = /** @type {Error & { code?: string, validationUrl?: string, learnMoreUrl?: string }} */ (new Error(`${details.message} Verify at ${details.validationUrl}`))
   err.code = 'VALIDATION_REQUIRED'
   err.validationUrl = details.validationUrl
   if (details.learnMoreUrl) err.learnMoreUrl = details.learnMoreUrl

package/lib/http.js

@@ -81,7 +81,7 @@ export function isTrustedSettingsRequest(request) {
   if (secFetchSite === 'cross-site') return false
 
   // 2. If origin header is present, it must match host
-  const host = headers.host || headers['x-forwarded-host']
+  const host = String(Array.isArray(headers.host) ? headers.host[0] : (headers.host || headers['x-forwarded-host'] || ''))
   const origin = headers.origin
   if (origin) {
     try {
@@ -167,17 +167,36 @@ export function sanitizeRequestHeaders(url, init = {}, options = {}) {
         delete headers.Cookie
       }
     }
-  } catch {}
+  } catch (err) {
+    void err
+    return headers
+  }
   return headers
 }
 
-export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins } = {}) {
+export function isTimeoutError(err) {
+  if (!err) return false
+  return err.name === 'TimeoutError'
+    || err.code === 'ETIMEDOUT'
+    || (err.name === 'AbortError' && String(err.message || '').toLowerCase().includes('timeout'))
+    || String(err.message || '').toLowerCase().includes('aborted due to timeout')
+    || String(err.message || '').toLowerCase().includes('timed out')
+    || String(err.message || '').toLowerCase().includes('operation was aborted')
+}
+
+/**
+ * @param {any} fetchImpl
+ * @param {string} url
+ * @param {any} [init]
+ * @param {{ timeoutMs?: number, allowedOrigins?: string[], stream?: boolean }} [options]
+ */
+export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins, stream = false } = {}) {
   const safeHeaders = sanitizeRequestHeaders(url, init, { allowedOrigins })
   init = { ...init, headers: safeHeaders }
   const impl = fetchImpl || fetch
   if (!timeoutMs || timeoutMs <= 0) return impl(url, init)
   const controller = new AbortController()
-  const timer = setTimeout(() => {
+  let timer = setTimeout(() => {
     controller.abort(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
   }, timeoutMs)
 
@@ -186,9 +205,74 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
     : controller.signal
 
   try {
-    return await impl(url, { ...init, signal })
-  } finally {
+    const res = await impl(url, { ...init, signal })
+    if (stream) {
+      clearTimeout(timer)
+      return res
+    }
+    const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
+    const origText = typeof res.text === 'function' ? res.text.bind(res) : null
+    if (origJson) {
+      res.json = () => {
+        if (controller.signal.aborted) {
+          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+        }
+        return new Promise((resolve, reject) => {
+          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+          controller.signal.addEventListener('abort', onAbort, { once: true })
+          origJson().then(
+            (val) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              resolve(val)
+            },
+            (err) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              if (controller.signal.aborted) {
+                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+              } else {
+                reject(err)
+              }
+            }
+          )
+        })
+      }
+    }
+    if (origText) {
+      res.text = () => {
+        if (controller.signal.aborted) {
+          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+        }
+        return new Promise((resolve, reject) => {
+          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+          controller.signal.addEventListener('abort', onAbort, { once: true })
+          origText().then(
+            (val) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              resolve(val)
+            },
+            (err) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              if (controller.signal.aborted) {
+                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+              } else {
+                reject(err)
+              }
+            }
+          )
+        })
+      }
+    }
+    return res
+  } catch (err) {
     clearTimeout(timer)
+    if (controller.signal.aborted && !isTimeoutError(err)) {
+      throw new DOMException('The operation was aborted due to timeout', 'TimeoutError')
+    }
+    throw err
   }
 }
 

package/lib/import-auth.js

@@ -39,6 +39,7 @@ async function discoverLocalCliSessionsInner() {
     const tok = codex.tokens || codex
     detected.codex = {
       provider: 'codex',
+      source: 'file',
       path: homeFile('.codex', 'auth.json'),
       email: codex.email || codex.account || '',
       hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
@@ -54,6 +55,7 @@ async function discoverLocalCliSessionsInner() {
     if (grok && (grok.access_token || grok.token || (grok.tokens && grok.tokens.access_token))) {
       detected.grok = {
         provider: 'grok',
+        source: 'file',
         path: p,
         email: grok.email || grok.account || '',
         hasRefreshToken: !!(grok.refresh_token || (grok.tokens && grok.tokens.refresh_token)),
@@ -73,6 +75,7 @@ async function discoverLocalCliSessionsInner() {
     if (tok && (tok.access_token || tok.accessToken)) {
       detected.antigravity = {
         provider: 'antigravity',
+        source: 'file',
         path: p,
         email: agy.email || tok.account || '',
         hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
@@ -86,6 +89,7 @@ async function discoverLocalCliSessionsInner() {
   if (kimi && (kimi.access_token || kimi.token)) {
     detected.kimi = {
       provider: 'kimi',
+      source: 'file',
       path: homeFile('.kimi-code', 'credentials', 'kimi-code.json'),
       email: kimi.email || kimi.account || '',
       hasRefreshToken: !!(kimi.refresh_token || kimi.refreshToken),
@@ -103,6 +107,7 @@ async function discoverLocalCliSessionsInner() {
     if (glm && (glm.apiKey || glm.api_key || (glm.provider && glm.provider.apiKey))) {
       detected.glm = {
         provider: 'glm',
+        source: 'file',
         path: p,
         email: 'ZCode CLI Account',
         hasRefreshToken: false,
@@ -111,20 +116,31 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 6. Cursor Token (env, CLI config or IDE state)
+  // 6. Cursor Token (CLI config, auth.json, or env)
   const cursorCliConfig = await readJson(homeFile('.cursor', 'cli-config.json'))
-  if (process.env.CURSOR_ACCESS_TOKEN) {
+  const cursorAuthConfig = await readJson(homeFile('.cursor', 'auth.json'))
+  if (cursorCliConfig && (cursorCliConfig.authInfo || cursorCliConfig.serverConfigCache)) {
     detected.cursor = {
       provider: 'cursor',
-      path: 'CURSOR_ACCESS_TOKEN env',
-      email: 'Cursor IDE User',
+      source: 'file',
+      path: homeFile('.cursor', 'cli-config.json'),
+      email: (cursorCliConfig.authInfo && cursorCliConfig.authInfo.email) || 'Cursor CLI User',
       hasRefreshToken: false,
     }
-  } else if (cursorCliConfig && (cursorCliConfig.authInfo || cursorCliConfig.serverConfigCache)) {
+  } else if (cursorAuthConfig && (cursorAuthConfig.accessToken || cursorAuthConfig.access_token || (cursorAuthConfig.authInfo && cursorAuthConfig.authInfo.authId))) {
     detected.cursor = {
       provider: 'cursor',
-      path: homeFile('.cursor', 'cli-config.json'),
-      email: (cursorCliConfig.authInfo && cursorCliConfig.authInfo.email) || 'Cursor CLI User',
+      source: 'file',
+      path: homeFile('.cursor', 'auth.json'),
+      email: (cursorAuthConfig.authInfo && cursorAuthConfig.authInfo.email) || cursorAuthConfig.email || 'Cursor User',
+      hasRefreshToken: false,
+    }
+  } else if (process.env.CURSOR_ACCESS_TOKEN) {
+    detected.cursor = {
+      provider: 'cursor',
+      source: 'env',
+      path: 'CURSOR_ACCESS_TOKEN',
+      email: 'Cursor IDE User',
       hasRefreshToken: false,
     }
   }
@@ -139,6 +155,7 @@ async function discoverLocalCliSessionsInner() {
     if (k && (k.accessToken || k.access_token || k.token)) {
       detected.kiro = {
         provider: 'kiro',
+        source: 'file',
         path: p,
         email: k.email || k.account || 'AWS Kiro User',
         hasRefreshToken: !!(k.refreshToken || k.refresh_token),
@@ -149,7 +166,8 @@ async function discoverLocalCliSessionsInner() {
   if (!detected.kiro && process.env.KIRO_API_KEY) {
     detected.kiro = {
       provider: 'kiro',
-      path: 'KIRO_API_KEY env',
+      source: 'env',
+      path: 'KIRO_API_KEY',
       email: 'AWS Kiro API Key',
       hasRefreshToken: false,
     }
@@ -158,12 +176,15 @@ async function discoverLocalCliSessionsInner() {
   // 8. Claude CLI Direct Import
   const claudeCreds = await readClaudeCredentials(activeHome)
   if (claudeCreds) {
-    detected['claude-cli'] = {
+    const claudeEntry = {
       provider: 'claude',
+      source: 'file',
       path: homeFile('.claude', 'credentials.json'),
-      email: 'Claude Code CLI User',
+      email: claudeCreds.email || 'Claude Code CLI User',
       hasRefreshToken: !!claudeCreds.refreshToken,
     }
+    detected.claude = claudeEntry
+    detected['claude-cli'] = claudeEntry
   }
 
   // 9. GitHub Copilot token
@@ -179,6 +200,7 @@ async function discoverLocalCliSessionsInner() {
       if (tok) {
         detected.copilot = {
           provider: 'copilot',
+          source: 'file',
           path: p,
           email: gh.user || 'GitHub Copilot User',
           hasRefreshToken: false,
@@ -190,37 +212,37 @@ async function discoverLocalCliSessionsInner() {
   if (!detected.copilot && (process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN)) {
     detected.copilot = {
       provider: 'copilot',
-      path: 'GITHUB_COPILOT_TOKEN env',
+      source: 'env',
+      path: process.env.GITHUB_COPILOT_TOKEN ? 'GITHUB_COPILOT_TOKEN' : 'GH_TOKEN',
       email: 'GitHub Copilot User',
       hasRefreshToken: false,
     }
   }
 
-
-
   return detected
 }
 
 export async function loadLocalCliBlob(provider, options = {}) {
+  const canonical = (provider === 'claude-cli') ? 'claude' : provider
   const discovered = await discoverLocalCliSessions(options)
-  const info = discovered[provider]
+  const info = discovered[canonical] || discovered[provider]
   if (!info) throw new Error(`no local CLI session found for ${provider}`)
 
-  if (provider === 'claude-cli' || (provider === 'claude' && info.provider === 'claude')) {
+  if (canonical === 'claude') {
     const creds = await readClaudeCredentials(options && options.home)
     if (!creds) throw new Error('Claude CLI credentials not found')
     return {
       accessToken: creds.accessToken,
-      refreshToken: creds.refreshToken,
+      refreshToken: creds.refreshToken || '',
       expiresAt: creds.expiresAt,
-      email: 'Claude Code CLI User'
+      email: creds.email || 'Claude Code CLI User',
     }
   }
 
-  if (provider === 'copilot') {
+  if (canonical === 'copilot') {
     let tok = process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN || ''
     let email = 'GitHub Copilot User'
-    if (info.path && info.path !== 'GITHUB_COPILOT_TOKEN env') {
+    if (info.source === 'file' && info.path) {
       const cp = await readJson(info.path)
       if (cp) {
         const gh = cp['github.com'] || cp
@@ -228,6 +250,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
         email = gh.user || email
       }
     }
+    if (!tok) throw new Error('no Copilot token found')
     return {
       accessToken: tok,
       refreshToken: tok,
@@ -238,10 +261,54 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
+  if (canonical === 'cursor') {
+    if (info.source === 'env' || !info.path || info.path.includes('env') || info.path === 'CURSOR_ACCESS_TOKEN') {
+      const token = process.env.CURSOR_ACCESS_TOKEN
+      if (!token) throw new Error('CURSOR_ACCESS_TOKEN environment variable not set')
+      return {
+        accessToken: token,
+        refreshToken: '',
+        expiresAt: Date.now() + 30 * 86400 * 1000,
+        email: 'Cursor IDE User',
+      }
+    }
+    const raw = await readJson(info.path)
+    if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
+    const token = (raw && (raw.accessToken || raw.access_token || (raw.authInfo && raw.authInfo.authId))) || process.env.CURSOR_ACCESS_TOKEN || ''
+    return {
+      accessToken: token,
+      refreshToken: '',
+      expiresAt: Date.now() + 30 * 86400 * 1000,
+      email: (raw && raw.authInfo && raw.authInfo.email) || raw.email || 'Cursor User',
+    }
+  }
+
+  if (canonical === 'kiro') {
+    if (info.source === 'env' || !info.path || info.path.includes('env') || info.path === 'KIRO_API_KEY') {
+      const token = process.env.KIRO_API_KEY
+      if (!token) throw new Error('KIRO_API_KEY environment variable not set')
+      return {
+        accessToken: token,
+        refreshToken: '',
+        expiresAt: Date.now() + 30 * 86400 * 1000,
+        email: 'AWS Kiro API Key',
+      }
+    }
+    const raw = await readJson(info.path)
+    if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
+    const token = (raw && (raw.accessToken || raw.access_token || raw.token)) || process.env.KIRO_API_KEY || ''
+    return {
+      accessToken: token,
+      refreshToken: (raw && (raw.refreshToken || raw.refresh_token)) || '',
+      expiresAt: (raw && raw.expiresAt) || (Date.now() + 30 * 86400 * 1000),
+      email: (raw && raw.email) || 'AWS Kiro User',
+    }
+  }
+
   const raw = await readJson(info.path)
   if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
 
-  if (provider === 'codex') {
+  if (canonical === 'codex') {
     const tok = raw.tokens || raw
     return {
       accessToken: tok.access_token || tok.accessToken || '',
@@ -252,7 +319,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'grok') {
+  if (canonical === 'grok') {
     const tok = raw.tokens || raw
     return {
       accessToken: tok.access_token || tok.token || '',
@@ -262,7 +329,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'antigravity') {
+  if (canonical === 'antigravity') {
     const tok = raw.token || raw
     return {
       accessToken: tok.access_token || tok.accessToken || '',
@@ -273,7 +340,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'kimi') {
+  if (canonical === 'kimi') {
     return {
       accessToken: raw.access_token || raw.token || '',
       refreshToken: raw.refresh_token || '',
@@ -282,7 +349,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'glm') {
+  if (canonical === 'glm') {
     const apiKey = raw.apiKey || raw.api_key || (raw.provider && raw.provider.apiKey) || ''
     return {
       accessToken: apiKey,
@@ -292,25 +359,5 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'cursor') {
-    const token = process.env.CURSOR_ACCESS_TOKEN || (raw && (raw.accessToken || raw.access_token || (raw.authInfo && raw.authInfo.authId))) || ''
-    return {
-      accessToken: token,
-      refreshToken: '',
-      expiresAt: Date.now() + 30 * 86400 * 1000,
-      email: (raw && raw.authInfo && raw.authInfo.email) || 'Cursor User',
-    }
-  }
-
-  if (provider === 'kiro') {
-    const token = process.env.KIRO_API_KEY || (raw && (raw.accessToken || raw.access_token || raw.token)) || ''
-    return {
-      accessToken: token,
-      refreshToken: (raw && (raw.refreshToken || raw.refresh_token)) || '',
-      expiresAt: (raw && raw.expiresAt) || (Date.now() + 30 * 86400 * 1000),
-      email: (raw && raw.email) || 'AWS Kiro User',
-    }
-  }
-
   throw new Error(`unsupported local CLI import for provider ${provider}`)
 }

package/lib/oauth.js

@@ -1,3 +1,15 @@
+/**
+ * @param {{
+ *   authUrl: string,
+ *   clientId: string,
+ *   redirectUri: string,
+ *   challenge: string,
+ *   state: string,
+ *   extra?: Record<string, any>,
+ *   scope?: string,
+ * }} params
+ * @returns {string}
+ */
 export function buildAuthorizeUrl({
   authUrl,
   clientId,

package/lib/routes/accounts.js

@@ -143,7 +143,9 @@ export function registerAccountsRoutes(ctx, state) {
       } catch {
         body = null
       }
-      if (!body || !body.provider || !isProvider(body.provider)) {
+      const rawProv = body && body.provider
+      const prov = (rawProv === 'claude-cli') ? 'claude' : rawProv
+      if (!prov || !isProvider(prov)) {
         writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'unknown or missing provider' } })
         return
       }
@@ -153,9 +155,8 @@ export function registerAccountsRoutes(ctx, state) {
         return
       }
       try {
-        const blob = await loadLocalCliBlob(body.provider)
-        const prov = body.provider
-        const idx = Number(body.index) || 1
+        const blob = await loadLocalCliBlob(prov)
+        const idx = idxNum
         const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
         const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
         if (!exists && getSettingsApi()) {

package/lib/routes/status.js

@@ -2,7 +2,7 @@
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
-import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, fetchWithTimeout, isTimeoutError } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
@@ -257,10 +257,8 @@ export function registerStatusRoutes(ctx, state) {
       }
       let capturedQuota = null
       const probeFetch = async (url, init = {}) => {
-        const timeoutSignal = AbortSignal.timeout(15_000)
-        const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
         const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-        const res2 = await doFetch(url, { ...init, signal })
+        const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -272,12 +270,14 @@ export function registerStatusRoutes(ctx, state) {
         const latencyMs = Date.now() - t0;
         writeJson(res, 200, { ok: true, provider, index: index, ref, latencyMs, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
       } catch (e) {
+        const isTimeout = isTimeoutError(e)
         writeJson(res, 200, {
           ok: false, provider, index: index, ref,
           latencyMs: Date.now() - t0,
           email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: capturedQuota || info.quota || null,
-          error: { code: e && e.code ? e.code : 'VENDOR', message: String(e && e.message || e).slice(0, 300) },
+          isTimeout,
+          error: { code: isTimeout ? 'TIMEOUT' : (e && e.code ? e.code : 'VENDOR'), message: String(e && e.message || e).slice(0, 300) },
         })
       }
     }),
@@ -384,10 +384,8 @@ export function registerStatusRoutes(ctx, state) {
       if (typeof vendor.check === 'function') {
         let capturedQuota = null
         const probeFetch = async (url, init = {}) => {
-          const timeoutSignal = AbortSignal.timeout(15_000)
-          const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
           const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-          const res2 = await doFetch(url, { ...init, signal })
+          const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/runaway-guard.js

@@ -68,6 +68,11 @@ export class RunawayDetector {
   }
 }
 
+/**
+ * @param {AsyncIterable<any>} stream
+ * @param {Record<string, any>} [options]
+ * @returns {AsyncGenerator<any, void, unknown>}
+ */
 export async function* withRunawayGuard(stream, options = {}) {
   if (options && options.enabled === false) {
     yield* stream

package/lib/session-pin.js

@@ -2,10 +2,8 @@ const sessionPins = new Map()
 const DEFAULT_TTL_MS = 30 * 60 * 1000 // 30 mins
 
 /**
- * Bind a session id to an account ref for ttlMs (default 30 minutes).
- * @param {string|undefined} sessionId
- * @param {string|undefined} accountRef
- * @param {number} [ttlMs]
+ * Prune expired session pin entries.
+ * @param {number} [now]
  * @returns {void}
  */
 export function pruneSessionPins(now = Date.now()) {
@@ -16,6 +14,13 @@ export function pruneSessionPins(now = Date.now()) {
   }
 }
 
+/**
+ * Bind a session id to an account ref for ttlMs (default 30 minutes).
+ * @param {string|undefined} sessionId
+ * @param {string|undefined} accountRef
+ * @param {number} [ttlMs]
+ * @returns {void}
+ */
 export function pinSession(sessionId, accountRef, ttlMs = DEFAULT_TTL_MS) {
   if (!sessionId || !accountRef) return
   if (sessionPins.size >= 50) {

package/lib/sse.js

@@ -1,3 +1,8 @@
+/**
+ * @param {any} body
+ * @param {{ idleTimeoutMs?: number, signal?: AbortSignal }} [options]
+ * @returns {AsyncGenerator<string, void, unknown>}
+ */
 export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {}) {
   const reader = body && typeof body.getReader === 'function' ? body.getReader() : null
   const decoder = new TextDecoder()
@@ -38,7 +43,7 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
     const timeoutPromise = new Promise((_, reject) => {
       if (!idleTimeoutMs || idleTimeoutMs <= 0) return
       timer = setTimeout(() => {
-        const err = new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`)
+        const err = /** @type {Error & { code?: string }} */ (new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`))
         err.code = 'TIMEOUT'
         reject(err)
       }, idleTimeoutMs)

package/lib/stream-rotate.js

@@ -41,7 +41,7 @@ export async function* streamWithRotation({
         return
       }
       if (lastError) throw lastError
-      const err = new Error('no usable subscription account for this provider')
+      const err = /** @type {Error & { code?: string }} */ (new Error('no usable subscription account for this provider'))
       err.code = 'RATE_LIMIT'
       throw err
     }

package/lib/vendor-factory.js

@@ -69,7 +69,8 @@ export function createVendorFromProfile(profile) {
         code_verifier: pkce.verifier,
       }
       const req = tokenStyle === "json" ? jsonTokenRequest : formTokenRequest
-      const json = await req(profile.tokenUrl, params, fetchImpl)
+      const tokenFetch = (u, i, o) => fetchWithTimeout(fetchImpl || fetch, u, i, { timeoutMs: 30000, ...(o || {}) })
+      const json = await req(profile.tokenUrl, params, tokenFetch)
       const blob = tokenBlobFromOAuth(json)
       return { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || name }
     },
@@ -80,7 +81,8 @@ export function createVendorFromProfile(profile) {
         refresh_token: blob.refreshToken,
       }
       const req = tokenStyle === "json" ? jsonTokenRequest : formTokenRequest
-      const json = await req(profile.tokenUrl, params, fetchImpl)
+      const tokenFetch = (u, i, o) => fetchWithTimeout(fetchImpl || fetch, u, i, { timeoutMs: 30000, ...(o || {}) })
+      const json = await req(profile.tokenUrl, params, tokenFetch)
       return tokenBlobFromOAuth(json, { label: blob.label, email: blob.email })
     },
     async listModels(blob, cfg, fetchImpl) {
@@ -112,7 +114,7 @@ export function createVendorFromProfile(profile) {
     async* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
       const body = codexResponsesBody(options, "")
       if (!body.instructions) delete body.instructions
-      const res = await (fetchImpl || fetch)(`${base}/responses`, {
+      const res = await fetchWithTimeout(fetchImpl || fetch, `${base}/responses`, {
         method: "POST",
         headers: {
           ...headers,
@@ -122,7 +124,7 @@ export function createVendorFromProfile(profile) {
         },
         body: JSON.stringify(body),
         signal,
-      })
+      }, { timeoutMs: 60000, stream: true })
       if (!res.ok) throw httpError(res.status, await res.text())
       yield* codexResponsesStream(res.body)
     },

package/lib/vendors/claude-cli.js

@@ -18,7 +18,8 @@ export async function readClaudeCredentials(home) {
         accessToken: oauth.accessToken || oauth.access_token,
         refreshToken: oauth.refreshToken || oauth.refresh_token || '',
         expiresAt: oauth.expiresAt || (oauth.expires_in ? Date.now() + oauth.expires_in * 1000 : Date.now() + 3600000),
-        subscriptionType: oauth.subscriptionType || 'Claude Code'
+        subscriptionType: oauth.subscriptionType || 'Claude Code',
+        email: oauth.email || json.email || 'Claude Code CLI User',
       }
     }
     return null

package/lib/vendors/codex.js

@@ -1,3 +1,4 @@
+import { isTimeoutError } from "../http.js"
 import { randomUUID, createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { codexResponsesBody, modelCatalog } from '../messages.js'
@@ -203,14 +204,15 @@ export async function usage(blob, cfg, fetchImpl) {
     const snap = asUsageSnapshot(deepestUsedPercent(json))
     if (snap) snap.windows = usageWindows(json)
     return snap
-  } catch {
+  } catch (err) {
+    if (isTimeoutError(err)) throw err
     return null
   }
 }
 
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
   const base = (config.baseUrl || defaults().baseUrl).replace(/\/$/, '')
-  const body = codexResponsesBody(options, INSTRUCTIONS, config)
+  const body = /** @type {Record<string, any>} */ (codexResponsesBody(options, INSTRUCTIONS, config))
   const sessionId = deriveSessionId(options)
 
   // Prompt Cache Affinity

package/lib/vendors/copilot.js

@@ -296,6 +296,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
 
   if (!copilotToken) throw new LlmError("GitHub Copilot not authenticated", "AUTH")
 
+  /** @type {Record<string, any>} */
   const body = {
     model: options.model || "claude-3.7-sonnet",
     messages: openaiMessages(options),

package/lib/vendors/cursor.js

@@ -175,6 +175,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const token = blob && (blob.accessToken || blob.access_token)
   if (!token) throw new LlmError('Cursor not authenticated', 'AUTH')
 
+  /** @type {Record<string, any>} */
   const body = {
     model: options.model || 'composer-2',
     messages: openaiMessages(options),

package/lib/vendors/glm.js

@@ -84,6 +84,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const token = blob && (blob.accessToken || blob.access_token)
   if (!token) throw new LlmError('GLM not authenticated', 'AUTH')
 
+  /** @type {Record<string, any>} */
   const body = {
     model: options.model || 'glm-4-plus',
     messages: openaiMessages(options),

package/lib/vendors/kimi.js

@@ -88,6 +88,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const token = blob && (blob.accessToken || blob.access_token)
   if (!token) throw new LlmError('Kimi not authenticated', 'AUTH')
 
+  /** @type {Record<string, any>} */
   const body = {
     model: options.model || 'kimi-for-coding',
     messages: openaiMessages(options),

package/lib/vendors/kiro.js

@@ -87,6 +87,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const token = blob && (blob.accessToken || blob.access_token)
   if (!token) throw new LlmError('AWS Kiro not authenticated', 'AUTH')
 
+  /** @type {Record<string, any>} */
   const body = {
     model: options.model || 'claude-sonnet-5',
     messages: openaiMessages(options),

package/lib/vendors/qwen.js

@@ -57,6 +57,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   const key = blob && (blob.accessToken || blob.apiKey)
   if (!key) throw new LlmError('Qwen API Key or Token is required', 'AUTH')
 
+  /** @type {Record<string, any>} */
   const body = {
     model: options.model || 'qwen-2.5-coder-32b-instruct',
     messages: openaiMessages(options),

package/lib/wire.js

@@ -1,9 +1,16 @@
+import { fetchWithTimeout } from "./http.js"
 import { iterateSse, jsonSse } from './sse.js'
 import { validationFromHttpError, validationRequiredError, googleRateLimitMessage, googleLicenseMessage } from './google-validation.js'
 
+/**
+ * @param {number} status
+ * @param {string} [bodyText]
+ * @param {string} [code]
+ * @returns {Error & { status?: number, code?: string }}
+ */
 export function httpError(status, bodyText, code) {
   const snippet = String(bodyText || '').slice(0, 400)
-  const err = new Error(snippet ? `vendor http ${status}: ${snippet}` : `vendor http ${status}`)
+  const err = /** @type {Error & { status?: number, code?: string }} */ (new Error(snippet ? `vendor http ${status}: ${snippet}` : `vendor http ${status}`))
   err.status = status
   if (code) {
     err.code = code
@@ -401,25 +408,19 @@ export async function* googleStream(body) {
 }
 
 export async function formTokenRequest(url, params, fetchImpl, headers, { timeoutMs = 25000 } = {}) {
-  const impl = fetchImpl || fetch
-  const timeoutSignal = AbortSignal.timeout(timeoutMs)
-  const res = await impl(url, {
+  const res = await fetchWithTimeout(fetchImpl || fetch, url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json', ...(headers || {}) },
     body: new URLSearchParams(params),
-    signal: timeoutSignal,
-  })
+  }, { timeoutMs })
   return readJson(res)
 }
 
 export async function jsonTokenRequest(url, body, fetchImpl, headers, { timeoutMs = 25000 } = {}) {
-  const impl = fetchImpl || fetch
-  const timeoutSignal = AbortSignal.timeout(timeoutMs)
-  const res = await impl(url, {
+  const res = await fetchWithTimeout(fetchImpl || fetch, url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(headers || {}) },
     body: JSON.stringify(body),
-    signal: timeoutSignal,
-  })
+  }, { timeoutMs })
   return readJson(res)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.41",
+  "version": "0.6.43",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -54,10 +54,10 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2",
     "@deepseek-ai/schemastery": "^3.18.4"
   },
   "publishConfig": {
@@ -68,9 +68,14 @@
     "undici": "^8.10.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-credentials": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.2.0-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.4",
     "@types/node": "^22.20.2",
-    "typescript": "^7.0.2",
-    "@deepseek-ai/schemastery": "^3.18.4"
+    "eslint": "^10.4.0",
+    "typescript": "^7.0.2"
   }
 }